Re: Clamav-deamon Bug

[Mike Bird <mgb-debian@yosemite.net>]

On Sunday 20 May 2007 05:17, David Baron wrote:
> I usually cannot find any dmesg entry for this problem. ONE time I did see
> one and the complaint was about permissions for opening the log file in
> append mode. The logfile's owner and the executer of clamd is "clamav" and
> the file;s permissions (rw r . )look fine.
>
> I originally thought that it tries to append the file, fails, logrotate
> moves it away and a new file can be created successfully. This is not the
> case since this log is rotated one per week!

How, if at all, does your config differ from this?

# grep clam /etc/{passwd,group}
/etc/passwd:clamav:x:113:113::/var/lib/clamav:/bin/false
/etc/passwd:clamsmtp:x:114:114::/var/spool/clamsmtp:/bin/false
/etc/group:clamav:x:113:
/etc/group:clamsmtp:x:114:clamav
# ls -dl /var/*/clam*
drwxr-xr-x 4 clamav clamav    4096 2007-05-20 10:38 /var/lib/clamav
drwxr-xr-x 2 clamav clamav    4096 2007-05-20 01:17 /var/log/clamav
drwxr-xr-x 2 clamav clamav    4096 2007-05-20 01:17 /var/run/clamav
drwxr-xr-x 2 clamav clamsmtp  4096 2007-05-14 23:47 /var/run/clamsmtp
drwxr-x--- 2 clamav clamsmtp 61440 2007-05-20 11:04 /var/spool/clamsmtp
# ls -l /var/log/clamav/clamav.log
-rw-r----- 1 clamav adm 953 2007-05-20 10:18 /var/log/clamav/clamav.log
# debconf-show clamav-base
* clamav-base/ScanMail: true
* clamav-base/LogSyslog: false
* clamav-base/AddGroups: clamsmtp
  clamav-base/socket-note:
* clamav-base/FixStaleSocket: true
* clamav-base/FollowDirectorySymlinks: false
* clamav-base/debconf: true
  clamav-base/numinfo:
  clamav-base/TCPAddr: any
* clamav-base/SelfCheck: 3600
* clamav-base/ReadTimeout: 180
* clamav-base/ScanArchive: true
* clamav-base/ScanRAR: false
* clamav-base/TcpOrLocal: UNIX
* clamav-base/FollowFileSymlinks: false
* clamav-base/MaxConnectionQueueLength: 15
* clamav-base/ArchiveMaxRecursion: 5
* clamav-base/ArchiveMaxFileSize: 10
* clamav-base/MaxThreads: 12
* clamav-base/MaxDirectoryRecursion: 15
* clamav-base/LogFile: /var/log/clamav/clamav.log
* clamav-base/LogTime: true
* clamav-base/LocalSocket: /var/run/clamav/clamd.ctl
* clamav-base/ArchiveMaxCompressionRatio: 0
* clamav-base/StreamMaxLength: 10
  clamav-base/TCPSocket: 3310
* clamav-base/User: clamav
* clamav-base/ArchiveMaxFiles: 1000

--Mike Bird