4.62.9-1 & MailScanner --lint [FIXED - but why?]

[Rick Cooper]

 > -----Original Message-----
 > From: mailscanner-bounces at lists.mailscanner.info 
 > [mailto:mailscanner-bounces at lists.mailscanner.info] On 
 > Behalf Of Quentin Campbell
 > Sent: Thursday, August 02, 2007 3:38 AM
 > To: MailScanner discussion
 > Subject: RE: 4.62.9-1 & MailScanner --lint [FIXED - but why?]
 > 
 > Phil
 > 
 > Thanks for the reply.
 > 
 > Where are your 'main.cvd' and 'daily.cvd' files kept?
 > 
 > A little more research and digging found the problem but I 
 > am unclear as
 > to how the situation came about. There is now a new 
 > maintenance problem
 > to be resolved and some worrying questions.
 > 
 > The " LibClamAV Warning: ***  The virus database is older 
 > than 7 days.
 > ***" message arises because there was a second location 
 > containing very
 > old (July 26, 2005) copies of main.cvd and daily.cvd under
 > /usr/local/share/clamav. In my current installation I keep the '.cvd'
 > files under /usr/local/clamav.
 > 
 > If I remove the 'clamav' sub-directory from /usr/local/share 
 > or remove
 > the two files from under it then 'MailScanner --lint' complains. If I
 > copy my current two '.cvd' files from /usr/local/clamav to
 > /usr/local/share/clamav then MailScanner --lint works OK.
 > 
 > QUESTIONS:
 > 
 > 1. When was the /usr/local/share/clamv sub-directory created and why?
 > 2. Why is a /usr/local/share/clamav needed when my
 > /usr/local/etc/freshclam.conf file specifies /usr/local/clamav as the
 > '.cvd' files location?   
 > 3. Has 'clamavmodule' been using these very old '.cvd' files 
 > for virus
 > detection?
 > 4. There is the maintenance issue - how do I keep the
 > /usr/local/share/clamav/*.cvd files up to date? ANSWER: I 
 > suppose when
 > using 'clamavmodule' I should change 
 > /usr/local/etc/freshclam.conf and
 > replace
 > 
 >   DatabaseDirectory /usr/local/clamav
 > 
 > with
 > 
 >  DatabaseDirectory /usr/local/share/clamav
 > 
 > Alternately I can make /usr/local/share/clamav a link to
 > /usr/local/clamav (or vice versa). What is best?
 > 
 > Had I missed and important documented step when I swapped from using
 > 'clamscan' to using 'clamavmodule'? If so I cannot find it!
 > 

This is more common than you might think. The most common complaint
resulting from this (on the clamav list) is not catching viruses through
(MailScanner|AMAVIS|Other) scanners, but from the command line the scanner
works fine.

The most common cause is installing clamav with two differing methods, RPM
then source or visa versa which would generally result in two different
--prefix designations. The best thing you could do is uninstall both
installations and reinstall, and always install with the same method. Make
sure and locate both sets of binaries and libraries (example: locate
libclamav.so && locate bin/clamscan). I would reinstall ClamAVModule after
you have done that.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.