Difference between revisions of "ClamAV - Reset Defs DB"

(Edited for style and clarity; added category Troubleshooting; added template Zimbra Certified)
Line 1: Line 1:
Sometimes ClamAV will download a virus update, and the update will not download correctly, causing an error in its checksum. If this happens, then ClamAV usually goes down, and the system suspends delivery.  Downloading fresh definition files can correct this problem.
+
{{ZC}}
==Symptoms==
 
You'll know the definitions are corrupt if you go to the '''/var/log/zimbra.log''' and you see that ClamAV isn't running, postfix/qmgr errors out at ''''delivery temporarily suspended'''', messages like ''''malformed database'''' appear in '''/opt/zimbra/log/clamd.log''', and zmclamdctl status shows clamd as down.
 
  
Another symptom is, if you stop & restart Zimbra services (zmcontrol stop and zmcontrol start), antivirus may fail to start with the error (among others):
+
Sometimes ClamAV will download a virus update, and the update will not download correctly. This causes an error in its checksum. If this happens, ClamAV usually goes down and the system suspends delivery.  Downloading fresh definition files can correct this problem.
  
'''clamd failed to start'''
+
=Symptoms=
 +
You will experience the following symptoms if ClamAV fails to correctly download a virus update:
  
'''WARNING: Your ClamAV installation is OUTDATED!''' may also appear, but this is not indicative of a corrupt clamd database. This error simply occurs because ClamAV has a more recent release available than the one that ships with Zimbra.  Updating your ClamAV installation to a version not included with a released ZCS product is not recommended and is not supported.
+
The definitions are corrupt if in '''/var/log/zimbra.log''':  
 +
*ClamAV isn't running
 +
*'''postfix/qmgr''' errors out at '''delivery temporarily suspended'''  
 +
And in '''/opt/zimbra/log/clamd.log''':
 +
*There are log error messages, like '''malformed database'''
 +
*'''zmclamdctl''' status shows clamd as down.
  
Zimbra updates the ClamAV engine to latest with every release of ZCS.  Users who wish to upgrade ClamAV independently from ZCS at their own risk can find directions here: [[ClamAV - Updating Version]] Out of cycle updates RFE is [http://bugzilla.zimbra.com/show_bug.cgi?id=15137 Bug 15137]
+
The following symptoms may occur if you stop & restart Zimbra services (using zmcontrol stop and zmcontrol start):
 +
*Antivirus may fail to start with the error (among others) '''clamd failed to start'''
  
ClamAV Virus definitions update automatically every 2h by default (zimbraVirusDefinitionsUpdateFrequency attribute).  
+
'''''Note:''' The '''WARNING: Your ClamAV installation is OUTDATED!''' error may also appear, but this is not indicative of a corrupt clamd database.  This error simply occurs because ClamAV has a more recent release available than the one that ships with Zimbra.  Updating your ClamAV installation to a version not included with a released ZCS product is not recommended and is not supported.  Zimbra updates the ClamAV engine to latest with every release of ZCS.  Users who wish to upgrade ClamAV independently from ZCS at their own risk can find directions here: [[ClamAV - Updating Version]] Out of cycle updates RFE is [http://bugzilla.zimbra.com/show_bug.cgi?id=15137 Bug 15137]''
  
==Fix==
+
'''''Note:''' ClamAV Virus definitions update automatically every 2h by default (zimbraVirusDefinitionsUpdateFrequency attribute).''
To fix this, you can delete the defs and try again:
+
 
 +
=Fix=
 +
To fix this issue, you can delete the definitions and download and update them again:
 
  su - zimbra
 
  su - zimbra
 
  mkdir /tmp/clamdb
 
  mkdir /tmp/clamdb
(in versions prior to 5.0.3):
+
(in versions prior to 5.0.3)
 
  mv /opt/zimbra/clamav/db/* /tmp/clamdb
 
  mv /opt/zimbra/clamav/db/* /tmp/clamdb
(in version 5.0.3 or later):
+
(in version 5.0.3 or later)
 
  mv /opt/zimbra/data/clamav/db/* /tmp/clamdb
 
  mv /opt/zimbra/data/clamav/db/* /tmp/clamdb
  
Line 26: Line 33:
 
  zmantivirusctl stop
 
  zmantivirusctl stop
 
  zmantivirusctl start
 
  zmantivirusctl start
(zmantivirusctl incorporates zmclamdctl/zmamavidsctl/zmmtaconfigctl though you can just restart ClamAV individually)
+
 
 +
'''''Note:''' '''zmantivirusctl''' incorporates '''zmclamdctl/zmamavidsctl/zmmtaconfigctl''' though you can just restart ClamAV individually.''
  
  
==Verify==
+
=Verify=
 
Verify by running:
 
Verify by running:
 
  /opt/zimbra/clamav/bin/clamscan -d /opt/zimbra/data/clamav/db/
 
  /opt/zimbra/clamav/bin/clamscan -d /opt/zimbra/data/clamav/db/
Line 37: Line 45:
  
 
[[Category:Anti-virus]]
 
[[Category:Anti-virus]]
[[Category: Pending Certification]]
+
[[Category:Certified]]
 +
[[Category:Troubleshooting]]

Revision as of 17:48, 30 June 2008


Sometimes ClamAV will download a virus update, and the update will not download correctly. This causes an error in its checksum. If this happens, ClamAV usually goes down and the system suspends delivery. Downloading fresh definition files can correct this problem.

Symptoms

You will experience the following symptoms if ClamAV fails to correctly download a virus update:

The definitions are corrupt if in /var/log/zimbra.log:

  • ClamAV isn't running
  • postfix/qmgr errors out at delivery temporarily suspended

And in /opt/zimbra/log/clamd.log:

  • There are log error messages, like malformed database
  • zmclamdctl status shows clamd as down.

The following symptoms may occur if you stop & restart Zimbra services (using zmcontrol stop and zmcontrol start):

  • Antivirus may fail to start with the error (among others) clamd failed to start

Note: The WARNING: Your ClamAV installation is OUTDATED! error may also appear, but this is not indicative of a corrupt clamd database. This error simply occurs because ClamAV has a more recent release available than the one that ships with Zimbra. Updating your ClamAV installation to a version not included with a released ZCS product is not recommended and is not supported. Zimbra updates the ClamAV engine to latest with every release of ZCS. Users who wish to upgrade ClamAV independently from ZCS at their own risk can find directions here: ClamAV - Updating Version Out of cycle updates RFE is Bug 15137

Note: ClamAV Virus definitions update automatically every 2h by default (zimbraVirusDefinitionsUpdateFrequency attribute).

Fix

To fix this issue, you can delete the definitions and download and update them again:

su - zimbra
mkdir /tmp/clamdb

(in versions prior to 5.0.3)

mv /opt/zimbra/clamav/db/* /tmp/clamdb

(in version 5.0.3 or later)

mv /opt/zimbra/data/clamav/db/* /tmp/clamdb
zmprov ms `zmhostname` +zimbraServiceEnabled antivirus
/opt/zimbra/clamav/bin/freshclam --config-file=/opt/zimbra/conf/freshclam.conf 
zmantivirusctl stop
zmantivirusctl start

Note: zmantivirusctl incorporates zmclamdctl/zmamavidsctl/zmmtaconfigctl though you can just restart ClamAV individually.


Verify

Verify by running:

/opt/zimbra/clamav/bin/clamscan -d /opt/zimbra/data/clamav/db/

In releases prior to 5.0.3, this command will be:

/opt/zimbra/clamav/bin/clamscan -d /opt/zimbra/clamav/db/
Jump to: navigation, search