freshclam: problem with internal logger

Zitat

-u USER, --user USER
Run as USER. By default (when started by root) freshclam drops privileges and operates as the '' user.

Zitat von -=Willi=-

Ich hatte noch nie was mit clamav zu tun aber in diesem Subforum sind wir ja eine eingeschworene Gruppe also versuch ich mal meinen Senf abzugeben .
Laut hier wird der Befehl `freshclam` als User '' ausgeführt wenn du ihn als root startest.

Ich muss gestehen dass ich ned weiß was User '' bedeutet aber zu Testzwecken könntest ja mal `freshclam -u root` als root ausführen und schauen was passiert.

Code:

[root@localhost clamav]# ls -l  
total 298612  
-rw-rw-rw-. 1 clamav clamav         0 Apr  6 03:55 clamd.log  
-rw-rw-rw-. 1 clam   clam       60445 Mar 16 04:04 clamd.log-20140316  
-rw-rw-rw-. 1 clam   clam       60858 Mar 23 04:35 clamd.log-20140323  
-rw-rw-rw-. 1 clam   clam       59914 Mar 30 03:23 clamd.log-20140330  
-rw-rw-rw-. 1 clam   clam       59144 Apr  5 19:44 clamd.log-20140406  
-rw-rw-rw-. 1 clamav clamav      1238 Apr 18 18:59 freshclam.log  
-rw-rw-rw-. 1 clam   clam        5090 Mar 23 04:35 freshclam.log-20140323  
-rw-rw-rw-. 1 clam   clam        4685 Mar 30 03:23 freshclam.log-20140330  
-rw-rw-rw-. 1 clam   clam        4152 Apr  6 03:55 freshclam.log-20140406  
-rw-rw-rw-. 1 clamav clamav      2672 Apr 16 12:10 freshclam.log-20140417  
-rw-rw-rw-. 1 root   root   305456177 Apr 18 18:01 scan.log  

Zitat von davebastard

laut deinem output da oben scheint gar keine instanz zu laufen
der output von einer laufenden instanz wär aber interessant wegen dem user.

eventuell heißt das binary anders grep mal anstatt nach "fresh" nach "clam"

edit: generell wären mehr infos hilfreich, welches OS, wozu dient freshclam wer ruft es auf usw.

Code:

[root@localhost ~]# freshclam -u root  
ClamAV update process started at Fri Apr 18 18:56:10 2014  
main.cvd is up to date (version: 55, sigs: 2424225, f-level: 60, builder: neo)  
Downloading daily-18808.cdiff [100%]  
Downloading daily-18809.cdiff [100%]  
Downloading daily-18810.cdiff [100%]  
Downloading daily-18811.cdiff [100%]  
Downloading daily-18812.cdiff [100%]  
Downloading daily-18813.cdiff [100%]  
Downloading daily-18814.cdiff [100%]  
Downloading daily-18815.cdiff [100%]  
Downloading daily-18816.cdiff [100%]  
Downloading daily-18817.cdiff [100%]  
Downloading daily-18818.cdiff [100%]  
Downloading daily-18819.cdiff [100%]  
Downloading daily-18820.cdiff [100%]  
daily.cld updated (version: 18820, sigs: 895403, f-level: 63, builder: neo) 
bytecode.cld is up to date (version: 236, sigs: 43, f-level: 63, builder: dgoddard)  
Database updated (3319671 signatures) from db.at.clamav.net (IP: 193.1.193.64)  [root@localhost ~]#  

Code:

##
## Example config file for freshclam
## Please read the freshclam.conf(5) manual before editing this file.
##


# Comment or remove the line below.
#Example

# Path to the database directory.
# WARNING: It must match clamd.conf's directive!
# Default: hardcoded (depends on installation options)
DatabaseDirectory /var/lib/clamav

# Path to the log file (make sure it has proper permissions)
# Default: disabled
UpdateLogFile /var/log/clamav/freshclam.log

# Maximum size of the log file.
# Value of 0 disables the limit.
# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes).
# in bytes just don't use modifiers.
# Default: 1M
#LogFileMaxSize 2M

# Log time with each message.
# Default: no
#LogTime yes

# Enable verbose logging.
# Default: no
#LogVerbose yes

# Use system logger (can work together with UpdateLogFile).
# Default: no
LogSyslog yes

# Specify the type of syslog messages - please refer to 'man syslog'
# for facility names.
# Default: LOG_LOCAL6
#LogFacility LOG_MAIL

# This option allows you to save the process identifier of the daemon
# Default: disabled
#PidFile /var/run/freshclam.pid

# By default when started freshclam drops privileges and switches to the
# "clamav" user. This directive allows you to change the database owner.
# Default: clamav (may depend on installation options)
DatabaseOwner clam

# Initialize supplementary group access (freshclam must be started by root).
# Default: no
#AllowSupplementaryGroups yes

# Use DNS to verify virus database version. Freshclam uses DNS TXT records
# to verify database and software versions. With this directive you can change
# the database verification domain.
# WARNING: Do not touch it unless you're configuring freshclam to use your
# own database verification domain.
# Default: current.cvd.clamav.net
#DNSDatabaseInfo current.cvd.clamav.net

# Uncomment the following line and replace XY with your country
# code. See [url]http://www.iana.org/cctld/cctld-whois.htm[/url] for the full list.
# You can use db.XY.ipv6.clamav.net for IPv6 connections.
#DatabaseMirror db.XY.clamav.net

# database.clamav.net is a round-robin record which points to our most
# reliable mirrors. It's used as a fall back in case db.XY.clamav.net is
# not working. DO NOT TOUCH the following line unless you know what you
# are doing.
DatabaseMirror db.at.clamav.net
DatabaseMirror db.local.clamav.net

# How many attempts to make before giving up.
# Default: 3 (per mirror)
#MaxAttempts 5

# With this option you can control scripted updates. It's highly recommended
# to keep it enabled.
# Default: yes
#ScriptedUpdates yes

# By default freshclam will keep the local databases (.cld) uncompressed to
# make their handling faster. With this option you can enable the compression;
# the change will take effect with the next database update.
# Default: no
#CompressLocalDatabase no

# With this option you can provide custom sources ([url]http://[/url] or file://) for
# database files. This option can be used multiple times.
# Default: no custom URLs
#DatabaseCustomURL [url]http://myserver.com/mysigs.ndb[/url]
#DatabaseCustomURL file:///mnt/nfs/local.hdb

# Number of database checks per day.
# Default: 12 (every two hours)
#Checks 24

# Proxy settings
# Default: disabled
#HTTPProxyServer myproxy.com
#HTTPProxyPort 1234
#HTTPProxyUsername myusername
#HTTPProxyPassword mypass

# If your servers are behind a firewall/proxy which applies User-Agent
# filtering you can use this option to force the use of a different
# User-Agent header.
# Default: clamav/version_number
#HTTPUserAgent SomeUserAgentIdString

# Use aaa.bbb.ccc.ddd as client address for downloading databases. Useful for
# multi-homed systems.
# Default: Use OS'es default outgoing IP address.
#LocalIPAddress aaa.bbb.ccc.ddd

# Send the RELOAD command to clamd.
# Default: no
#NotifyClamd /path/to/clamd.conf

# Run command after successful database update.
# Default: disabled
#OnUpdateExecute command

# Run command when database update process fails.
# Default: disabled
#OnErrorExecute command

# Run command when freshclam reports outdated version.
# In the command string %v will be replaced by the new version number.
# Default: disabled
#OnOutdatedExecute command

# Don't fork into background.
# Default: no
#Foreground yes

# Enable debug messages in libclamav.
# Default: no
#Debug yes

# Timeout in seconds when connecting to database server.
# Default: 30
#ConnectTimeout 60

# Timeout in seconds when reading from database server.
# Default: 30
#ReceiveTimeout 60

# With this option enabled, freshclam will attempt to load new
# databases into memory to make sure they are properly handled
# by libclamav before replacing the old ones.
# Default: yes
#TestDatabases yes

# When enabled freshclam will submit statistics to the ClamAV Project about
# the latest virus detections in your environment. The ClamAV maintainers
# will then use this data to determine what types of malware are the most
# detected in the field and in what geographic area they are.
# Freshclam will connect to clamd in order to get recent statistics.
# Default: no
#SubmitDetectionStats /path/to/clamd.conf

# Country of origin of malware/detection statistics (for statistical
# purposes only). The statistics collector at ClamAV.net will look up
# your IP address to determine the geographical origin of the malware
# reported by your installation. If this installation is mainly used to
# scan data which comes from a different location, please enable this
# option and enter a two-letter code (see [url]http://www.iana.org/domains/root/db/[/url])
# of the country of origin.
# Default: disabled
#DetectionStatsCountry country-code

# This option enables support for our "Personal Statistics" service.
# When this option is enabled, the information on malware detected by
# your clamd installation is made available to you through our website.
# To get your HostID, log on [url]http://www.stats.clamav.net[/url] and add a new
# host to your host list. Once you have the HostID, uncomment this option
# and paste the HostID here. As soon as your freshclam starts submitting
# information to our stats collecting service, you will be able to view
# the statistics of this clamd installation by logging into
# [url]http://www.stats.clamav.net[/url] with the same credentials you used to
# generate the HostID. For more information refer to:
# [url]http://www.clamav.net/support/faq/faq-cctts/[/url]
# This feature requires SubmitDetectionStats to be enabled.
# Default: disabled
#DetectionStatsHostID unique-id

# This option enables support for Google Safe Browsing. When activated for
# the first time, freshclam will download a new database file (safebrowsing.cvd)
# which will be automatically loaded by clamd and clamscan during the next
# reload, provided that the heuristic phishing detection is turned on. This
# database includes information about websites that may be phishing sites or
# possible sources of malware. When using this option, it's mandatory to run
# freshclam at least every 30 minutes.
# Freshclam uses the ClamAV's mirror infrastructure to distribute the
# database and its updates but all the contents are provided under Google's
# terms of use. See [url]http://code.google.com/support/bin/answer.py?answer=70015[/url]
# and [url]http://safebrowsing.clamav.net[/url] for more information.
# Default: disabled
#SafeBrowsing yes

# This option enables downloading of bytecode.cvd, which includes additional
# detection mechanisms and improvements to the ClamAV engine.
# Default: enabled
#Bytecode yes

# Download an additional 3rd party signature database distributed through
# the ClamAV mirrors. Here you can find a list of available databases:
# [url]http://www.clamav.net/download/cvd/3rdparty[/url]
# This option can be used multiple times.
#ExtraDatabase dbname1
#ExtraDatabase dbname2

Zitat von luka

Aus welchem Repository wurde ClamAV installiert? EPEL? Yum könnte helfen:

Code:

yum info clamav

Zitat von luka

Vielleicht wurde ein inkompatibles Paket versehentlich aus einem anderen Repository installiert/aktualisiert, das einen anderen Benutzer verwendet.



Die Dateirechte 666 bedeuten: der Eigentümer, Gruppe und jeder andere kann Schreiben (2) und Lesen (4)
Das Verzeichnis /var/log/clamav muss aber auch das Ausführungsrecht (1) haben, damit man ins Verzeichnis wechseln darf.

Am besten setzt du die Rechte so:

Code:

chmod 755 /var/log/clamav

Das bedeutet: Der Eigentümer kann ins Verzeichnis wechseln (ausführen), den Inhalt auflisten (lesen), neue Dateien/Unterordner erstellen, löschen, umbenennen, Dateirechte ändern (schreiben). Die Gruppe und der Rest kann nur ins Verzeichnis wechseln und den Inhalt auflisten.

Die Logdateien sollte nur der User von ClamAV bzw. Freshclam verändern dürfen:

Code:

chown -R clamav:clamav /var/log/clamav

Code:

chmod 640 /var/log/clamav/*

Code:

Loaded plugins: downloadonly, fastestmirror, refresh-packagekit, replace,
              : security
Loading mirror speeds from cached hostfile
 * base: mirror.skylink-datacenter.de
 * epel: mirror.digitalnova.at
 * extras: gd.tuwien.ac.at
 * rpmforge: ftp.fi.muni.cz
 * rpmfusion-free-updates: ftp.upjs.sk
 * updates: gd.tuwien.ac.at
 * webtatic: nl.repo.webtatic.com
Installed Packages
Name        : clamav
Arch        : x86_64
Version     : 0.98.1
Release     : 1.el6.rf
Size        : 7.1 M
Repo        : installed
From repo   : rpmforge
Summary     : Anti-virus software
URL         : [url]http://www.clamav.net/[/url]
License     : GPL
Description : Clam AntiVirus is a GPL anti-virus toolkit for UNIX. The main
            : purpose of this software is the integration with mail servers
            : (attachment scanning). The package provides a flexible and
            : scalable multi-threaded daemon, a command line scanner, and a tool
            : for automatic updating via Internet.
            : 
            : The programs are based on a shared library distributed with the
            : Clam AntiVirus package, which you can use with your own software.
            : Most importantly, the virus database is kept up to date

Available Packages
Name        : clamav
Arch        : i686
Version     : 0.98.1
Release     : 1.el6
Size        : 1.4 M
Repo        : epel
Summary     : Anti-virus software
URL         : [url]http://www.clamav.net/[/url]
License     : GPLv2
Description : Clam AntiVirus is a GPL anti-virus toolkit for UNIX. The main
            : purpose of this software is the integration with mail servers
            : (attachment scanning). The package provides a flexible and
            : scalable multi-threaded daemon, a command line scanner, and a tool
            : for automatic updating via Internet.
            : 
            : The programs are based on a shared library distributed with the
            : Clam AntiVirus package, which you can use with your own software.
            : Most importantly, the virus database is kept up to date

Code:

Loaded plugins: downloadonly, fastestmirror, refresh-packagekit, replace,
              : security
Loading mirror speeds from cached hostfile
 * base: mirror.skylink-datacenter.de
 * epel: fedora.aau.at
 * extras: centos.mirroraustria.at
 * rpmforge: ftp.fi.muni.cz
 * rpmfusion-free-updates: ftp.upjs.sk
 * updates: centos.mirroraustria.at
 * webtatic: nl.repo.webtatic.com
Installed Packages
clamav.x86_64                             0.98.1-1.el6.rf              @rpmforge
clamav-db.x86_64                          0.98.1-1.el6.rf              @rpmforge
clamd.x86_64                              0.98.1-1.el6.rf              @rpmforge
Available Packages
clamav.i686                               0.98.1-1.el6                 epel     
clamav-devel.i686                         0.98.1-1.el6                 epel     
clamav-devel.x86_64                       0.98.1-1.el6.rf              rpmforge 
clamav-milter.x86_64                      0.98.1-1.el6.rf              rpmforge 
clamav-unofficial-sigs.noarch             3.7.1-6.el6                  epel     
clamsmtp.x86_64                           1.10-6.el6                   epel     
clamtk.noarch                             4.25-1.el6.rf                rpmforge 
clamz.x86_64                              0.5-0.el6                    epel     

Code:

Loaded plugins: downloadonly, fastestmirror, refresh-packagekit, replace,
              : security
Loading mirror speeds from cached hostfile
 * base: mirror.skylink-datacenter.de
 * epel: mirror.digitalnova.at
 * extras: ftp-stud.fht-esslingen.de
 * rpmforge: ftp.fi.muni.cz
 * rpmfusion-free-updates: ftp.upjs.sk
 * updates: gd.tuwien.ac.at
 * webtatic: nl.repo.webtatic.com
repo id                repo name                                          status
base                   CentOS-6 - Base                                     6,367
epel                   Extra Packages for Enterprise Linux 6 - x86_64     10,721
extras                 CentOS-6 - Extras                                      14
isv_ownCloud_community Latest stable community release of ownCloud (CentO     10
rpmforge               RHEL 6 - RPMforge.net - dag                         4,678
rpmfusion-free-updates RPM Fusion for EL 6 - Free - Updates                  292
updates                CentOS-6 - Updates                                    813
webtatic               Webtatic Repository EL6 - x86_64                       96
zeroc-ice              Ice 3.5 for RHEL 6 - x86_64                            31
zfs                    ZFS of Linux for EL 6                                  42
repolist: 23,064