ClamAV: poruka "WARNING: getpatch: Can't download daily-16682.cdiff"

Nekim korisnicima našeg helpdeska za sistemce antivirusni program ClamAV ponovo počinje raditi "probleme". Ovi problemi ne sprječavaju rad antivirusa, no sprječavaju osvježavanje antivirusnih definicija. Ova činjenica s vremenom bi omogućila da pojedini virusi prođu nezamijećeni kroz cijeli antivirusni sustav, pa je potrebno posvetiti pažnju da se to ne dogodi. Poruke koje ste mogli primjetiti su bile:

LibClamAV Warning: ***The virus database is older than 7 days!***
LibClamAV Warning: ***Please update it as soon as possible.***

Ručnim pokretanjem programa za osvježavanje antivurnish definicija htjeli smo vidjeti zašto se antivirusne definicije ne skidaju, je li problem u mreži, mirrorima ili nečem drugom. Rezultat koji smo dobili:

# freshclam -v
Current working dir is /var/lib/clamav
Max retries == 5
ClamAV update process started at Wed Apr  3 14:25:46 2013
Using IPv6 aware code
Querying current.cvd.clamav.net
TTL: 712
Software version from DNS: 0.97.7
main.cvd version from DNS: 54
main.cld is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven)
daily.cvd version from DNS: 16950
Retrieving http://db.local.clamav.net/daily-16682.cdiff
Ignoring mirror 193.92.150.194 (has connected too many times with an outdated version)
Ignoring mirror 195.222.33.229 (has connected too many times with an outdated version)
Ignoring mirror 193.92.150.194 (has connected too many times with an outdated version)
Ignoring mirror 195.222.33.229 (has connected too many times with an outdated version)
WARNING: getpatch: Can't download daily-16682.cdiff from db.local.clamav.net
...
Whitelisting short-term blacklisted mirrors
Retrieving http://db.local.clamav.net/daily.cvd
Ignoring mirror 193.92.150.194 (has connected too many times with an outdated version)
Ignoring mirror 195.222.33.229 (has connected too many times with an outdated version)
Ignoring mirror 193.92.150.194 (has connected too many times with an outdated version)
Ignoring mirror 195.222.33.229 (has connected too many times with an outdated version)
WARNING: Can't download daily.cvd from db.local.clamav.net
Trying again in 5 secs...

Čini se da mirrori imaju zastarjele inačice definicija, ili je možda greška ipak do nas? Najbrže je do informacija doći na izvoru, pa smo našli korisne informacije na adresi http://blog.clamav.net. Čini se da su zbog izdavanja nove inačice ClamAV-a (0.97.7) i priprema za 0.98 napravili pogrešan korak, kojim su onemogućili osvježavanje na uobičajen način. Rješenje je jednostavno, treba obrisati datoteke daily.cvd i mirrors.dat u direktoriju /var/lib/clamav. Mi smo imali uspjeha i s brisanjem samo datoteke daily.cvd:

# rm /var/lib/clamav/daily.cvd
# freshclam -v
Current working dir is /var/lib/clamav
Max retries == 5
ClamAV update process started at Wed Apr  3 14:25:58 2013
Using IPv6 aware code
Querying current.cvd.clamav.net
TTL: 700
Software version from DNS: 0.97.7
main.cvd version from DNS: 54
main.cld is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven)
Retrieving http://db.local.clamav.net/daily.cvd
Trying to download http://db.local.clamav.net/daily.cvd (IP: 195.222.33.229)
Downloading daily.cvd [100%]
Loading signatures from daily.cvd
Properly loaded 1039355 signatures from new daily.cvd
daily.cvd updated (version: 16950, sigs: 1039355, f-level: 63, builder: neo)
Querying daily.16950.68.1.0.195.222.33.229.ping.clamav.net
bytecode.cvd version from DNS: 214
bytecode.cld is up to date (version: 214, sigs: 41, f-level: 63, builder: neo)
Database updated (2083783 signatures) from db.local.clamav.net (IP: 195.222.33.229)

Osvježavanje je, dakle, proradilo bez dodatnih intervencija. Ukoliko kod vas ovaj recept "ne upali", probajte obrisati i mirrors.dat.