clamav out of date

Submitted by tbirnseth on Mon, 12/06/2010 - 15:09

This seems to be wrapped in a virtualmain wrapper so didn't want to mess with it. But I am continually getting emails about clamav being out of date. When I do a yum update clamav I get no updates available.

The email is: LibClamAV Warning: *********************************************************** LibClamAV Warning: *** This version of the ClamAV engine is outdated. *** LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq *** LibClamAV Warning: ***********************************************************

Status: 
Closed (duplicate)

Comments

Submitted by tbirnseth on Mon, 12/06/2010 - 15:50

Overly dramatic or not, it sends me sometimes 20 emails a day about it being out of date. I tried the link to the other bug but it's says I don't have permission. Can you tell me how to correct or when the current version will be available in Virtualmin?

Submitted by JamieCameron on Mon, 12/06/2010 - 16:18

It is unusual that this is emailing you ... could you post the full email here?

Submitted by andreychek on Mon, 12/06/2010 - 16:19

Yeah, the owner of the other ticket had apparently set it to private, so it won't be visible to everyone.

As far as ClamAV goes -- the version available in the Bleed repo is barely a month old, but does still generate quite a bit of chatter about being outdated.

This is a bit of an experiment -- but in "/etc/sysconfig/freshclam", I believe there's a line that looks something like this:

FRESHCLAM_DELAY=disabled-warn

Do you have that in your freshclam file?

If so, what happens if you comment it out (by putting a # in front of it), and then restarting the freshclam process (I don't have the exact script name in front of me, but that's something like: /etc/init.d/clamav-freshclam restart).

After that, do you continue to receive those notices?

Submitted by tbirnseth on Mon, 12/06/2010 - 16:30

Looks like it's already commented out:

## When changing the periodicity of freshclam runs in the crontab,
## this value must be adjusted also. Its value is the timespan between
## two subsequent freshclam runs in minutes. E.g. for the default
##
## | 0 */3 * * *  ...
##
## crontab line, the value is 180 (minutes).
# FRESHCLAM_MOD=
 
## A predefined value for the delay in seconds. By default, the value is
## calculated by the 'hostid' program. This predefined value guarantees
## constant timespans of 3 hours between two subsequent freshclam runs.
##
## This option accepts two special values:
## 'disabled-warn'  ...  disables the automatic freshclam update and
##                         gives out a warning
## 'disabled'       ...  disables the automatic freshclam silently
# FRESHCLAM_DELAY=
 
 
### !!!!! REMOVE ME !!!!!!
### REMOVE ME: By default, the freshclam update is disabled to avoid
### REMOVE ME: network access without prior activation
#FRESHCLAM_DELAY=disabled-warn  # REMOVE ME

Submitted by andreychek on Mon, 12/06/2010 - 16:33

Looks like it's already commented out:

Okay, then plan B is what Jamie asked... can you paste in the entire contents of one of the warning emails you're receiving?

That should help us figure out how to quiet it down a bit :-)

Submitted by tbirnseth on Mon, 12/06/2010 - 16:37

I did in the first post. It comes from Cron Daemon.

LibClamAV Warning: ***********************************************************
LibClamAV Warning: ***  This version of the ClamAV engine is outdated.     ***
LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq ***
LibClamAV Warning: ***********************************************************

Submitted by tbirnseth on Mon, 12/06/2010 - 16:38

And a yum list clamav shows:

clamav.x86_64                                        0.96.4-1.vm.el5                                         installed

Submitted by andreychek on Mon, 12/06/2010 - 16:41

I did in the first post. It comes from Cron Daemon.

We're interested in the headers too... the "From" and "Subject" lines would be a good start.

Submitted by tbirnseth on Mon, 12/06/2010 - 16:58

Here's best I can do from Thunderbird:

Subject:
Cron <root@ezms1> /usr/share/clamav/freshclam-sleep
From:
root@ez-merchant-hosting.com (Cron Daemon)
Date:
Mon, 6 Dec 2010 14:04:02 -0800 (PST)
To:
root@ez-merchant-hosting.com, postmaster@ez-merchant-hosting.com, webmaster@ez-merchant-hosting.com, clamav@ez-merchant-hosting.com
Return-Path:
<root@ez-merchant-hosting.com>
X-Spam-Checker-Version:
SpamAssassin 3.2.5 (2008-06-10) on ezms1.ez-merchant-hosting.com
X-Spam-Level:
**
X-Spam-Status:
No, score=2.4 required=10.0 tests=AWL,BAYES_00, FH_DATE_PAST_20XX,NO_RELAYS,TVD_SPACE_RATIO autolearn=no version=3.2.5
X-Original-To:
postmaster
Delivered-To:
postmaster@ez-merchant-hosting.com
Received:
by ezms1.ez-merchant-hosting.com (Postfix, from userid 0) id CFFFF2D2842C; Mon, 6 Dec 2010 14:04:02 -0800 (PST)
Content-Type:
text/plain; charset=UTF-8
Auto-Submitted:
auto-generated
X-Cron-Env:
<MAILTO=root,postmaster,webmaster,clamav>
X-Cron-Env:
<SHELL=/bin/sh>
X-Cron-Env:
<HOME=/root>
X-Cron-Env:
<PATH=/usr/bin:/bin>
X-Cron-Env:
<LOGNAME=root>
X-Cron-Env:
<USER=root>
Message-ID:
<20101206220402.CFFFF2D2842C@ezms1.ez-merchant-hosting.com>
 
LibClamAV Warning: ***********************************************************
LibClamAV Warning: ***  This version of the ClamAV engine is outdated.     ***
LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq ***
LibClamAV Warning: ***********************************************************

Submitted by andreychek on Mon, 12/06/2010 - 20:09

What output do you receive if you type this command as root:

crontab -l | grep freshclam

Submitted by tbirnseth on Mon, 12/06/2010 - 21:27

It shows nothing (empty result).

Submitted by JamieCameron on Mon, 12/06/2010 - 23:24

What if you run :

ls /etc/cron*/*clam*

Submitted by tbirnseth on Mon, 12/06/2010 - 23:30 

[root@ezms1 tonyb]# ls /etc/cron*/*clam*
/etc/cron.d/clamav-update
[root@ezms1 tonyb]#

And this is the freshclam:

[root@ezms1 tonyb]# ls /etc/sysconfig/*clam*
/etc/sysconfig/freshclam
[root@ezms1 tonyb]#

Submitted by JamieCameron on Mon, 12/06/2010 - 23:34

Ok .. and what does /etc/cron.d/clamav-update contain?

Submitted by tbirnseth on Mon, 12/06/2010 - 23:49 

[root@ezms1 tonyb]# cat !$
cat /etc/cron.d/clamav-update
## Adjust this line...
MAILTO=root,postmaster,webmaster,clamav
 
## It is ok to execute it as root; freshclam drops privileges and becomes
## user 'clamav' as soon as possible
0  */3 * * * root /usr/share/clamav/freshclam-sleep
[root@ezms1 tonyb]#

So if I just make the MAILTO line be MAILTO= that will probably stop the email. But I guess the bigger question is when will it become "up to date"?

Submitted by JamieCameron on Tue, 12/07/2010 - 00:48

Yes, that would stop the email.

I will defer to Joe to answer when the new ClamAV package will be out.