Topic: clam AV not updating

[shadetreecomputer]

Started receiving emails with the following message today:

2013-02-14 14:03:45.709967500 ClamAV update process started at Thu Feb 14 14:03:44 2013
2013-02-14 14:03:45.709970500 main.cvd is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven)
2013-02-14 14:03:45.709971500 WARNING: getpatch: Can't download daily-16682.cdiff from database.clamav.net
2013-02-14 14:03:45.709972500 WARNING: getpatch: Can't download daily-16682.cdiff from database.clamav.net
2013-02-14 14:03:45.709973500 WARNING: getpatch: Can't download daily-16682.cdiff from database.clamav.net
2013-02-14 14:03:45.709974500 WARNING: getpatch: Can't download daily-16682.cdiff from database.clamav.net
2013-02-14 14:03:45.709986500 WARNING: getpatch: Can't download daily-16682.cdiff from database.clamav.net
2013-02-14 14:03:45.709987500 WARNING: getpatch: Can't download daily-16682.cdiff from database.clamav.net
2013-02-14 14:03:45.709988500 WARNING: Incremental update failed, trying to download daily.cvd
2013-02-14 14:03:45.709989500 WARNING: Can't download daily.cvd from database.clamav.net
2013-02-14 14:03:45.709991500 Trying again in 5 secs...

They arrive approximately every hour.
I have another server running the same version and configured the same, but it is not sending these messages.

Thanks for your assisstance

[Stefano]

hi,  welcome here
please search the forum and read the FAQ,  you'll find the answer

[janet]

shadetreecomputer

This does happen every so often, usually for reasons beyond sme end user control.

2013-02-14 14:03:45.709970500 main.cvd is up to date

It's up to date so do not be alarmed.

At the end it usually says, or at least my email warning message says:

2013-02-15 11:44:21.002902500 Update failed. Your network may be down or none of the mirrors listed in /etc/freshclam.conf is working. Check http://www.clamav.net/support/mirror-problem for possible reasons.

So please read that web site
http://www.clamav.net/lang/en/mirror-problem/

and wait a while for the system to self fix or be fixed (in the most likely scenario)

[wellsi]

http://lurker.clamav.net/message/20130214.163139.13906576.en.html

In preparation for the 0.98 release, we needed to push out a new database
file. We couldn't do this by pushing a cdiff out, so the 16682 daily.cvd
update does not have a corresponding cdiff. Clients will be downloading the
full daily.cvd for 16682.

In short: there is no cdiff for the 16682 daily.cvd update.

[p-jones]

I have been battling with this same issue for about 4 weeks.  It started with a couple of V8 machines . AFTER READING THE FORUMS and following the advice I sorted this issue for a couple of days but it returned and is now systematically appearing on other machines both V7 and V8.

Running freshclam -v suggest it has all updated successfully but the messages still appear.

2013-02-15 20:18:50.317329500 WARNING: getpatch: Can't download daily-16685.cdiff from database.clamav.net
2013-02-15 20:18:50.318178500 WARNING: getpatch: Can't download daily-16685.cdiff from database.clamav.net
2013-02-15 20:18:50.319004500 WARNING: getpatch: Can't download daily-16685.cdiff from database.clamav.net
2013-02-15 20:18:50.319848500 WARNING: getpatch: Can't download daily-16685.cdiff from database.clamav.net
2013-02-15 20:18:50.320682500 ERROR: getpatch: Can't download daily-16685.cdiff from database.clamav.net
2013-02-15 20:18:50.364461500 WARNING: Incremental update failed, trying to download daily.cvd

[root@server ~]# freshclam -v
Current working dir is /var/clamav
Max retries == 6
ClamAV update process started at Fri Feb 15 20:43:06 2013
Using IPv6 aware code
Querying current.cvd.clamav.net
TTL: 4402
Software version from DNS: 0.97.6
main.cvd version from DNS: 54
main.cvd is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven)
daily.cvd version from DNS: 16685
daily.cvd is up to date (version: 16685, sigs: 781011, f-level: 63, builder: guitar)

Also 16685 is newer than 16682 refered to at http://lurker.clamav.net/message/20130214.163139.13906576.en.html

[dstevens]

Shadetree, et al

Unfortunately, the information on the http://www.clamav.net/lang/en/mirror-problem/ page is not, IMHO, overly helpful.

I imagine that you, like I have, searched the web and this site for answers - both before and after posting.

Sometimes, it is easy to overlook a potential answer...

Try this in a console session, logged in as root.  Initiate a manual update of clamav - type 'freshclam' at the prompt.

If you still get errors, navigate to /var/clamav and delete the mirrors.dat file. Re-run the freshclam command again.

[shadetreecomputer]

Yep, been looking in the FAQ & searching both before and after...

Ran 'freshclam' from console - errors
Deleted mirrors.dat from /var/clamav
Ran 'freshclam' again - appears to have updated

Compare server-manager antivirus page on the happy server to this unhappy one & they are now showing the same version(s) of both clamav and the db.

We'll see what happens...

Thanks,
STC

[Drifting]

So far I have 10 servers sending quite a large amount of these update error every few mins.
Tried the suggestions on my local server, deleting the mirrors.dat, still got the error.
I assume then by what this thread is saying is "sit tight, it will be fixed"?

P

[kmccarn]

So - I did the mirrors.dat stuff - didn't work.

I deleted the daily.cvd - reran freshclam (it updated the daily and main.cvd) - and all is well.

[janet]

Dear All

There is a bug report open for this issue
http://bugs.contribs.org/show_bug.cgi?id=7353

Refer workaround in Comment 16
rm -f /var/clamav/daily.cvd
freshclam

and also Comment 18
That might be a workaround, but doesn't diagnose or fix the problem.

Please add any further comments or feedback ONLY to the bug report so all the pertinent information is contained in one place, and perhaps a proper fix can be determined, rather than just a workaround.

[shadetreecomputer]

That seems to have healed mine.  Haven't gotten another email / error on this issue since this morning.

[dave simmons]

Workaround posted above hasn't worked for me   

[janet]

dave simmons

Workaround posted above hasn't worked for me   

....and that is why all reports whether positive or negative should be reported to bugzilla, rather than here.

[dave simmons]

dave simmons

....and that is why all reports whether positive or negative should be reported to bugzilla, rather than here.

Posted

[Drifting]

Mine is all good now, thank you for the workaround, was getting annoying all those emails.

P