Robert S Galloway wrote:
The file was created again today at 04:08 local, which leads me to
believe this is happening when some cron job is running. It's being
created by user root and is empty.
Thanks, Robert
I finally found a file called "*.cvd" in the /usr/share/clamav
folder, but I haven't got a clue how it got there. Anyone have any
ideas? I've deleted it and I'm getting mail but I want to be sure
this doesn't happen again.
Thanks, Robert
Robert et al, see:
http://lurker.clamav.net/message/20070411.175950.b7329d9f.en.html
If that url goes away, here's partial text of that message (not written by
me)
---
....
I found this file too when I was investigating the problem I talk about in
my post "Clamav suddenly died on several boxes". I found the the '*.cvd'
file is created by a daily cron script, /etc/cron.daily/freshclam, which
issues the command
/bin/touch -a /var/lib/clamav/*.cvd
This command creates the file *.cvd (literally) when there's no .cvd file in
/var/lib/clamav .
It's clear the the original intention of the command was to protect cvd
files from being deleted by the subsequent command
/usr/sbin/tmpwatch 72 /var/lib/clamav
but since now we're switching to .inc directories instead of .cvd files,
this command is not correct any more.
I think that the touch command should be substituted by something like
(maybe can done in a more compact):
find /var/lib/clamav/ -type f -name '*.cvd' -exec touch -a '{}' ';'
find /var/lib/clamav/ -type d -name '*.inc' | while read dir; do find
$dir -exec touch -a '{}' ';' ; done
....
---
I'll add that this is the result of the "ScriptedUpdates" feature in newer
clamav versions. If you edit /etc/freshclam.conf and make the
scriptedupdates option "no", delete the contents of /var/lib/clamav/*, and
restart the freshclam service and run it manually at the command line,
you'll get new main and daily.cvd files like in previous verisons, rather
than the "inc" versions. Or you can probably follow the advice in that
message above, regarding the cron file.
Paul
--
Paul Oehler
NEXCESS.NET Internet Solutions
http://nexcess.net
304 1/2 S. State St.
Ann Arbor, MI 48104
1.866.NEXCESS
---------------------------------------------------------------------
QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
