ClamAV - Reset Defs DB: Difference between revisions

mNo edit summary
No edit summary
Line 1: Line 1:
Sometimes ClamAV will download a virus update, and the MD5 will be wrong. If it is, then ClamAV usually goes down, and
Sometimes ClamAV will download a virus update, and the update will not download correctly, causing an error in its checksum. If this happens, then ClamAV usually goes down, and the system suspends delivery. Downloading fresh definition files can correct this problem.
the system suspends delivery. In which case it's time to refresh your defs.
==Symptoms==
==Symptoms==
You'll know this is the case if you go to the /var/log/'''zimbra.log''' and you see that ClamAV isn't running, postfix/qmgr errors out at ''''delivery temporarily suspended'''', messages like ''''malformed database'''' in /opt/zimbra/log/'''clamd.log''', and by checking zmclamdctl status.
You'll know the definitions are corrupt if you go to the '''/var/log/zimbra.log''' and you see that ClamAV isn't running, postfix/qmgr errors out at ''''delivery temporarily suspended'''', messages like ''''malformed database'''' appear in '''/opt/zimbra/log/clamd.log''', and zmclamdctl status shows clamd as down.


Other symptoms are, if you stop & restart Zimbra services (zmcontrol stop and zmcontrol start), antivirus may fail to start with the errors (among others):
Another symptom is, if you stop & restart Zimbra services (zmcontrol stop and zmcontrol start), antivirus may fail to start with the error (among others):


'''WARNING: Your ClamAV installation is OUTDATED!''' and '''clamd failed to start'''
'''clamd failed to start'''


The above text is part of a much longer set of errors; despite what the Clam errors say, you DON'T necessarily have to update your whole ClamAV.
'''WARNING: Your ClamAV installation is OUTDATED!''' may also appear, but this is not indicative of a corrupt clamd database.  This error simply occurs because ClamAV has a more recent release available than the one that ships with Zimbra.  Updating your ClamAV installation to a version not included with a released ZCS product is not recommended and is not supported.
 
Zimbra updates the ClamAV engine to latest with every release of ZCS.  Users who wish to upgrade ClamAV independently from ZCS at their own risk can find directions here: [[ClamAV - Updating Version]] Out of cycle updates RFE is [http://bugzilla.zimbra.com/show_bug.cgi?id=15137 Bug 15137]


ClamAV Virus definitions update automatically every 2h by default (zimbraVirusDefinitionsUpdateFrequency attribute).  
ClamAV Virus definitions update automatically every 2h by default (zimbraVirusDefinitionsUpdateFrequency attribute).  
Zimbra updates the ClamAV engine to latest with every release of ZCS & does not endorse edorse doing so on your own but you can find directions here: [[ClamAV - Updating Version]] Out of cycle updates RFE is [http://bugzilla.zimbra.com/show_bug.cgi?id=15137 Bug 15137]


==Fix==
==Fix==
Line 18: Line 17:
  su - zimbra
  su - zimbra
  mkdir /tmp/clamdb
  mkdir /tmp/clamdb
(in versions prior to 5.0.3):
  mv /opt/zimbra/clamav/db/* /tmp/clamdb
  mv /opt/zimbra/clamav/db/* /tmp/clamdb
(in version 5.0.3 or later):
mv /opt/zimbra/data/clamav/db/* /tmp/clamdb
  zmprov ms `zmhostname` +zimbraServiceEnabled antivirus
  zmprov ms `zmhostname` +zimbraServiceEnabled antivirus
  /opt/zimbra/clamav/bin/freshclam --config-file=/opt/zimbra/conf/freshclam.conf  
  /opt/zimbra/clamav/bin/freshclam --config-file=/opt/zimbra/conf/freshclam.conf  
Line 24: Line 27:
  zmantivirusctl start
  zmantivirusctl start
(zmantivirusctl incorporates zmclamdctl/zmamavidsctl/zmmtaconfigctl though you can just restart ClamAV individually)
(zmantivirusctl incorporates zmclamdctl/zmamavidsctl/zmmtaconfigctl though you can just restart ClamAV individually)
==ZCS 5.0.3+==
 
In ZCS 5.0.3+ we moved to a data directory to keep separate from application data, replace the above with:
/opt/zimbra/data/clamav/db


==Verify==
==Verify==

Revision as of 19:12, 26 June 2008

Sometimes ClamAV will download a virus update, and the update will not download correctly, causing an error in its checksum. If this happens, then ClamAV usually goes down, and the system suspends delivery. Downloading fresh definition files can correct this problem.

Symptoms

You'll know the definitions are corrupt if you go to the /var/log/zimbra.log and you see that ClamAV isn't running, postfix/qmgr errors out at 'delivery temporarily suspended', messages like 'malformed database' appear in /opt/zimbra/log/clamd.log, and zmclamdctl status shows clamd as down.

Another symptom is, if you stop & restart Zimbra services (zmcontrol stop and zmcontrol start), antivirus may fail to start with the error (among others):

clamd failed to start

WARNING: Your ClamAV installation is OUTDATED! may also appear, but this is not indicative of a corrupt clamd database. This error simply occurs because ClamAV has a more recent release available than the one that ships with Zimbra. Updating your ClamAV installation to a version not included with a released ZCS product is not recommended and is not supported.

Zimbra updates the ClamAV engine to latest with every release of ZCS. Users who wish to upgrade ClamAV independently from ZCS at their own risk can find directions here: ClamAV - Updating Version Out of cycle updates RFE is Bug 15137

ClamAV Virus definitions update automatically every 2h by default (zimbraVirusDefinitionsUpdateFrequency attribute).

Fix

To fix this, you can delete the defs and try again: 

su - zimbra
mkdir /tmp/clamdb

(in versions prior to 5.0.3): 

mv /opt/zimbra/clamav/db/* /tmp/clamdb

(in version 5.0.3 or later): 

mv /opt/zimbra/data/clamav/db/* /tmp/clamdb

zmprov ms `zmhostname` +zimbraServiceEnabled antivirus
/opt/zimbra/clamav/bin/freshclam --config-file=/opt/zimbra/conf/freshclam.conf 
zmantivirusctl stop
zmantivirusctl start

(zmantivirusctl incorporates zmclamdctl/zmamavidsctl/zmmtaconfigctl though you can just restart ClamAV individually)


Verify

Verify by running: 

/opt/zimbra/clamav/bin/clamscan -d /opt/zimbra/data/clamav/db/
Retrieved from "http://wiki.zimbra.com/index.php?title=ClamAV_-_Reset_Defs_DB&oldid=8965"
Jump to: navigation, search