errors from freshclam-sleep

quietFinn

Well-Known Member
Feb 4, 2006
1,707
353
438
Finland
cPanel Access Level
Root Administrator
Couple of days ago we started getting this kind of emails from all of our servers:

Code:
Cron <[email protected][host]> /usr/share/clamav/freshclam-sleep

ERROR: Can't open /var/lib/clamav/mirrors.dat for writing
ERROR: Can't open /var/lib/clamav/mirrors.dat for writing
.... (more same lines)
/var/lib/clamav/ directory looks like this:


drwxr-xr-x 3 clamupdate clamupdate 4096 Aug 29 14:07 .
drwxr-xr-x. 29 root root 4096 Aug 29 03:30 ..
-rw-r--r-- 1 clamupdate clamupdate 1038848 Aug 28 05:07 bytecode.cld
drwxr-xr-x 3 491 485 4096 Mar 7 03:30 clamav-9939694aa3a0bca18c94c57ea2061c36.tmp
-rw-r--r-- 1 clamupdate clamupdate 141753856 Aug 29 14:06 daily.cld
-rw-r--r-- 1 clamupdate clamupdate 117892267 Aug 21 16:46 main.cvd
-rw------- 1 491 485 728 Aug 13 03:15 mirrors.dat



Any advice to fix this?
 
Last edited:

cPanelLauren

Product Owner II
Staff member
Nov 14, 2017
13,274
1,295
313
Houston
The ownership of those files is really strange. the user/group should be clamupdate

You can update the owner by running the following:

Code:
chown clamupdate:clamupdate mirrors.dat
 

quietFinn

Well-Known Member
Feb 4, 2006
1,707
353
438
Finland
cPanel Access Level
Root Administrator
The ownership of those files is really strange. the user/group should be clamupdate

You can update the owner by running the following:

Code:
chown clamupdate:clamupdate mirrors.dat
I changed the user/group in one server and check later if that fixes the problem.
 
  • Like
Reactions: cPanelLauren

quietFinn

Well-Known Member
Feb 4, 2006
1,707
353
438
Finland
cPanel Access Level
Root Administrator
Did this fix the problem? I started getting these same errors.
Yes, after I changed user/group all seems fine.
But still nobody seems to know why that happened.
 

cPanelLauren

Product Owner II
Staff member
Nov 14, 2017
13,274
1,295
313
Houston
The best answer I can give you as to WHY it happened is that this seems to be a symptom of the recent issues CloudLinux/Imunify had with ClamAV - specifically with the retention of clamav-db package which is an outdated package instead of the current package clamav-update. This is discussed in this thread: ClamAV update script and logging issues