Virtualman Freshclam Issue

MartinT · June 15, 2011, 8:19am

Hi everyone,

I’ve recently been getting the following error:

"/etc/cron.daily/freshclam:

ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).
ERROR: Can’t open /var/log/clamav/freshclam.log in append mode (check permissions!)."

I have edited /etc/cron.daily/freshclam and tried changing the permissions of the line:

…
chmod 644 “$LOG_FILE”
…

to 664 and 666 but still get the error when running the cron job.

I also get the same error when running freshclam. After changing the permissions on /var/log/freshclam.log to 666 and then running freshclam and it updates ok.

Any ideas?

Thanks,

martin

Eric · June 15, 2011, 1:36pm

Howdy,

Which distribution/version are you using?

And what output do you receive if you run this command:

ls -l /var/log/clamav/freshclam.log

MartinT · June 16, 2011, 9:04am

Hi,

I’m running Virtualmin 3.86.gpl on CentOS 5.6.

uname -r 2.6.18-238.12.1.el5.028stab091.1

freshclam -V ClamAV 0.97/13198/Thu Jun 16 03:31:04 2011

The output as requested is:

ls -l /var/log/clamav/freshclam.log -rwxrwxr-x 1 root wheel 0 Sep 30 2010 /var/log/clamav/freshclam.log

Eric · June 16, 2011, 1:48pm

Okay, I believe on CentOS, that file should be owned by the “clamav” group, rather than “wheel”.

You can set that by running this command:

chgrp clamav /var/log/clamav/freshclam.log

MartinT · June 16, 2011, 2:18pm

That seems to have fixed the problem - many thanks.

I also have an error that keeps appearing in procmail.log:

“WARNING: System limit for file size is lower than engine->maxscansize”

Have you any idea how to fix this?

Thanks again.

Eric · June 16, 2011, 2:33pm

“WARNING: System limit for file size is lower than engine->maxscansize”

Well, that’s just a warning… I’m not sure that I’d be too concerned about it.

It says that your filesystem allows a particular file size to be written, but that ClamAV is able to scan files larger than that.

But if you’d like to look into it, you may want to check your ulimit settings (/etc/security/limits.conf) for any limits that apply to file size. You could also edit your clamav.conf file in /etc, and set “MaxScanSize” to a lower number.

-Eric