freshclam.log and clamav.log suddenly empty...

Question

Level 1

119 points

freshclam.log and clamav.log suddenly empty...

My mail server appears to be running fine, and the databases are updating...but...it appears the clamav and freshclam logs are suddenly empty. No config changes happened on the server, they just stopped logging and haven't restarted. One other odd thing: In Server Admin, under the "Update the virus databases X times per day" it shows "Last update: Not available."

For the heck of it, I decided to temporarily rename the log files to see if I could get fresh versions to generate. Bad things happened...so I moved them back. Suddenly, the virus update log started to work again, but the clamav did not; it is still empty.

Any ideas on what is happening?

Message was edited by: Matt Domenici

Mac OS X (10.5)

Posted on Oct 20, 2008 6:47 PM

Reply

Answer 1

Matt Domenici Author

Level 1

119 points

Oct 22, 2008 8:28 AM in response to Matt Domenici

So the log rotated this morning on clamav.log -- and surprise, it is now empty too.

I've traced this back to the October 2008 - 007 Security Update on the server. Since applying the update, the logs, when rotated become empty. It appears the server cannot/does not write to them anymore. Has anyone else seen this issue and how can I address it...?

Reply

Answer 2

pterobyte

Level 6

11,104 points

Oct 22, 2008 10:41 AM in response to Matt Domenici

Check clamav.conf, clamd.conf and freshclam.conf to see where they are set to log. The latest security update, updates ClamAV. As of ClamAV 0.93.x the conf file format has changed.

Reply

Answer 3

Matt Domenici Author

Level 1

119 points

Oct 22, 2008 10:58 AM in response to pterobyte

Mmm...I'll look again, but they both appear to be set to log in /var/log -- the system creates files when the logs rotate, they're just zero bytes and never get any data put in them...

Is is possible there's some other sort of issue preventing the log data from being written? Or is the log file rotation process separate?

- Matt

Reply

Answer 4

AK_Mike

Level 4

1,233 points

Oct 22, 2008 5:11 PM in response to Matt Domenici

I find that if left alone both logs are empty after a few days.

However if I change the settings (checkbox) for use antivirus and how often to update the antivirus, save and then change it back, things start proceeding normally again.

Just ain't had the time to look into it more.

I believe one or more processes (daemons) stop and don't restart.

Reply

Answer 5

Matt Domenici Author

Level 1

119 points

Oct 22, 2008 11:23 PM in response to AK_Mike

Changing the settings has no effect for me.

Reply

Answer 6

Matt Domenici Author

Level 1

119 points

Oct 23, 2008 10:40 PM in response to Matt Domenici

I checked, they are definitely still pointing to that location, the files rotate, go to zero bytes, and then never update again.

Reply

Answer 7

Matt Domenici Author

Level 1

119 points

Nov 1, 2008 10:33 AM in response to Matt Domenici

Well, now all three logs are consistently empty, all after they were rotated...

Does anyone have any other ideas?

Reply

Answer 8

pterobyte

Level 6

11,104 points

Nov 1, 2008 10:55 AM in response to Matt Domenici

Try and delete /var/log/asl.db and reboot.

Message was edited by: pterobyte

Reply

Answer 9

Matt Domenici Author

Level 1

119 points

Nov 3, 2008 10:01 PM in response to pterobyte

That did it! Thanks!

Reply

Answer 10

Nov 4, 2008 5:40 AM in response to pterobyte

Alex, I not sure if this is really the fix. I believe I have the same issue and just rebooting fixes the problem until the next log rotate. I will delete asl.db and wait a week for the next log rotation. Fingers crossed.

Reply

Answer 11

Matt Domenici Author

Level 1

119 points

Nov 7, 2008 8:55 AM in response to Ga_Fishnut

You're right -- after deleting asl.db, rebooting, the logs rotated, no go. They're empty again.

Reply

Answer 12

Matt Domenici Author

Level 1

119 points

Nov 7, 2008 8:55 AM in response to Matt Domenici

The fix unfortunately did not work...

Reply

Answer 13

msandri

Level 1

9 points

Nov 9, 2008 3:07 PM in response to Matt Domenici

Hi,

I had the very same problem, and I've been able to find a fix. It seems the script /etc/periodic/daily/700.daily.server.cyrus is unable to signal both freshclam and amavisd processes once the log files have been rotated, because it relies on a different "ps" program output, and this makes it fail when searching for the process ID.

I've fixed the problem by changing line 137 of the script from:

+($pid, $tt, $stat, $time, $cmdAndArgs) = split(' ', $line, 5);+

to:

+($pid, $tt, $time, $cmdAndArgs) = split(' ', $line, 5);+

as "ps -axwww" doesn't output status column anymore.

Hope this helps...

Reply

Answer 14

Matt Domenici Author

Level 1

119 points

Nov 28, 2008 2:57 PM in response to msandri

Thanks, I've tried this, will let you know how it goes.

Reply

Answer 15

Nov 29, 2008 7:47 PM in response to Matt Domenici

Thanks, this fixed it for me as well.
Harry

Reply