{"action":"created","issue":{"url":"https://api.github.com/repos/rfxn/linux-malware-detect/issues/58","labels_url":"https://api.github.com/repos/rfxn/linux-malware-detect/issues/58/labels{/name}","comments_url":"https://api.github.com/repos/rfxn/linux-malware-detect/issues/58/comments","events_url":"https://api.github.com/repos/rfxn/linux-malware-detect/issues/58/events","html_url":"https://github.com/rfxn/linux-malware-detect/issues/58","id":107316131,"number":58,"title":"ClamAV failure","user":{"login":"captainwasabi","id":8583375,"avatar_url":"https://avatars.githubusercontent.com/u/8583375?v=3","gravatar_id":"","url":"https://api.github.com/users/captainwasabi","html_url":"https://github.com/captainwasabi","followers_url":"https://api.github.com/users/captainwasabi/followers","following_url":"https://api.github.com/users/captainwasabi/following{/other_user}","gists_url":"https://api.github.com/users/captainwasabi/gists{/gist_id}","starred_url":"https://api.github.com/users/captainwasabi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/captainwasabi/subscriptions","organizations_url":"https://api.github.com/users/captainwasabi/orgs","repos_url":"https://api.github.com/users/captainwasabi/repos","events_url":"https://api.github.com/users/captainwasabi/events{/privacy}","received_events_url":"https://api.github.com/users/captainwasabi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-09-19T06:42:15Z","updated_at":"2015-09-19T14:55:20Z","closed_at":null,"body":"It looks like when maldet updated at midnight as part of my daily scan and backup script it broke ClamAV.  As this is on my mail server, and amavis uses clamAV to scan for viruses, this is preventing mail from being sent or delivered.\r\n\r\nI've tried running freshclam, maldet -d, maldet -u, restarting clamav-daemon, restarting amavis, etc.\r\n\r\nWhen I try to start ClamAV this is what I get:\r\n\r\nservice clamav-daemon start\r\n * Starting ClamAV daemon clamd                                                 \r\nLibClamAV Error: cli_load(): Can't open file /var/lib/clamav/lmd.user.hdb\r\nLibClamAV Error: cli_loaddbdir(): error loading database /var/lib/clamav/lmd.user.hdb\r\nERROR: Can't open file or directory                                                                         [fail]\r\n\r\ncontents of /var/lib/clamav:\r\n\r\ndrwxr-xr-x  2 clamav clamav      4096 Sep 19 02:15 ./\r\ndrwxr-xr-x 59 root   root        4096 Aug 26 07:41 ../\r\n-rw-r--r--  1 clamav clamav    407040 Aug 20 11:45 bytecode.cld\r\n-rw-r--r--  1 clamav clamav 101435904 Sep 18 13:52 daily.cld\r\nlrwxrwxrwx  1 root   root          38 Sep 19 00:01 lmd.user.hdb -> /usr/local/maldetect/sigs/lmd.user.hdb\r\nlrwxrwxrwx  1 root   root          38 Sep 19 00:01 lmd.user.ndb -> /usr/local/maldetect/sigs/lmd.user.ndb\r\n-rw-r--r--  1 clamav clamav  64720632 Sep 17  2013 main.cvd\r\n-rw-------  1 clamav clamav      1196 Sep 19 02:15 mirrors.dat\r\nlrwxrwxrwx  1 root   root          34 Sep 19 00:01 rfxn.hdb -> /usr/local/maldetect/sigs/rfxn.hdb\r\nlrwxrwxrwx  1 root   root          34 Sep 19 00:01 rfxn.ndb -> /usr/local/maldetect/sigs/rfxn.ndb\r\n\r\ncontents of /usr/local/maldetect/sigs:\r\n\r\n ll /usr/local/maldetect/sigs\r\ntotal 2584\r\ndrwxr-xr-x  3 root root   4096 Sep 19 00:04 ./\r\ndrwxr-xr-x 11 root root   4096 Sep 19 02:10 ../\r\ndrwxr-xr-x  2 root root   4096 Sep 12  2013 appver/\r\n-rw-r--r--  1 root root      0 Sep 19 00:01 custom.hex.dat\r\n-rw-r--r--  1 root root      0 Sep 19 00:01 custom.md5.dat\r\n-rw-r--r--  1 root root 429904 Sep 18 18:18 hex.dat\r\nlrwxrwxrwx  1 root root     48 Sep 19 00:04 lmd.user.hdb -> /usr/local/maldetect/tmp/.runtime.user.13092.hdb\r\nlrwxrwxrwx  1 root root     48 Sep 19 00:04 lmd.user.ndb -> /usr/local/maldetect/tmp/.runtime.user.13092.ndb\r\n-rw-r--r--  1 root root     14 Sep 19 00:01 maldet.sigs.ver\r\n-rw-r--r--  1 root root 551001 Sep 18 18:18 md5.dat\r\n-rw-r--r--  1 root root 602518 Sep 18 18:18 md5v2.dat\r\n-rw-r--r--  1 root root 598632 Sep 18 18:18 rfxn.hdb\r\n-rw-r--r--  1 root root 437560 Sep 18 18:18 rfxn.ndb\r\n\r\ncontents of /usr/local/maldetect/tmp:\r\n\r\nll /usr/local/maldetect/tmp\r\ntotal 8\r\ndrwxr-x---  2 root root 4096 Sep 19 00:04 ./\r\ndrwxr-xr-x 11 root root 4096 Sep 19 02:10 ../\r\n-rw-r--r--  1 root root    0 Sep 19 00:01 .digest.alert.hits\r\n-rw-r--r--  1 root root    0 Sep 19 00:01 .digest.clean.hits\r\n-rw-r--r--  1 root root    0 Sep 19 00:01 .digest.monitor.alert\r\n-rw-r--r--  1 root root    0 Sep 19 00:01 .digest.susp.hits\r\n\r\n\r\nso as you can see the .runtime.user.13092.* files are missing.\r\n\r\nThe error I'm getting in my /var/log/mail.log is:\r\n\r\nSep 19 02:08:52 pigeon amavis[4089]: (04089-06) (!)run_av (ClamAV-clamscan) FAILED - unexpected exit 2, output=\"LibClamAV Error: cli_load(): Can't open file /var/lib/clamav/lmd.user.hdb\\nLibClamAV Error: cli_loaddbdir(): error loading database /var/lib/clamav/lmd.user.hdb\\nERROR: Can't open file or directory\"\r\n\r\nrelevant lines from /var/log/clamav/clamav.log:\r\n\r\nFri Sep 18 22:17:23 2015 -> SelfCheck: Database status OK.\r\nFri Sep 18 23:21:25 2015 -> SelfCheck: Database status OK.\r\nSat Sep 19 00:01:35 2015 -> Reading databases from /var/lib/clamav\r\nSat Sep 19 00:01:38 2015 -> ERROR: reload db failed: Can't open file or director\r\ny\r\nSat Sep 19 00:01:38 2015 -> Terminating because of a fatal error.\r\nSat Sep 19 00:01:38 2015 -> Pid file removed.\r\nSat Sep 19 00:01:38 2015 -> --- Stopped at Sat Sep 19 00:01:38 2015\r\nSat Sep 19 00:01:38 2015 -> Socket file removed.\r\n\r\n\r\nrelevant lines from /usr/local/maldetect/logs/event_log\r\n\r\nSep 19 00:01:31 pigeon maldet(11534): {sigup} performing signature update check...\r\nSep 19 00:01:31 pigeon maldet(11534): {sigup} local signature set is version 2015091828029\r\nSep 19 00:01:31 pigeon maldet(11534): {sigup} latest signature set already installed\r\nSep 19 00:01:31 pigeon maldet(11237): {update} completed update v1.4.2 => v1.5, running signature updates...\r\nSep 19 00:01:31 pigeon maldet(11619): {sigup} performing signature update check...\r\nSep 19 00:01:31 pigeon maldet(11619): {sigup} local signature set is version 2015091828029\r\nSep 19 00:01:31 pigeon maldet(11619): {sigup} latest signature set already installed\r\nSep 19 00:01:31 pigeon maldet(11237): {update} update and config import completed.\r\nSep 19 00:01:31 pigeon maldet(11237): {sigup} performing signature update check...\r\nSep 19 00:01:31 pigeon maldet(11237): {sigup} local signature set is version 2015091516329\r\nSep 19 00:01:31 pigeon maldet(11237): {sigup} new signature set (2015091828029) available\r\nSep 19 00:01:32 pigeon maldet(11237): {sigup} downloaded http://cdn.rfxn.com/downloads/md5.dat\r\nSep 19 00:01:33 pigeon maldet(11237): {sigup} downloaded http://cdn.rfxn.com/downloads/hex.dat\r\nSep 19 00:01:34 pigeon maldet(11237): {sigup} downloaded http://cdn.rfxn.com/downloads/rfxn.ndb\r\nSep 19 00:01:35 pigeon maldet(11237): {sigup} downloaded http://cdn.rfxn.com/downloads/rfxn.hdb\r\nSep 19 00:01:35 pigeon maldet(11237): {sigup} downloaded http://cdn.rfxn.com/downloads/maldet-clean.tgz\r\nSep 19 00:01:35 pigeon maldet(11237): {sigup} signature set update completed\r\nSep 19 00:01:35 pigeon maldet(11237): {sigup} 10822 signatures (8908 MD5 / 1914 HEX)\r\nSep 19 00:01:36 pigeon maldet(11791): {scan} launching scan of /root changes in last 1d to background, see /usr/local/maldetect/logs/event_log for progress\r\nSep 19 00:01:36 pigeon maldet(11791): {scan} signatures loaded: 10822 (8908 MD5 / 1914 HEX / 0 USER)\r\nSep 19 00:01:36 pigeon maldet(11791): {scan} building file list for /root of new/modified files from last 1 days, this might take awhile...\r\nSep 19 00:01:36 pigeon maldet(11791): {scan} setting nice scheduler priorities for all operations: cpunice 19 , ionice 6\r\nSep 19 00:01:36 pigeon maldet(11791): {scan} executed /usr/bin/nice -n 19 /usr/bin/ionice -c2 -n 6 /usr/bin/find /root /tmp /var/tmp /dev/shm -maxdepth 15 -regextype posix-egrep -type f ( -mtime -1 -o -ctime -1 ) -size +24c -size -6947618c  -not -perm 000 -not -regex \"\"  -not -uid 0 -not -gid 0\r\nSep 19 00:01:37 pigeon maldet(11791): {scan} file list completed in 1s, found 69 files...\r\nSep 19 00:01:37 pigeon maldet(11791): {scan} found clamav binary at /usr/bin/clamdscan, using clamav scanner engine...\r\nSep 19 00:01:37 pigeon maldet(11791): {scan} scan of /root (69 files) in progress...\r\nSep 19 00:01:38 pigeon maldet(11791): {scan} clamscan returned an error, check /usr/local/maldetect/logs/clamscan_log for more details!\r\n\r\nrelevant lines from /usr/local/maldetect/logs/clamscan_log:\r\n\r\nSep 19 00:01:37 pigeon clamscan start\r\nSep 19 00:01:37 pigeon executed: /usr/bin/nice -n 19 /usr/bin/ionice -c2 -n 6 /usr/bin/clamdscan  --infected -\r\n-no-summary -f /usr/local/maldetect/tmp/.find.11791\r\nERROR: Communication error\r\nERROR: Could not lookup : Servname not supported for ai_socktype\r\nERROR: Could not lookup : Servname not supported for ai_socktype\r\nERROR: Could not lookup : Servname not supported for ai_socktype\r\n.\r\n.\r\n.\r\nSep 19 00:01:42 pigeon clamscan start\r\nSep 19 00:01:42 pigeon executed: /usr/bin/nice -n 19 /usr/bin/ionice -c2 -n 6 /usr/bin/clamdscan --max-filesiz\r\ne=5M --max-scansize=5M -d /usr/local/maldetect/tmp/.runtime.user.12047.hdb -d /usr/local/maldetect/tmp/.runtim\r\ne.user.12047.ndb  -r --infected --no-summary -f /usr/local/maldetect/tmp/.find.12047\r\nWARNING: Ignoring unsupported option --max-filesize\r\nWARNING: Ignoring unsupported option --max-scansize\r\nWARNING: Ignoring unsupported option --database (-d)\r\nWARNING: Ignoring unsupported option --database (-d)\r\nWARNING: Ignoring unsupported option --recursive (-r)\r\nERROR: Could not lookup : Servname not supported for ai_socktype\r\nERROR: Could not lookup : Servname not supported for ai_socktype\r\nERROR: Could not lookup : Servname not supported for ai_socktype\r\n.\r\n.\r\n.\r\n\r\n\r\nThis is a MAJOR issue. for now I have disabled anti-virus checking in amavis like this:\r\n\r\nTry this on Debian or Ubuntu:\r\n\r\nAdd a new file /etc/amavis/conf.d/90-custom\r\n\r\nwith the following content:\r\n\r\nCode:\r\n\r\n    use strict;\r\n\r\n    @bypass_virus_checks_maps  = (1);\r\n\r\n    #------------ Do not modify anything below this line -------------\r\n    1;  # insure a defined return\r\n\r\nand restart amavisd.\r\n"},"comment":{"url":"https://api.github.com/repos/rfxn/linux-malware-detect/issues/comments/141677548","html_url":"https://github.com/rfxn/linux-malware-detect/issues/58#issuecomment-141677548","issue_url":"https://api.github.com/repos/rfxn/linux-malware-detect/issues/58","id":141677548,"user":{"login":"captainwasabi","id":8583375,"avatar_url":"https://avatars.githubusercontent.com/u/8583375?v=3","gravatar_id":"","url":"https://api.github.com/users/captainwasabi","html_url":"https://github.com/captainwasabi","followers_url":"https://api.github.com/users/captainwasabi/followers","following_url":"https://api.github.com/users/captainwasabi/following{/other_user}","gists_url":"https://api.github.com/users/captainwasabi/gists{/gist_id}","starred_url":"https://api.github.com/users/captainwasabi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/captainwasabi/subscriptions","organizations_url":"https://api.github.com/users/captainwasabi/orgs","repos_url":"https://api.github.com/users/captainwasabi/repos","events_url":"https://api.github.com/users/captainwasabi/events{/privacy}","received_events_url":"https://api.github.com/users/captainwasabi/received_events","type":"User","site_admin":false},"created_at":"2015-09-19T14:55:20Z","updated_at":"2015-09-19T14:55:20Z","body":"tried this and the following still happens when I start clamav\r\n\r\nservice clamav-daemon start\r\n * Starting ClamAV daemon clamd                                                                               LibClamAV Error: cli_load(): Can't open file /var/lib/clamav/rfxn.ndb\r\nLibClamAV Error: cli_loaddbdir(): error loading database /var/lib/clamav/rfxn.ndb\r\nERROR: Can't open file or directory\r\n                                                                                                       [fail]\r\n\r\nI also get the same errors as reported above in the maillog (because the daemon isn't running) \r\nbut it does look like email is being delivered.\r\n\r\nBTW, thank you for this great package that I use daily on all my servers.  Also thank you for looking at this issue so quickly, it's really appreciated!"}}