From: "Steven Levine" <ecs-isp@2rosenthals.com>
Message-ID: <6528804f.2.mr2ice.fgrirsq@earthlink.net>
Date: Thu, 12 Oct 2023 15:25:03 -0800
To: "eCS ISP Mailing List" <ecs-isp@2rosenthals.com>
In-Reply-To: <list-8110697@2rosenthals.com>
Subject: Re: [eCS-ISP] ClamAV

In <list-8110697@2rosenthals.com>, on 10/12/23
   at 08:44 PM, "Massimo S." <ecs-isp@2rosenthals.com> said:

Hi Massimo,


>> Where did you get these URLs from?  On my currently partially working
>> ClamAV setup (ClamAV 0.103.6), freshclam is attempting to download
>i searched online:
>https://askubuntu.com/questions/1280581/how-to-offline-update-clamav-database

I've already seen this link.  I noticed when I read it that is was over 3
years old and that the links did not match the ClamAV documented link.  I
suspected the information might be stale and your results seem to confirm
that this.

>>    https://database.clamav.net/daily.cvd
>> which fails because OpenSSL cannot find a certificate and complains:
>>   * error setting certificate verify locations:  CAfile:
>> /etc/ssl/cacert.pem CApath: none
>> Did you get this failure and if so what did you do to correct it?
>i don't get the same error

Oh well.

>i get this from freshclam:
>WARNING: downloadPatch: Can't download daily-26075.cdiff from
>https://database.clamav.net/daily-26075.cdiff 

The broswer tells me this .cdiff is gone.  It's probably already been
replaced.

>WARNING: Incremental update failed, trying to download daily.cvd WARNING:
>Stderr output from database load : realloc_problem: Not enough memory

We seen this one often enough.  Once I get freshclam to the point where it
will attempt to download files, I will look at what we can do to avoid the
realloc failure.  One though I had was to allocate all the space that will
be needed at startup.  This will avoid the realloc.  This may not be
sufficient, but we won't know without some testing.

>doh :-)

:-)

>no.. here it say 1.20.3
>i tried again yum update, but it don't find any update

That's the last i686 version.  You need to switch to the pentium4 platform
or settle for using the efficiently unsupported i686 builds.

[d:\tmp]yum --noplugins --disablerepo=*exp -C list installed wget
Installed Packages
wget.pentium4                     1.21.3-1.oc00                    
@netlabs-rel

>>> i can only download them from my pc with the browser, but i don't think
>>> this is an option
>> 
>> Why not?  I've not tried this yet.

>manual updates??

Sure.  Like I said why not.  I downloaded current copies of main.cvd and
daily.cvd using firefox on suse and clamscan happily accepted them. 
Unfortunately, wasn't paying attention and left both firefox and dooble
running so I ended with with a 350MB swap file and a system that needed to
be rebooted.  My bad.

>i use SPE to low down priority of clamav (on server1 the one that
>freezed) maybe this could create issues?

Possibly.  However, I would suspect excessive memory use.

>but if i add daily signatures and sanesecurity* i get this:

>LibClamAV Warning: **************************************************
>LibClamAV Warning: ***  The virus database is older than 7 days!  ***
>LibClamAV Warning: ***   Please update it as soon as possible.    ***
>LibClamAV Warning: **************************************************
>realloc_problem: Not enough memory

Makes sense.  This needs to be resolve or the current ClamAV will continue
to be a not quite ready for production use running on OS/2.


Steven

-- 
----------------------------------------------------------------------
"Steven Levine" <steve53@earthlink.net>  Warp/DIY/BlueLion etc.
www.scoug.com www.arcanoae.com www.warpcave.com
----------------------------------------------------------------------