Re: [clamav-users] Errors connecting to mirrors

2018-04-06 Thread Orion Poplawski 
Shouldn't matter - the resolved dns name isn't going to affect the http
request.  So that seems like a server configuration error on that mirror.

On 04/05/2018 04:40 PM, Dennis Peterson wrote:
> Since db.us.clamav.net is a round robin resolving to db.us.big.clamav.net,
> another round robin, try the actual server hostname to dl a known file. The
> specific diff files come and go and may not be on a particular mirror server.
> The following worked for me - I send the output to /dev/null to save time.
> 
> curl --resolve db.us.big.clamav.net:80:72.21.91.8
> http://db.us.big.clamav.net/bytecode.cvd 2>&1 >/dev/null
> 
> dp
> 
> 
> On 4/5/18 2:56 PM, Orion Poplawski wrote:
>> On 03/30/2018 09:48 AM, Orion Poplawski wrote:
>>> And still having persistent problems with 72.21.91.8 as reported here:
>>> https://bugzilla.clamav.net/show_bug.cgi?id=12068
>>>
>> And it is still not there:
>>
>> # curl --resolve db.us.clamav.net:80:72.21.91.8
>> http://db.us.clamav.net/daily-24447.cdiff
>> 
>> >   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd";>
>> http://www.w3.org/1999/xhtml"; xml:lang="en" lang="en">
>>  
>>  404 - Not Found
>>  
>>  
>>  404 - Not Found
>>  
>> 
>>
>> Nor any other db files...
>>
>> Feel like I'm shouting into the void with this
>>
>>
>> Here's a little test script:
>>
>> host db.us.clamav.net |
>> awk '/address/ { print $4 }' |
>> while read ip;
>> do echo Trying $ip;
>> curl --resolve db.us.clamav.net:80:$ip -w 'result=%{http_code}\n\n' -o
>> /dev/null http://db.us.clamav.net/daily-24447.cdiff;
>> done
>>
>> Output:
>>
>>
>> Trying 74.115.25.14
>>    % Total    % Received % Xferd  Average Speed   Time    Time Time 
>> Current
>>   Dload  Upload   Total   Spent    Left  
>> Speed
>>    0 0    0 0    0 0  0  0 --:--:--  0:02:07 --:--:--
>> 0result=000
>>
>> curl: (7) Failed connect to db.us.clamav.net:80; Connection timed out
>> Trying 200.236.31.1
>>    % Total    % Received % Xferd  Average Speed   Time    Time Time 
>> Current
>>   Dload  Upload   Total   Spent    Left  
>> Speed
>> 100 12309  100 12309    0 0  37220  0 --:--:-- --:--:-- --:--:-- 
>> 37300
>> result=200
>>
>> Trying 72.21.91.8
>>    % Total    % Received % Xferd  Average Speed   Time    Time Time 
>> Current
>>   Dload  Upload   Total   Spent    Left  
>> Speed
>> 100   345  100   345    0 0   6873  0 --:--:-- --:--:-- --:--:--  
>> 6900
>> result=404
>>
>> Trying 146.112.59.53
>>    % Total    % Received % Xferd  Average Speed   Time    Time Time 
>> Current
>>   Dload  Upload   Total   Spent    Left  
>> Speed
>> 100 12309  100 12309    0 0  43418  0 --:--:-- --:--:-- --:--:-- 
>> 43494
>> result=200
>>
>> Trying 198.148.78.4
>>    % Total    % Received % Xferd  Average Speed   Time    Time Time 
>> Current
>>   Dload  Upload   Total   Spent    Left  
>> Speed
>> 100 12309  100 12309    0 0  91546  0 --:--:-- --:--:-- --:--:-- 
>> 91858
>> result=200
>>
>> Trying 150.214.142.197
>>    % Total    % Received % Xferd  Average Speed   Time    Time Time 
>> Current
>>   Dload  Upload   Total   Spent    Left  
>> Speed
>> 100 12309  100 12309    0 0  18416  0 --:--:-- --:--:-- --:--:-- 
>> 18399
>> result=200
>>
>> Trying 204.130.133.50
>>    % Total    % Received % Xferd  Average Speed   Time    Time Time 
>> Current
>>   Dload  Upload   Total   Spent    Left  
>> Speed
>> 100 12309  100 12309    0 0   230k  0 --:--:-- --:--:-- --:--:--  
>> 231k
>> result=200
>>
>> Trying 12.167.151.1
>>    % Total    % Received % Xferd  Average Speed   Time    Time Time 
>> Current
>>   Dload  Upload   Total   Spent    Left  
>> Speed
>> 100 12309  100 12309    0 0  88046  0 --:--:-- --:--:-- --:--:-- 
>> 88553
>> result=200
>>
>> Trying 155.98.64.87
>>    % Total    % Received % Xferd  Average Speed   Time    Time Time 
>> Current
>>   Dload  Upload   Total   Spent    Left  
>> Speed
>> 100 12309  100 12309    0 0  67394  0 --:--:-- --:--:-- --:--:-- 
>> 67262
>> result=200
>>
>> Trying 12.167.151.2
>>    % Total    % Received % Xferd  Average Speed   Time    Time Time 
>> Current
>>   Dload  Upload   Total   Spent    Left  
>> Speed
>> 100 12309  100 12309    0 0  85108  0 --:--:-- --:--:-- --:--:-- 
>> 85479
>> result=200
>>
>> So looks like 74.115.25.14 is bad too.
>>
> 
> ___
> clamav-users mailing list
> clamav-users@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com

Re: [clamav-users] Errors connecting to mirrors

2018-04-05 Thread Dennis Peterson 
Since db.us.clamav.net is a round robin resolving to db.us.big.clamav.net, 
another round robin, try the actual server hostname to dl a known file. The 
specific diff files come and go and may not be on a particular mirror server. 
The following worked for me - I send the output to /dev/null to save time.


curl --resolve db.us.big.clamav.net:80:72.21.91.8
http://db.us.big.clamav.net/bytecode.cvd 2>&1 >/dev/null

dp


On 4/5/18 2:56 PM, Orion Poplawski wrote:

On 03/30/2018 09:48 AM, Orion Poplawski wrote:

And still having persistent problems with 72.21.91.8 as reported here:
https://bugzilla.clamav.net/show_bug.cgi?id=12068


And it is still not there:

# curl --resolve db.us.clamav.net:80:72.21.91.8
http://db.us.clamav.net/daily-24447.cdiff

http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd";>
http://www.w3.org/1999/xhtml"; xml:lang="en" lang="en">
 
 404 - Not Found
 
 
 404 - Not Found
 


Nor any other db files...

Feel like I'm shouting into the void with this


Here's a little test script:

host db.us.clamav.net |
awk '/address/ { print $4 }' |
while read ip;
do echo Trying $ip;
curl --resolve db.us.clamav.net:80:$ip -w 'result=%{http_code}\n\n' -o
/dev/null http://db.us.clamav.net/daily-24447.cdiff;
done

Output:


Trying 74.115.25.14
   % Total% Received % Xferd  Average Speed   TimeTime Time  Current
  Dload  Upload   Total   SpentLeft  Speed
   0 00 00 0  0  0 --:--:--  0:02:07 --:--:--
0result=000

curl: (7) Failed connect to db.us.clamav.net:80; Connection timed out
Trying 200.236.31.1
   % Total% Received % Xferd  Average Speed   TimeTime Time  Current
  Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  37220  0 --:--:-- --:--:-- --:--:-- 37300
result=200

Trying 72.21.91.8
   % Total% Received % Xferd  Average Speed   TimeTime Time  Current
  Dload  Upload   Total   SpentLeft  Speed
100   345  100   3450 0   6873  0 --:--:-- --:--:-- --:--:--  6900
result=404

Trying 146.112.59.53
   % Total% Received % Xferd  Average Speed   TimeTime Time  Current
  Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  43418  0 --:--:-- --:--:-- --:--:-- 43494
result=200

Trying 198.148.78.4
   % Total% Received % Xferd  Average Speed   TimeTime Time  Current
  Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  91546  0 --:--:-- --:--:-- --:--:-- 91858
result=200

Trying 150.214.142.197
   % Total% Received % Xferd  Average Speed   TimeTime Time  Current
  Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  18416  0 --:--:-- --:--:-- --:--:-- 18399
result=200

Trying 204.130.133.50
   % Total% Received % Xferd  Average Speed   TimeTime Time  Current
  Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0   230k  0 --:--:-- --:--:-- --:--:--  231k
result=200

Trying 12.167.151.1
   % Total% Received % Xferd  Average Speed   TimeTime Time  Current
  Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  88046  0 --:--:-- --:--:-- --:--:-- 88553
result=200

Trying 155.98.64.87
   % Total% Received % Xferd  Average Speed   TimeTime Time  Current
  Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  67394  0 --:--:-- --:--:-- --:--:-- 67262
result=200

Trying 12.167.151.2
   % Total% Received % Xferd  Average Speed   TimeTime Time  Current
  Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  85108  0 --:--:-- --:--:-- --:--:-- 85479
result=200

So looks like 74.115.25.14 is bad too.



___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-04-05 Thread Orion Poplawski 
On 03/30/2018 09:48 AM, Orion Poplawski wrote:
> 
> And still having persistent problems with 72.21.91.8 as reported here:
> https://bugzilla.clamav.net/show_bug.cgi?id=12068
> 

And it is still not there:

# curl --resolve db.us.clamav.net:80:72.21.91.8
http://db.us.clamav.net/daily-24447.cdiff

http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd";>
http://www.w3.org/1999/xhtml"; xml:lang="en" lang="en">

404 - Not Found


404 - Not Found



Nor any other db files...

Feel like I'm shouting into the void with this


Here's a little test script:

host db.us.clamav.net |
awk '/address/ { print $4 }' |
while read ip;
do echo Trying $ip;
curl --resolve db.us.clamav.net:80:$ip -w 'result=%{http_code}\n\n' -o
/dev/null http://db.us.clamav.net/daily-24447.cdiff;
done

Output:


Trying 74.115.25.14
  % Total% Received % Xferd  Average Speed   TimeTime Time  Current
 Dload  Upload   Total   SpentLeft  Speed
  0 00 00 0  0  0 --:--:--  0:02:07 --:--:--
0result=000

curl: (7) Failed connect to db.us.clamav.net:80; Connection timed out
Trying 200.236.31.1
  % Total% Received % Xferd  Average Speed   TimeTime Time  Current
 Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  37220  0 --:--:-- --:--:-- --:--:-- 37300
result=200

Trying 72.21.91.8
  % Total% Received % Xferd  Average Speed   TimeTime Time  Current
 Dload  Upload   Total   SpentLeft  Speed
100   345  100   3450 0   6873  0 --:--:-- --:--:-- --:--:--  6900
result=404

Trying 146.112.59.53
  % Total% Received % Xferd  Average Speed   TimeTime Time  Current
 Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  43418  0 --:--:-- --:--:-- --:--:-- 43494
result=200

Trying 198.148.78.4
  % Total% Received % Xferd  Average Speed   TimeTime Time  Current
 Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  91546  0 --:--:-- --:--:-- --:--:-- 91858
result=200

Trying 150.214.142.197
  % Total% Received % Xferd  Average Speed   TimeTime Time  Current
 Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  18416  0 --:--:-- --:--:-- --:--:-- 18399
result=200

Trying 204.130.133.50
  % Total% Received % Xferd  Average Speed   TimeTime Time  Current
 Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0   230k  0 --:--:-- --:--:-- --:--:--  231k
result=200

Trying 12.167.151.1
  % Total% Received % Xferd  Average Speed   TimeTime Time  Current
 Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  88046  0 --:--:-- --:--:-- --:--:-- 88553
result=200

Trying 155.98.64.87
  % Total% Received % Xferd  Average Speed   TimeTime Time  Current
 Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  67394  0 --:--:-- --:--:-- --:--:-- 67262
result=200

Trying 12.167.151.2
  % Total% Received % Xferd  Average Speed   TimeTime Time  Current
 Dload  Upload   Total   SpentLeft  Speed
100 12309  100 123090 0  85108  0 --:--:-- --:--:-- --:--:-- 85479
result=200

So looks like 74.115.25.14 is bad too.

-- 
Orion Poplawski
Manager of NWRA Technical Systems  720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane   or...@nwra.com
Boulder, CO 80301 https://www.nwra.com/
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-30 Thread Orion Poplawski 
It does not appear to be ignoring the TTL, but the TTL appears to be 60.
freshclam seems to wait for 5 seconds between attempts so the 3 attempts to
download will fall within the TTL of the DNS results.

Sample squidclient mgr:ipcache entry:

 HostnameFlg lstrefTTL  N(b)
 db.us.clamav.net 5 55  9( 0)
  72.21.91.8-OK

I think this doesn't affect freshclam normally because it sends a DNS request
for each attempt, and the nameserver appears to rotate the names for each 
request.

Just to pass it on - balance_on_multiple_ip appears not to be functional in
squid anymore: https://bugs.squid-cache.org/show_bug.cgi?id=4691 and for a
fairly good reason I suppose, but does work against freshclam.

At this point I'd like to increase the 5 second delay between download
attempts (to allow the DNS cache to expire) but that appears to be hard coded.


And still having persistent problems with 72.21.91.8 as reported here:
https://bugzilla.clamav.net/show_bug.cgi?id=12068


On 03/28/2018 05:50 PM, Dennis Peterson wrote:
> If your proxy ignores the TTL for the mirrors then quite likely things will
> grind to a halt for you. All the mirrors are in round-robin dns pools.
> 
> dp
> 
> On 3/27/18 4:32 PM, Orion Poplawski wrote:
>> On 03/27/2018 05:21 PM, Al Varnell wrote:
>>> Using the same IP each time with failure will also cause mirrors.dat to
>>> temporarily block that IP's use for some period of time. That will require
>>> you to trash mirrors.dat and allow it to be rebuilt at the next check.
>>>
>>> -Al-
>> I don't think mirrors.dat comes into play here as the proxy is doing the dns
>> lookup, not freshclam.
>>
>>> On Tue, Mar 27, 2018 at 03:40 PM, Orion Poplawski wrote:
 On 03/27/2018 03:13 PM, Orion Poplawski wrote:
> Thanks for the response.
>
> I ended up switching freshclam to use our proxy servers and increasing the
> ConnectTimeout to 60 seconds.  This has helped a bit, but I still get the
> occasional issue.  Latest was trying to get daily-24426.cdiff from
> 72.21.91.8
> around Tue Mar 27 13:31:14 2018 PDT.  These are annoying because they
> generate
> emails.
 This was exacerbated by squid continuing to use the same IP address for the
 connection each time freshclam retried the download.  I'm trying enabling
 http://www.squid-cache.org/Doc/config/balance_on_multiple_ip/
  to see if
 that
 helps.
>>>
>>>
>>>
>>> ___
>>> clamav-users mailing list
>>> clamav-users@lists.clamav.net
>>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>>>
>>>
>>> Help us build a comprehensive ClamAV guide:
>>> https://github.com/vrtadmin/clamav-faq
>>>
>>> http://www.clamav.net/contact.html#ml
>>>
>>
> 
> ___
> clamav-users mailing list
> clamav-users@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml


-- 
Orion Poplawski
Manager of NWRA Technical Systems  720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane   or...@nwra.com
Boulder, CO 80301 https://www.nwra.com/
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-29 Thread Thomas McCourt (tmccourt) 
We fixed an issue earlier in the evening yesterday with the mirrors that, I 
think, should have corrected the issue you were seeing. Is this not the case? 
Are you still seeing this ongoing ?

On 3/28/18, 11:41 PM, "clamav-users on behalf of Paul Kosinski" 
 
wrote:

True, except:

1. There was a successful download from 198.148.78.4 at 01:36 on Wed 28
   Mar, and no mirrors were ignored.
   
2. There were about 8 "everything up to date" attempts every 90 minutes
   until 16:36.

3. Everything failed starting at 16:36. It kept trying until 17:05, but
   couldn't download from any of the 6 mirrors that were listed in the
   mirrors.dat file I posted. More precisely, 198.148.78.4 worked
   at 01:36, but no longer worked at 16:36. The other 5 may already have
   been "bad" for quite a while. In particular, 150.214.142.197 failed
   Sun 25 Mar (but 155.98.64.87 worked).


On Thu, 29 Mar 2018 00:58:17 +
"Thomas McCourt (tmccourt)"  wrote:

> The 'ignoring mirror' message was due to previous errors, not current
> ones. It is just skipping them because they errored out for you and
> it's saved that in the mirror.dat file. Clear that file, and it
> potentially, could remove those messages. (unless those mirrors are
> messed up.)
> 
> 
> 
> On 3/28/18, 8:42 PM, "clamav-users on behalf of Paul Kosinski"
>  clamav-us...@iment.com> wrote:
> 
> Here is a recent freshclam log that details our local mirror --
> we try to save bandwidth! -- downloading from ClamAV servers. It
> shows lots of errors followed by success. The total elapsed time, on
> our 100+ Mb/s cable connection, is about 1 minute in spite of the
> failures. 
> 
> --  Wednesday 28 March 2018 at
> 18:06:02  -- 
> Current working dir is /opt/clamav.d/clamav.0.99.4/share/clamav
> Max retries == 4
> ClamAV update process started at Wed Mar 28 18:06:02 2018
> Using IPv6 aware code
> Querying current.cvd.clamav.net
> TTL: 1800
> Software version from DNS: 0.99.4
> main.cvd version from DNS: 58
> main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60,
> builder: sigmgr) daily.cvd version from DNS: 24429
> Retrieving http://db.us.clamav.net/daily.cvd
> Ignoring mirror 72.21.91.8 (due to previous errors)
> Ignoring mirror 204.130.133.50 (due to previous errors)
> Ignoring mirror 198.148.78.4 (due to previous errors)
> Ignoring mirror 12.167.151.1 (due to previous errors)
> Ignoring mirror 155.98.64.87 (due to previous errors)
> Ignoring mirror 74.115.25.14 (due to previous errors)
> Trying to download http://db.us.clamav.net/daily.cvd (IP:
> 12.167.151.2) Downloading daily.cvd [100%]
> Loading signatures from daily.cvd
> Properly loaded 1891690 signatures from new daily.cvd
> daily.cvd updated (version: 24429, sigs: 1891690, f-level: 63,
> builder: neo) Querying daily.24429.85.1.0.0CA79702.ping.clamav.net
> bytecode.cvd version from DNS: 319
> bytecode.cvd is up to date (version: 319, sigs: 75, f-level: 63,
> builder: neo) Database updated (6458014 signatures) from
> db.us.clamav.net (IP: 12.167.151.2) OnUpdateExecute: EXIT_1
> 
> --  Wednesday 28 March 2018 at
> 18:07:34  -- 
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml


___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-28 Thread Paul Kosinski 
True, except:

1. There was a successful download from 198.148.78.4 at 01:36 on Wed 28
   Mar, and no mirrors were ignored.
   
2. There were about 8 "everything up to date" attempts every 90 minutes
   until 16:36.

3. Everything failed starting at 16:36. It kept trying until 17:05, but
   couldn't download from any of the 6 mirrors that were listed in the
   mirrors.dat file I posted. More precisely, 198.148.78.4 worked
   at 01:36, but no longer worked at 16:36. The other 5 may already have
   been "bad" for quite a while. In particular, 150.214.142.197 failed
   Sun 25 Mar (but 155.98.64.87 worked).


On Thu, 29 Mar 2018 00:58:17 +
"Thomas McCourt (tmccourt)"  wrote:

> The 'ignoring mirror' message was due to previous errors, not current
> ones. It is just skipping them because they errored out for you and
> it's saved that in the mirror.dat file. Clear that file, and it
> potentially, could remove those messages. (unless those mirrors are
> messed up.)
> 
> 
> 
> On 3/28/18, 8:42 PM, "clamav-users on behalf of Paul Kosinski"
>  clamav-us...@iment.com> wrote:
> 
> Here is a recent freshclam log that details our local mirror --
> we try to save bandwidth! -- downloading from ClamAV servers. It
> shows lots of errors followed by success. The total elapsed time, on
> our 100+ Mb/s cable connection, is about 1 minute in spite of the
> failures. 
> 
> --  Wednesday 28 March 2018 at
> 18:06:02  -- 
> Current working dir is /opt/clamav.d/clamav.0.99.4/share/clamav
> Max retries == 4
> ClamAV update process started at Wed Mar 28 18:06:02 2018
> Using IPv6 aware code
> Querying current.cvd.clamav.net
> TTL: 1800
> Software version from DNS: 0.99.4
> main.cvd version from DNS: 58
> main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60,
> builder: sigmgr) daily.cvd version from DNS: 24429
> Retrieving http://db.us.clamav.net/daily.cvd
> Ignoring mirror 72.21.91.8 (due to previous errors)
> Ignoring mirror 204.130.133.50 (due to previous errors)
> Ignoring mirror 198.148.78.4 (due to previous errors)
> Ignoring mirror 12.167.151.1 (due to previous errors)
> Ignoring mirror 155.98.64.87 (due to previous errors)
> Ignoring mirror 74.115.25.14 (due to previous errors)
> Trying to download http://db.us.clamav.net/daily.cvd (IP:
> 12.167.151.2) Downloading daily.cvd [100%]
> Loading signatures from daily.cvd
> Properly loaded 1891690 signatures from new daily.cvd
> daily.cvd updated (version: 24429, sigs: 1891690, f-level: 63,
> builder: neo) Querying daily.24429.85.1.0.0CA79702.ping.clamav.net
> bytecode.cvd version from DNS: 319
> bytecode.cvd is up to date (version: 319, sigs: 75, f-level: 63,
> builder: neo) Database updated (6458014 signatures) from
> db.us.clamav.net (IP: 12.167.151.2) OnUpdateExecute: EXIT_1
> 
> --  Wednesday 28 March 2018 at
> 18:07:34  -- 
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-28 Thread Thomas McCourt (tmccourt) 
The 'ignoring mirror' message was due to previous errors, not current ones. It 
is just skipping them because they errored out for you and it's saved that in 
the mirror.dat file.
Clear that file, and it potentially, could remove those messages. (unless those 
mirrors are messed up.)



On 3/28/18, 8:42 PM, "clamav-users on behalf of Paul Kosinski" 
 
wrote:

Here is a recent freshclam log that details our local mirror -- we try to
save bandwidth! -- downloading from ClamAV servers. It shows lots of
errors followed by success. The total elapsed time, on our 100+ Mb/s
cable connection, is about 1 minute in spite of the failures.


--  Wednesday 28 March 2018 at 18:06:02  
--

Current working dir is /opt/clamav.d/clamav.0.99.4/share/clamav
Max retries == 4
ClamAV update process started at Wed Mar 28 18:06:02 2018
Using IPv6 aware code
Querying current.cvd.clamav.net
TTL: 1800
Software version from DNS: 0.99.4
main.cvd version from DNS: 58
main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: 
sigmgr)
daily.cvd version from DNS: 24429
Retrieving http://db.us.clamav.net/daily.cvd
Ignoring mirror 72.21.91.8 (due to previous errors)
Ignoring mirror 204.130.133.50 (due to previous errors)
Ignoring mirror 198.148.78.4 (due to previous errors)
Ignoring mirror 12.167.151.1 (due to previous errors)
Ignoring mirror 155.98.64.87 (due to previous errors)
Ignoring mirror 74.115.25.14 (due to previous errors)
Trying to download http://db.us.clamav.net/daily.cvd (IP: 12.167.151.2)
Downloading daily.cvd [100%]
Loading signatures from daily.cvd
Properly loaded 1891690 signatures from new daily.cvd
daily.cvd updated (version: 24429, sigs: 1891690, f-level: 63, builder: neo)
Querying daily.24429.85.1.0.0CA79702.ping.clamav.net
bytecode.cvd version from DNS: 319
bytecode.cvd is up to date (version: 319, sigs: 75, f-level: 63, builder: 
neo)
Database updated (6458014 signatures) from db.us.clamav.net (IP: 
12.167.151.2)
OnUpdateExecute: EXIT_1

--  Wednesday 28 March 2018 at 18:07:34  
--

___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml


___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-28 Thread Paul Kosinski 
Here is a recent freshclam log that details our local mirror -- we try to
save bandwidth! -- downloading from ClamAV servers. It shows lots of
errors followed by success. The total elapsed time, on our 100+ Mb/s
cable connection, is about 1 minute in spite of the failures.


--  Wednesday 28 March 2018 at 18:06:02  
--

Current working dir is /opt/clamav.d/clamav.0.99.4/share/clamav
Max retries == 4
ClamAV update process started at Wed Mar 28 18:06:02 2018
Using IPv6 aware code
Querying current.cvd.clamav.net
TTL: 1800
Software version from DNS: 0.99.4
main.cvd version from DNS: 58
main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: 
sigmgr)
daily.cvd version from DNS: 24429
Retrieving http://db.us.clamav.net/daily.cvd
Ignoring mirror 72.21.91.8 (due to previous errors)
Ignoring mirror 204.130.133.50 (due to previous errors)
Ignoring mirror 198.148.78.4 (due to previous errors)
Ignoring mirror 12.167.151.1 (due to previous errors)
Ignoring mirror 155.98.64.87 (due to previous errors)
Ignoring mirror 74.115.25.14 (due to previous errors)
Trying to download http://db.us.clamav.net/daily.cvd (IP: 12.167.151.2)
Downloading daily.cvd [100%]
Loading signatures from daily.cvd
Properly loaded 1891690 signatures from new daily.cvd
daily.cvd updated (version: 24429, sigs: 1891690, f-level: 63, builder: neo)
Querying daily.24429.85.1.0.0CA79702.ping.clamav.net
bytecode.cvd version from DNS: 319
bytecode.cvd is up to date (version: 319, sigs: 75, f-level: 63, builder: neo)
Database updated (6458014 signatures) from db.us.clamav.net (IP: 12.167.151.2)
OnUpdateExecute: EXIT_1

--  Wednesday 28 March 2018 at 18:07:34  
--

___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-28 Thread Alex 
Hi,

> There is no mirror status page that exists as of right now. That might change 
> in the future.
> As far as mirror issues, there was one earlier today with the daily, and that 
> has thus been corrected.

Just as I was creating the bugzilla ticket it appears to have been
resolved. All looks good now.

> As far as transfer speeds, I don’t really have a clue off hand, I would need 
> to investigate and see if any other people are experiencing these issues. 
> (So, create a ticket for it.)

I was thinking the issue was because at least my two hosts were
connecting to a single mirror because all others were failing. I was
thinking that was the issue for many others as well, connecting to
that same mirror.

Thanks,
Alex
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-28 Thread Dennis Peterson 
If your proxy ignores the TTL for the mirrors then quite likely things will 
grind to a halt for you. All the mirrors are in round-robin dns pools.


dp

On 3/27/18 4:32 PM, Orion Poplawski wrote:

On 03/27/2018 05:21 PM, Al Varnell wrote:

Using the same IP each time with failure will also cause mirrors.dat to 
temporarily block that IP's use for some period of time. That will require you 
to trash mirrors.dat and allow it to be rebuilt at the next check.

-Al-

I don't think mirrors.dat comes into play here as the proxy is doing the dns
lookup, not freshclam.


On Tue, Mar 27, 2018 at 03:40 PM, Orion Poplawski wrote:

On 03/27/2018 03:13 PM, Orion Poplawski wrote:

Thanks for the response.

I ended up switching freshclam to use our proxy servers and increasing the
ConnectTimeout to 60 seconds.  This has helped a bit, but I still get the
occasional issue.  Latest was trying to get daily-24426.cdiff from 72.21.91.8
around Tue Mar 27 13:31:14 2018 PDT.  These are annoying because they generate
emails.

This was exacerbated by squid continuing to use the same IP address for the
connection each time freshclam retried the download.  I'm trying enabling
http://www.squid-cache.org/Doc/config/balance_on_multiple_ip/ 
 to see if that
helps.




___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml





___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-28 Thread Thomas McCourt (tmccourt) 
Hey all- 

There is no mirror status page that exists as of right now. That might change 
in the future. 
As far as mirror issues, there was one earlier today with the daily, and that 
has thus been corrected.

As far as timeouts for specific mirrors, I can look into those mirrors directly 
to see what is going on if you create a Bugzilla ticket 
At https://bugzilla.clamav.net/enter_bug.cgi?product=Mirror%20Issues

As far as transfer speeds, I don’t really have a clue off hand, I would need to 
investigate and see if any other people are experiencing these issues. (So, 
create a ticket for it.)


Thank you,
 
 
Tom McCourt | Talos: Open Source Team| tmcco...@cisco.com
 
 




On 3/28/18, 7:32 PM, "clamav-users on behalf of Al Varnell" 
 wrote:

On Wed, Mar 28, 2018 at 02:34 PM, Alex wrote:
> We're still seeing timeouts and abysmal transfer speeds. I don't know
> if it's related to the OP's issue.
> 
> Retrieving http://db.us.clamav.net/safebrowsing-47190.cdiff 

> Trying to download http://db.us.clamav.net/safebrowsing-47190.cdiff 

> (IP: 150.214.142.197)
> WARNING: getfile: safebrowsing-47190.cdiff not found on
> db.us.clamav.net  (IP: 150.214.142.197)
> WARNING: getpatch: Can't download safebrowsing-47190.cdiff from 
db.us.clamav.net 
> Querying safebrowsing.47190.82.0.0.96D68EC5.ping.clamav.net 

> Retrieving http://db.us.clamav.net/safebrowsing-47190.cdiff 

> nonblock_connect: connect timing out (30 secs)
> Can't connect to port 80 of host db.us.clamav.net 
 (IP: 204.130.133.50)
> Trying host db.us.clamav.net  (200.236.31.1)...
> Trying to download http://db.us.clamav.net/safebrowsing-47190.cdiff 

> (IP: 200.236.31.1)
> WARNING: getfile: safebrowsing-47190.cdiff not found on
> db.us.clamav.net  (IP: 200.236.31.1)
> WARNING: getpatch: Can't download safebrowsing-47190.cdiff from 
db.us.clamav.net 
> Querying safebrowsing.47190.82.0.0.C8EC1F01.ping.clamav.net 

> Retrieving http://db.us.clamav.net/safebrowsing-47190.cdiff 

> Trying to download http://db.us.clamav.net/safebrowsing-47190.cdiff 

> (IP: 12.167.151.1)

I don't believe it's related. Your's appears to specifically involve a 
safebrowsing update that doesn't exist on either of those two mirrors, so 
apparently the main database updates are working OK?

> Ignoring mirror 150.214.142.197 (due to previous errors)
> Ignoring mirror 204.130.133.50 (due to previous errors)
> Ignoring mirror 155.98.64.87 (due to previous errors)
> Ignoring mirror 12.167.151.1 (due to previous errors)
> Ignoring mirror 12.167.151.2 (due to previous errors)
> Ignoring mirror 198.148.78.4 (due to previous errors)
> Ignoring mirror 72.21.91.8 (due to previous errors)
> Ignoring mirror 200.236.31.1 (due to previous errors)

Note that both the IP addresses used above are also on the Ignoring list.

This can be cured by deleting mirrors.dat, but may not solve your problem 
if that update isn't on any of them.

> nonblock_recv: recv timing out (30 secs)7%]
> 
> It just keeps looping. Two systems on completely different parts of
> the Internet both connected connected to 12.167.151.1, as all others
> were unavailable.
> 
> Is there a known current problem? Is there a site where we can go to
> check mirror status?
> 
> 
> On Tue, Mar 27, 2018 at 7:32 PM, Orion Poplawski mailto:or...@nwra.com>> wrote:
>> On 03/27/2018 05:21 PM, Al Varnell wrote:
>>> Using the same IP each time with failure will also cause mirrors.dat to 
temporarily block that IP's use for some period of time. That will require you 
to trash mirrors.dat and allow it to be rebuilt at the next check.
>>> 
>>> -Al-
>> 
>> I don't think mirrors.dat comes into play here as the proxy is doing the 
dns
>> lookup, not freshclam.
>> 
>>> 
>>> On Tue, Mar 27, 2018 at 03:40 PM, Orion Poplawski wrote:
 On 03/27/2018 03:13 PM, Orion Poplawski wrote:
> Thanks for the response.
> 
> I ended up switching freshclam to use our proxy servers and 
increasing the
> ConnectTimeout to 60 seconds.  This has helped a bit, but I still get 
the
> occasional issue.  Latest was trying to get daily-24426.cdiff from 
72.21.91.8
> around Tue Mar 27 13:31:14 2018 PDT.  These are annoying because they 
generate
> emails.

Re: [clamav-users] Errors connecting to mirrors

2018-03-28 Thread Al Varnell 
On Wed, Mar 28, 2018 at 02:34 PM, Alex wrote:
> We're still seeing timeouts and abysmal transfer speeds. I don't know
> if it's related to the OP's issue.
> 
> Retrieving http://db.us.clamav.net/safebrowsing-47190.cdiff 
> 
> Trying to download http://db.us.clamav.net/safebrowsing-47190.cdiff 
> 
> (IP: 150.214.142.197)
> WARNING: getfile: safebrowsing-47190.cdiff not found on
> db.us.clamav.net  (IP: 150.214.142.197)
> WARNING: getpatch: Can't download safebrowsing-47190.cdiff from 
> db.us.clamav.net 
> Querying safebrowsing.47190.82.0.0.96D68EC5.ping.clamav.net 
> 
> Retrieving http://db.us.clamav.net/safebrowsing-47190.cdiff 
> 
> nonblock_connect: connect timing out (30 secs)
> Can't connect to port 80 of host db.us.clamav.net  
> (IP: 204.130.133.50)
> Trying host db.us.clamav.net  (200.236.31.1)...
> Trying to download http://db.us.clamav.net/safebrowsing-47190.cdiff 
> 
> (IP: 200.236.31.1)
> WARNING: getfile: safebrowsing-47190.cdiff not found on
> db.us.clamav.net  (IP: 200.236.31.1)
> WARNING: getpatch: Can't download safebrowsing-47190.cdiff from 
> db.us.clamav.net 
> Querying safebrowsing.47190.82.0.0.C8EC1F01.ping.clamav.net 
> 
> Retrieving http://db.us.clamav.net/safebrowsing-47190.cdiff 
> 
> Trying to download http://db.us.clamav.net/safebrowsing-47190.cdiff 
> 
> (IP: 12.167.151.1)

I don't believe it's related. Your's appears to specifically involve a 
safebrowsing update that doesn't exist on either of those two mirrors, so 
apparently the main database updates are working OK?

> Ignoring mirror 150.214.142.197 (due to previous errors)
> Ignoring mirror 204.130.133.50 (due to previous errors)
> Ignoring mirror 155.98.64.87 (due to previous errors)
> Ignoring mirror 12.167.151.1 (due to previous errors)
> Ignoring mirror 12.167.151.2 (due to previous errors)
> Ignoring mirror 198.148.78.4 (due to previous errors)
> Ignoring mirror 72.21.91.8 (due to previous errors)
> Ignoring mirror 200.236.31.1 (due to previous errors)

Note that both the IP addresses used above are also on the Ignoring list.

This can be cured by deleting mirrors.dat, but may not solve your problem if 
that update isn't on any of them.

> nonblock_recv: recv timing out (30 secs)7%]
> 
> It just keeps looping. Two systems on completely different parts of
> the Internet both connected connected to 12.167.151.1, as all others
> were unavailable.
> 
> Is there a known current problem? Is there a site where we can go to
> check mirror status?
> 
> 
> On Tue, Mar 27, 2018 at 7:32 PM, Orion Poplawski  > wrote:
>> On 03/27/2018 05:21 PM, Al Varnell wrote:
>>> Using the same IP each time with failure will also cause mirrors.dat to 
>>> temporarily block that IP's use for some period of time. That will require 
>>> you to trash mirrors.dat and allow it to be rebuilt at the next check.
>>> 
>>> -Al-
>> 
>> I don't think mirrors.dat comes into play here as the proxy is doing the dns
>> lookup, not freshclam.
>> 
>>> 
>>> On Tue, Mar 27, 2018 at 03:40 PM, Orion Poplawski wrote:
 On 03/27/2018 03:13 PM, Orion Poplawski wrote:
> Thanks for the response.
> 
> I ended up switching freshclam to use our proxy servers and increasing the
> ConnectTimeout to 60 seconds.  This has helped a bit, but I still get the
> occasional issue.  Latest was trying to get daily-24426.cdiff from 
> 72.21.91.8
> around Tue Mar 27 13:31:14 2018 PDT.  These are annoying because they 
> generate
> emails.
 
 This was exacerbated by squid continuing to use the same IP address for the
 connection each time freshclam retried the download.  I'm trying enabling
 http://www.squid-cache.org/Doc/config/balance_on_multiple_ip/ 
  
 > to see if 
 that
 helps.
>>> 
>>> 
>>> 
>>> 
>>> ___
>>> clamav-users mailing list
>>> clamav-users@lists.clamav.net 
>>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>>> 
>>> 
>>> Help us build a comprehensive ClamAV guide:
>>> https://github.com/vrtadmin/clamav-faq
>>> 
>>> http://www.clamav.net/contact.html#ml
>>> 
>> 
>> 
>> --
>> Orion Poplawski
>> Manager of NWRA Technical Systems  720-772-5637
>> NWRA, Boulder/CoRA Office

Re: [clamav-users] Errors connecting to mirrors

2018-03-28 Thread Eric Tykwinski 
Joel,

I had the same issue at 4:45PM EST, so pasted my logs to the Bugzilla site.
If there’s any more information/help you guys need, please announce on the list.

Sincerely,

Eric Tykwinski
TrueNet, Inc.
P: 610-429-8300

> On Mar 28, 2018, at 6:41 PM, Joel Esler (jesler)  wrote:
> 
> Inline’
> 
> Sent from my iPad
> 
>> On Mar 28, 2018, at 5:34 PM, Alex  wrote:
>> 
>> Is there a known current problem?
> 
> Not that I am aware of. Please file a mirror error ticket at 
> bugzilla.clamav.net and I’ll get someone to investigate it?
> 
>> Is there a site where we can go to
>> check mirror status?
> 
> Not yet, we are working on that, as we speak. 
> ___
> clamav-users mailing list
> clamav-users@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml

___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-28 Thread Joel Esler (jesler) 
Inline’

Sent from my iPad

> On Mar 28, 2018, at 5:34 PM, Alex  wrote:
> 
> Is there a known current problem?

Not that I am aware of. Please file a mirror error ticket at 
bugzilla.clamav.net and I’ll get someone to investigate it?

> Is there a site where we can go to
> check mirror status?

Not yet, we are working on that, as we speak. 
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-28 Thread Alex 
We're still seeing timeouts and abysmal transfer speeds. I don't know
if it's related to the OP's issue.

Retrieving http://db.us.clamav.net/safebrowsing-47190.cdiff
Trying to download http://db.us.clamav.net/safebrowsing-47190.cdiff
(IP: 150.214.142.197)
WARNING: getfile: safebrowsing-47190.cdiff not found on
db.us.clamav.net (IP: 150.214.142.197)
WARNING: getpatch: Can't download safebrowsing-47190.cdiff from db.us.clamav.net
Querying safebrowsing.47190.82.0.0.96D68EC5.ping.clamav.net
Retrieving http://db.us.clamav.net/safebrowsing-47190.cdiff
nonblock_connect: connect timing out (30 secs)
Can't connect to port 80 of host db.us.clamav.net (IP: 204.130.133.50)
Trying host db.us.clamav.net (200.236.31.1)...
Trying to download http://db.us.clamav.net/safebrowsing-47190.cdiff
(IP: 200.236.31.1)
WARNING: getfile: safebrowsing-47190.cdiff not found on
db.us.clamav.net (IP: 200.236.31.1)
WARNING: getpatch: Can't download safebrowsing-47190.cdiff from db.us.clamav.net
Querying safebrowsing.47190.82.0.0.C8EC1F01.ping.clamav.net
Retrieving http://db.us.clamav.net/safebrowsing-47190.cdiff
Trying to download http://db.us.clamav.net/safebrowsing-47190.cdiff
(IP: 12.167.151.1)

Ignoring mirror 150.214.142.197 (due to previous errors)
Ignoring mirror 204.130.133.50 (due to previous errors)
Ignoring mirror 155.98.64.87 (due to previous errors)
Ignoring mirror 12.167.151.1 (due to previous errors)
Ignoring mirror 12.167.151.2 (due to previous errors)
Ignoring mirror 198.148.78.4 (due to previous errors)
Ignoring mirror 72.21.91.8 (due to previous errors)
Ignoring mirror 200.236.31.1 (due to previous errors)

nonblock_recv: recv timing out (30 secs)7%]

It just keeps looping. Two systems on completely different parts of
the Internet both connected connected to 12.167.151.1, as all others
were unavailable.

Is there a known current problem? Is there a site where we can go to
check mirror status?


On Tue, Mar 27, 2018 at 7:32 PM, Orion Poplawski  wrote:
> On 03/27/2018 05:21 PM, Al Varnell wrote:
>> Using the same IP each time with failure will also cause mirrors.dat to 
>> temporarily block that IP's use for some period of time. That will require 
>> you to trash mirrors.dat and allow it to be rebuilt at the next check.
>>
>> -Al-
>
> I don't think mirrors.dat comes into play here as the proxy is doing the dns
> lookup, not freshclam.
>
>>
>> On Tue, Mar 27, 2018 at 03:40 PM, Orion Poplawski wrote:
>>> On 03/27/2018 03:13 PM, Orion Poplawski wrote:
 Thanks for the response.

 I ended up switching freshclam to use our proxy servers and increasing the
 ConnectTimeout to 60 seconds.  This has helped a bit, but I still get the
 occasional issue.  Latest was trying to get daily-24426.cdiff from 
 72.21.91.8
 around Tue Mar 27 13:31:14 2018 PDT.  These are annoying because they 
 generate
 emails.
>>>
>>> This was exacerbated by squid continuing to use the same IP address for the
>>> connection each time freshclam retried the download.  I'm trying enabling
>>> http://www.squid-cache.org/Doc/config/balance_on_multiple_ip/ 
>>>  to see if 
>>> that
>>> helps.
>>
>>
>>
>>
>> ___
>> clamav-users mailing list
>> clamav-users@lists.clamav.net
>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>>
>>
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>>
>> http://www.clamav.net/contact.html#ml
>>
>
>
> --
> Orion Poplawski
> Manager of NWRA Technical Systems  720-772-5637
> NWRA, Boulder/CoRA Office FAX: 303-415-9702
> 3380 Mitchell Lane   or...@nwra.com
> Boulder, CO 80301 https://www.nwra.com/
> ___
> clamav-users mailing list
> clamav-users@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-27 Thread Orion Poplawski 
On 03/27/2018 05:21 PM, Al Varnell wrote:
> Using the same IP each time with failure will also cause mirrors.dat to 
> temporarily block that IP's use for some period of time. That will require 
> you to trash mirrors.dat and allow it to be rebuilt at the next check.
> 
> -Al-

I don't think mirrors.dat comes into play here as the proxy is doing the dns
lookup, not freshclam.

> 
> On Tue, Mar 27, 2018 at 03:40 PM, Orion Poplawski wrote:
>> On 03/27/2018 03:13 PM, Orion Poplawski wrote:
>>> Thanks for the response.
>>>
>>> I ended up switching freshclam to use our proxy servers and increasing the
>>> ConnectTimeout to 60 seconds.  This has helped a bit, but I still get the
>>> occasional issue.  Latest was trying to get daily-24426.cdiff from 
>>> 72.21.91.8
>>> around Tue Mar 27 13:31:14 2018 PDT.  These are annoying because they 
>>> generate
>>> emails.
>>
>> This was exacerbated by squid continuing to use the same IP address for the
>> connection each time freshclam retried the download.  I'm trying enabling
>> http://www.squid-cache.org/Doc/config/balance_on_multiple_ip/ 
>>  to see if 
>> that
>> helps.
> 
> 
> 
> 
> ___
> clamav-users mailing list
> clamav-users@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml
> 


-- 
Orion Poplawski
Manager of NWRA Technical Systems  720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane   or...@nwra.com
Boulder, CO 80301 https://www.nwra.com/
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-27 Thread Al Varnell 
Using the same IP each time with failure will also cause mirrors.dat to 
temporarily block that IP's use for some period of time. That will require you 
to trash mirrors.dat and allow it to be rebuilt at the next check.

-Al-

On Tue, Mar 27, 2018 at 03:40 PM, Orion Poplawski wrote:
> On 03/27/2018 03:13 PM, Orion Poplawski wrote:
>> Thanks for the response.
>> 
>> I ended up switching freshclam to use our proxy servers and increasing the
>> ConnectTimeout to 60 seconds.  This has helped a bit, but I still get the
>> occasional issue.  Latest was trying to get daily-24426.cdiff from 72.21.91.8
>> around Tue Mar 27 13:31:14 2018 PDT.  These are annoying because they 
>> generate
>> emails.
> 
> This was exacerbated by squid continuing to use the same IP address for the
> connection each time freshclam retried the download.  I'm trying enabling
> http://www.squid-cache.org/Doc/config/balance_on_multiple_ip/ 
>  to see if that
> helps.




smime.p7s
Description: S/MIME cryptographic signature
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-27 Thread Orion Poplawski 
On 03/27/2018 03:13 PM, Orion Poplawski wrote:
> Thanks for the response.
> 
> I ended up switching freshclam to use our proxy servers and increasing the
> ConnectTimeout to 60 seconds.  This has helped a bit, but I still get the
> occasional issue.  Latest was trying to get daily-24426.cdiff from 72.21.91.8
> around Tue Mar 27 13:31:14 2018 PDT.  These are annoying because they generate
> emails.

This was exacerbated by squid continuing to use the same IP address for the
connection each time freshclam retried the download.  I'm trying enabling
http://www.squid-cache.org/Doc/config/balance_on_multiple_ip/ to see if that
helps.

-- 
Orion Poplawski
Manager of NWRA Technical Systems  720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane   or...@nwra.com
Boulder, CO 80301 https://www.nwra.com/
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-27 Thread Orion Poplawski 
Thanks for the response.

I ended up switching freshclam to use our proxy servers and increasing the
ConnectTimeout to 60 seconds.  This has helped a bit, but I still get the
occasional issue.  Latest was trying to get daily-24426.cdiff from 72.21.91.8
around Tue Mar 27 13:31:14 2018 PDT.  These are annoying because they generate
emails.

Some other failures:

ClamAV update process started at Tue Mar 27 08:27:30 2018 PDT
nonblock_connect: connect timing out (60 secs)
Can't connect to port 80 of host db.us.clamav.net (IP: 74.115.25.14)
WARNING: getfile: daily-24425.cdiff not found on db.us.clamav.net (IP: 
72.21.91.8)

ClamAV update process started at Mon Mar 26 23:27:29 2018 PDT
nonblock_connect: connect timing out (60 secs)
Can't connect to port 80 of host db.us.clamav.net (IP: 74.115.25.14)

So 72.21.91.8 and 74.115.25.14 seem to come up a bit.

Filed https://bugzilla.clamav.net/show_bug.cgi?id=12068

On 03/23/2018 10:23 AM, Thomas McCourt (tmccourt) wrote:
> If you are seeing mirror errors, enter a Bugzilla ticket.
> Please provide the mirror that is causing an issue, so I can investigate it.
> If it is your mirror that is having an issue, provide more information or 
> also create a ticket and specifically state it is a mirror YOU maintain and 
> what seems to be the issue-
> 
> 
> Thank you,
> 
>  
>  
> Tom McCourt | Talos: Open Source Team| tmcco...@cisco.com
>  
>  
> 
> 
> On 3/23/18, 11:47 AM, "clamav-users on behalf of Orion Poplawski" 
>  wrote:
> 
> It seems like in the last month or so I'm seeing more timeouts connecting 
> to
> the clamav DB mirrors.  Is anyone else seeing this?  I have a bit of a 
> strange
> mirror setup so it might just be my configuration.
> 
> Thanks.
> 
> -- 
> Orion Poplawski
> Manager of NWRA Technical Systems  720-772-5637
> NWRA, Boulder/CoRA Office FAX: 303-415-9702
> 3380 Mitchell Lane   or...@nwra.com
> Boulder, CO 80301 https://www.nwra.com/
> ___
> clamav-users mailing list
> clamav-users@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml
> 
> 
> ___
> clamav-users mailing list
> clamav-users@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml
> 


-- 
Orion Poplawski
Manager of NWRA Technical Systems  720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane   or...@nwra.com
Boulder, CO 80301 https://www.nwra.com/
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-23 Thread Joel Esler (jesler) 
Please file errors here:

https://bugzilla.clamav.net/enter_bug.cgi?product=Mirror%20Issues

With Mirrors?

Thanks.

--
Joel Esler
Manager
Open Source, Design, Web, and Education
Talos Group
http://www.talosintelligence.com


On Mar 23, 2018, at 1:41 PM, G.W. Haywood 
mailto:cla...@jubileegroup.co.uk>> wrote:

Hi there,

On Fri, 23 Mar 2018, Orion Poplawski wrote:

It seems like in the last month or so I'm seeing more timeouts connecting to
the clamav DB mirrors.  Is anyone else seeing this?  I have a bit of a strange
mirror setup so it might just be my configuration.

Yes, I'm seeing some in the UK recently, but more like the last week
than the last month.  This is the last two months' logs:

/var/log/clamav# >>> grep connect freshclam.log.1 freshclam.log
freshclam.log:Fri Mar 16 19:44:27 2018 -> nonblock_connect: connect timing out 
(30 secs)
freshclam.log:Fri Mar 16 19:44:27 2018 -> Can't connect to port 80 of host 
db.uk.clamav.net (IP: 178.79.177.182)
freshclam.log:Sun Mar 18 21:45:24 2018 -> nonblock_connect: connect timing out 
(30 secs)
freshclam.log:Sun Mar 18 21:45:24 2018 -> Can't connect to port 80 of host 
db.uk.clamav.net (IP: 178.79.177.182)
freshclam.log:Wed Mar 21 04:48:02 2018 -> nonblock_connect: connect timing out 
(30 secs)
freshclam.log:Wed Mar 21 04:48:02 2018 -> Can't connect to port 80 of host 
db.uk.clamav.net (IP: 178.79.177.182)
freshclam.log:Wed Mar 21 12:51:05 2018 -> nonblock_connect: connect timing out 
(30 secs)
freshclam.log:Wed Mar 21 12:51:05 2018 -> Can't connect to port 80 of host 
db.uk.clamav.net (IP: 178.79.177.182)
freshclam.log:Wed Mar 21 22:52:13 2018 -> nonblock_connect: connect timing out 
(30 secs)
freshclam.log:Wed Mar 21 22:52:13 2018 -> Can't connect to port 80 of host 
db.uk.clamav.net (IP: 178.79.177.182)
freshclam.log:Thu Mar 22 04:52:53 2018 -> nonblock_connect: connect timing out 
(30 secs)
freshclam.log:Thu Mar 22 04:52:53 2018 -> Can't connect to port 80 of host 
db.uk.clamav.net (IP: 178.79.177.182)

I haven't investigated carefully, but I've no reason to believe that
the problem is within our network.  We run Smokeping continuously, and
there's no sign of anything in the graphs of packet loss and RTTs to
off-site servers which could explain something like this.

--

73,
Ged.
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-23 Thread G.W. Haywood 

Hi there,

On Fri, 23 Mar 2018, Orion Poplawski wrote:


It seems like in the last month or so I'm seeing more timeouts connecting to
the clamav DB mirrors.  Is anyone else seeing this?  I have a bit of a strange
mirror setup so it might just be my configuration.


Yes, I'm seeing some in the UK recently, but more like the last week
than the last month.  This is the last two months' logs:

/var/log/clamav# >>> grep connect freshclam.log.1 freshclam.log
freshclam.log:Fri Mar 16 19:44:27 2018 -> nonblock_connect: connect timing out 
(30 secs)
freshclam.log:Fri Mar 16 19:44:27 2018 -> Can't connect to port 80 of host 
db.uk.clamav.net (IP: 178.79.177.182)
freshclam.log:Sun Mar 18 21:45:24 2018 -> nonblock_connect: connect timing out 
(30 secs)
freshclam.log:Sun Mar 18 21:45:24 2018 -> Can't connect to port 80 of host 
db.uk.clamav.net (IP: 178.79.177.182)
freshclam.log:Wed Mar 21 04:48:02 2018 -> nonblock_connect: connect timing out 
(30 secs)
freshclam.log:Wed Mar 21 04:48:02 2018 -> Can't connect to port 80 of host 
db.uk.clamav.net (IP: 178.79.177.182)
freshclam.log:Wed Mar 21 12:51:05 2018 -> nonblock_connect: connect timing out 
(30 secs)
freshclam.log:Wed Mar 21 12:51:05 2018 -> Can't connect to port 80 of host 
db.uk.clamav.net (IP: 178.79.177.182)
freshclam.log:Wed Mar 21 22:52:13 2018 -> nonblock_connect: connect timing out 
(30 secs)
freshclam.log:Wed Mar 21 22:52:13 2018 -> Can't connect to port 80 of host 
db.uk.clamav.net (IP: 178.79.177.182)
freshclam.log:Thu Mar 22 04:52:53 2018 -> nonblock_connect: connect timing out 
(30 secs)
freshclam.log:Thu Mar 22 04:52:53 2018 -> Can't connect to port 80 of host 
db.uk.clamav.net (IP: 178.79.177.182)

I haven't investigated carefully, but I've no reason to believe that
the problem is within our network.  We run Smokeping continuously, and
there's no sign of anything in the graphs of packet loss and RTTs to
off-site servers which could explain something like this.

--

73,
Ged.
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Errors connecting to mirrors

2018-03-23 Thread Thomas McCourt (tmccourt) 
If you are seeing mirror errors, enter a Bugzilla ticket.
Please provide the mirror that is causing an issue, so I can investigate it.
If it is your mirror that is having an issue, provide more information or also 
create a ticket and specifically state it is a mirror YOU maintain and what 
seems to be the issue-


Thank you,

 
 
Tom McCourt | Talos: Open Source Team| tmcco...@cisco.com
 
 


On 3/23/18, 11:47 AM, "clamav-users on behalf of Orion Poplawski" 
 wrote:

It seems like in the last month or so I'm seeing more timeouts connecting to
the clamav DB mirrors.  Is anyone else seeing this?  I have a bit of a 
strange
mirror setup so it might just be my configuration.

Thanks.

-- 
Orion Poplawski
Manager of NWRA Technical Systems  720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane   or...@nwra.com
Boulder, CO 80301 https://www.nwra.com/
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml


___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml