Topic: Freshclam error

[ReetP]

Hi,

I recently started getting hourly mails as follows :

Subject : Cron <root@esmith> /usr/bin/freshclam --quiet

Body : ERROR: Problem with internal logger.

I thought it might be log file permissions but have checked them and they appear to be OK.

Have tried a reboot to no avail.

It's slowly driving me nuts - the drip drip of the leaky tap. Chinese water torture !

Anyone have any idea what is causing this ? Can I enable more advanced logging to try to discover what is going on ?

Many thanks.
John

[warren]

John
Try running /usr/bin/freshclam --debug from command line and also
/usr/bin/freshclam -v  (verbose)

Warren

[ReetP]

Thanks Warren,

I did that and got the following :

# /usr/bin/freshclam --debug
ClamAV update process started at Wed Apr 26 08:38:33 2006
main.cvd is up to date (version: 38, sigs: 51206, f-level: 7, builder: tkojm)
daily.cvd is up to date (version: 1425, sigs: 1860, f-level: 7, builder: ccordes)

#/usr/bin/freshclam -v
Current working dir is /usr/share/clamav
Max retries == 6
ClamAV update process started at Wed Apr 26 08:47:04 2006
Querying current.cvd.clamav.net
TTL: 900
Software version from DNS: 0.88.1
main.cvd version from DNS: 38
main.cvd is up to date (version: 38, sigs: 51206, f-level: 7, builder: tkojm)
daily.cvd version from DNS: 1425
daily.cvd is up to date (version: 1425, sigs: 1860, f-level: 7, builder: ccordes)
Freeing option list...done

I can't see anything else in the logs. I have just enabled verbose logging in freshclam.conf too see if that shows anything.

Everything looks normal but something is obviously not quite right.

[ReetP]

Anyone have any ideas about this error as I am stuck.

[nmtrier]

I am getting exactly the same message emailed to me as admin every 2 hours:
the messsage title is:
Cron <root@server1> /usr/bin/freshclam --quiet
and the message body is:
ERROR: Problem with internal logger.

Since we are both in the UK, perhaps it is something to do with locale and update servers?
Nick

[ReetP]

Hi Nick,

you may well have a point.

Just noticed in the server panel :

Virus Definition Scheduled Updates
(Virus patterns last updated: Wed, 19 Apr 2006 22:20:05 +0100 )

OOOpppssss !

So something is not updating correctly I guess.

My update period is set too one hour and I point to the UK updates. I have just changed it to 2 hours and Belgium and will see what occurs.

John

[wellsi]

In the UK, connecting via NTL - it just works (for me).

From the panel:
Virus patterns last updated: Wed, 3 May 2006 20:12:02 +0100 )
Select country for database updates    UK
Update every 2 hours

Here is the last update:
ClamAV update process started at Thu May  4 08:12:00 2006
main.cvd is up to date (version: 38, sigs: 51206, f-level: 7, builder: tkojm)
daily.cvd is up to date (version: 1438, sigs: 2038, f-level: 8, builder: ccordes)

Sorry that I cannot help more

[brianr]

I am also geting this error, and cannot see why (also in the UK).  I suggest you open an issue in the bugtracker, and we can see if we can track it down.  It started with the previous version of Clam 0.88.1 and is still happening now with 0.88.2.  Interestingly it is only on one of 16 boxes!! (my inhouse one)

[ReetP]

Hmm. Having changed update period and location, no joy. Still getting mails.

I ran the following. It seemed to update OK and showed the time of last update changed from 26th April as per my last post to

Virus Definition Scheduled Updates
(Virus patterns last updated: Thu, 4 May 2006 10:02:05 +0100 )

However the logs show that it seems to have updated the definitions OK.

[root@esmith root]# /usr/bin/freshclam -v
Current working dir is /usr/share/clamav
Max retries == 6
ClamAV update process started at Thu May  4 10:49:16 2006
Querying current.cvd.clamav.net
TTL: 900
Software version from DNS: 0.88.2
main.cvd version from DNS: 38
main.cvd is up to date (version: 38, sigs: 51206, f-level: 7, builder: tkojm)
daily.cvd version from DNS: 1439
daily.cvd is up to date (version: 1439, sigs: 2043, f-level: 7, builder: sven)
Freeing option list...done
[root@esmith root]# /usr/bin/freshclam --debug
ClamAV update process started at Thu May  4 10:49:41 2006
main.cvd is up to date (version: 38, sigs: 51206, f-level: 7, builder: tkojm)
daily.cvd is up to date (version: 1439, sigs: 2043, f-level: 7, builder: sven)

From the look of my logs, it upgraded from 0.88.1 to 0.88.2 on Sunday 30th April.

Thoroughly confused

As this isn't part of the core OS, is the bugtracker the right place to post ?

B. Rgds
John

[brianr]

As this isn't part of the core OS, is the bugtracker the right place to post ?

the perceived wisdom is to use the bugtracker to track all bugs, as it gives a much more disciplined environment for tracking solutions etc, although there does not seem to be a category for SME6 contribs.

[ReetP]

Understand.

Just found there is a section for contribs.

http://bugs.contribs.org/query.cgi

Look for SME contribs on the Products drop down.

Anyone have any further thought or input that we can lob into the tracker ?

[warren]

Hi John,

Subject : Cron <root@esmith> /usr/bin/freshclam --quiet

Body : ERROR: Problem with internal logger.

I'm thinking that this error is not relted to the AV but something else. ( my thinking is towards : /usr/bin/logger -i -t e-smith ) as the error message is been generated when cron is trying to run /usr/bin/freshclam --quiet )

See /etc/e-smith/templates/etc/crontab/40freshclam
Try re-expand the templates.

Has this or the crontab file changed?

Does the cron log show an entry :
May  1 08:12:00 server CROND[3775]: (root) CMD (/usr/bin/freshclam --quiet)

Warren

[ReetP]

Thanks Warren.

Am away until Monday - I'll have a look then.

[nmtrier]

I searched on the web for this error message and found the following suggestion on http://lists.clamav.net/message/20060503.044340.42218713.en.html
"I ran into this issue on one of three servers I upgraded to 0.88.2
today. After running your trace, it was obvious that another process had
the logfile already open for writing. An inspection via ps -ef | grep
freshclam revealed a previous run was hung in some fashion. Killing the
previous process cleared things up.
regards,
jim"

I found that I had the following process running since 1st May when my problems arose:
[root@server1 clamav]# ps -ef|grep freshclam
qmailq   24275 24274  0 May01 ?        00:00:00 /usr/bin/freshclam --quiet

I issued the command
kill 24275
to stop this process, and now I get the (expected) results from running:
[root@server1 clamav]# /usr/bin/freshclam -v
Current working dir is /usr/share/clamav
Max retries == 6
ClamAV update process started at Sat May  6 23:27:33 2006
Querying current.cvd.clamav.net
TTL: 900
Software version from DNS: 0.88.2
main.cvd version from DNS: 38
main.cvd is up to date (version: 38, sigs: 51206, f-level: 7, builder: tkojm)
daily.cvd version from DNS: 1445
daily.cvd is up to date (version: 1445, sigs: 3085, f-level: 8, builder: ccordes)
Freeing option list...done

where previously I just got the error message.  

I can now confirm that this has stopped the irritating message every 2 hours, and freshclam has now successfully collected updated signatures on the 2 hourly shedule.  

This leaves open the question as to why the freshclam process failed to stop on 1st May, and why subsequent invocations do not attempt to kill the previous one.  However, it is possible that the problem coincided with my manual installation of the upgrade which would be plain bad luck!

[ReetP]

Problem solved - I think !

I looked in the cron log and found that there were two entries at the same time :


May 1 08:12:00 esmith CROND[3775]: (root) CMD (/usr/bin/freshclam --quiet)
May 1 08:12:00 esmith CROND[3775]: (root) CMD (/usr/bin/freshclam --quiet)


I looked in the templates directory and found that there were two entries :

40freshclam
40freshclambjr

The templates were identical and basically duplicated the entries in crontab. So it was kicking off two processes at the same time, one of which locked the file.

I moved the 40freshclambjr to another directory, expanded the template and I am just waiting too see if it works.

Will post back as soon as I know.

[brianr]

40freshclambjr

Yes I also have that file - and have deleted it.  It is one I sent Jesper many moons ago, as part of an update to the freshclam mechanism, It must have sneaked into the update for 0.88.1.

[ReetP]

Ah ha ! That makes sense now Brian - thanks.

All seems quiet on the Western Front now. Pretty sure it's cured. What about everyone else ?

[Brenno]

Hmm... found this thread after starting to receive this same "internal logger" error via email this morning.

I have checked my cron logs, and I do not have two instances of cron running freshclam at the same time.  I also don't have that extra templates file "40freshclambjr" that ReetP had.  But I still get the message!

Running clam 0.88.2.

Thoughts?

[nmtrier]

I do not have two instances of cron running freshclam at the same time.  

Thoughts?

That sounds like my symptons last week. Do you still have one instance of frechlam running? it is supposed to run and finish, but I had the process running from May 1st until I killed it on May 6th.  During that whole time I got the irritating message, but as soon as I killed the rogue instance of fresclam, normal service resumed. (see my previous post on page 1)
Nick

[Brenno]

nmtrier,

Yes - I did have one instance running.  After re-reading your initial post, I realized that it shouldn't have been.  I killed the process as per your instructions and all is well now.  Thanks!

[ReetP]

Uh oh. It's started again !

It look like the job is not finishing correctly or something as if I ps -e |grep fresh I still have a process running.

If I kill it, it seems to be OK for the next run, but then doesn't seem to end the task again.

Now if I try to type :

/usr/bin/freshclam -v
/usr/bin/freshclam --quiet
/usr/bin/freshclam --debug

I get 'Problem with internal logger'

I have just swapped the update servers over to Belgium rather than the UK . I then ran :

/usr/bin/freshclam -l /var/log/clamav/clam-update.log

This checked the updates and now I no longer get the error messages at the command prompt. I'll wait and see what occurs next.

[ReetP]

All quiet at the moment with servers set to Belgium.

Will monitor accordingly. Away for a week now. Will try to go back to the UK servers when I get back.

[Knuddi]

Just noticed this thread - there is not additional 40freshclambrj in the disti of sme-antivirus and the clam package doesn't have that either. This file must come from somewhere else

[Brenno]

Revisted this thread this morning after having the "Problem with internal logger" emails reappear.  This time, I knew how to fix it, thanks to these forums, but why might it be happening again?

[ReetP]

The best return from holiday that I could have - no email warnings !

Just going to try my local UK servers again and see what happens.