Oscar Usifer wrote: >> ----- Original Message ----- >> From: "Noel Jones" <[EMAIL PROTECTED]> >> To: "ClamAV users ML" <clamav-users@lists.clamav.net> >> Subject: Re: [Clamav-users] Freshclam to ClamAV sig parity count mismatch >> Date: Thu, 04 Sep 2008 12:45:41 -0500 >> >> >> Oscar Usifer wrote: >>> Folks, >>> >>> I am seeing freshclam report more signatures than clamav is >>> reloading in the logs files. For example freshclam says, >>> 'Database updated (413786 signatures)...' and 'Clamd successfully >>> notified about the update.', but clamd says, 'Database correctly >>> reloaded (312304 signatures)'. Why does it do that? >>> >>> ==> /var/log/clamav/freshclam.log <== >>> Thu Sep 4 09:34:07 2008 -> Received signal: wake up >>> Thu Sep 4 09:34:07 2008 -> ClamAV update process started at Thu >>> Sep 4 09:34:07 2008 >>> Thu Sep 4 09:34:07 2008 -> main.cvd is up to date (version: 47, >>> sigs: 312304, f-level: 31, builder: sven) >>> Thu Sep 4 09:34:07 2008 -> Trying host db.us.clamav.net (208.67.80.27)... >>> Thu Sep 4 09:34:07 2008 -> Downloading daily-8161.cdiff [100%] >>> Thu Sep 4 09:34:08 2008 -> daily.cld updated (version: 8161, >>> sigs: 101482, f-level: 35, builder: arnaud) >>> Thu Sep 4 09:34:08 2008 -> Database updated (413786 signatures) >>> from db.us.clamav.net (IP: 208.67.80.27) >>> Thu Sep 4 09:34:08 2008 -> Clamd successfully notified about the update. >>> Thu Sep 4 09:34:08 2008 -> -------------------------------------- >>> >>> ==> /var/log/clamav/clamd.log <== >>> Thu Sep 4 09:47:02 2008 -> SelfCheck: Database modification >>> detected. Forcing reload. >>> Thu Sep 4 09:47:02 2008 -> Reading databases from /var/lib/clamav >>> Thu Sep 4 09:47:05 2008 -> Database correctly reloaded (312304 signatures) > >> Probably the DatabaseDirectory directives in clamd.conf and >> freshclam.conf don't match. >> > > I don't see this is the case. > > > > [EMAIL PROTECTED] ~]$ clamconf -n > /etc/clamd.conf: clamd directives > ------------------------------ > LogFile = "/var/log/clamav/clamd.log" > LogFileMaxSize = 0 > LogTime = yes > LogSyslog = yes > PidFile = "/var/run/clamav/clamd.pid" > TemporaryDirectory = "/var/tmp" > ScanPDF = yes > DatabaseDirectory = "/var/lib/clamav" > LocalSocket = "/var/run/clamav/clamd.sock" > User = "clamav" > AllowSupplementaryGroups = yes > > /etc/freshclam.conf: freshclam directives > ------------------------------ > LogFileMaxSize = 0 > LogTime = yes > LogSyslog = yes > PidFile = "/var/run/clamav/freshclam.pid" > DatabaseDirectory = "/var/lib/clamav" > AllowSupplementaryGroups = yes > Checks = 24 > UpdateLogFile = "/var/log/clamav/freshclam.log" > DatabaseMirror = "db.us.clamav.net" > DatabaseMirror = "database.clamav.net" > CompressLocalDatabase = yes > NotifyClamd = "/etc/clamd.conf" > > Engine and signature databases > ------------------------------ > Engine version: 0.94 > Database directory: /var/lib/clamav > main db: Format: .cvd, Version: 47, Build time: Mon Jun 23 11:20:53 2008 > daily db: Format: .cld, Version: 8162, Build time: Thu Sep 4 09:38:45 2008 > [EMAIL PROTECTED] ~]$ > > >
Maybe more than one freshclam.conf? Do the files in /var/lib/clamav have a recent timestamp? Search for another daily.cld somewhere? File ownership problems? Change CompressLocalDatabase back to the default "no"? -- Noel Jones _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
