Urgent ClamAV

Submitted by bvi@postcy.com on Thu, 11/01/2012 - 03:21

when i try to start the services does not start. and i got the error below.

Nov 1 09:42:11 ns1 clamd[19494]: clamd daemon 0.97.6 (OS: linux-gnu, ARCH: i386, CPU: i386) Nov 1 09:42:11 ns1 clamd[19494]: Running as user nobody (UID 99, GID 99) Nov 1 09:42:11 ns1 clamd[19494]: Log file size limited to 1048576 bytes. Nov 1 09:42:11 ns1 clamd[19494]: Reading databases from /var/clamav Nov 1 09:42:11 ns1 clamd[19494]: Not loading PUA signatures. Nov 1 09:42:11 ns1 clamd[19494]: Bytecode: Security mode set to "TrustSigned". Nov 1 09:42:11 ns1 clamd[19494]: Can't open file or directory

Thanks in advance Vakis

Status: 
Closed (fixed)

Comments

Submitted by andreychek on Thu, 11/01/2012 - 09:26

Howdy -- what output do you receive if you run these commands:

ls -l /etc/clamd.conf
grep '^[^# ]' /etc/clamd.conf

That will show what config options are currently active in your Clam config.

Submitted by bvi@postcy.com on Thu, 11/01/2012 - 11:12

the problem is fix for a reason clamav was wrong config path to its database.

Submitted by andreychek on Thu, 11/01/2012 - 12:33

Super, I'm glad you got it working!

Is there by chance a new repository enabled on your system?

What you're describing could occur if a version of ClamAV were pulled in from a third party repository.

You can determine what ClamAV version you have by running this command... if you like, feel free to paste the output in here and we can verify the ClamAV version:

rpm -qa | grep clam

Submitted by bvi@postcy.com on Thu, 11/01/2012 - 12:44

Hello,

find the version below.

clamav-db-0.97.6-9.el5.art clamd-0.97.6-9.el5.art clamav-0.97.6-9.el5.art

Best regards Vakis

Submitted by andreychek on Thu, 11/01/2012 - 12:49

Aha, I suspect that's what caused the issue. That version of ClamAV is indeed from another repository, the "art" repo. It likely has some different defaults, and it looks like those defaults conflicted with what you already had setup.

I'd suggest caution with third party repositories -- when possible, I'd recommend only pulling in the packages you need from them, and not having them globally enabled on your system.

I'm glad it's working now though!