[clamav-users] Problem with BE db

[Pierre Dehaen]

Hi,

It seems the db.be.clamav.net does not work any more since Nov 9th. I tried to delete the
mirrors.dat but no way, I still get:

# freshclam --update-db=daily --stdout
...
daily.cvd version from DNS: 25111
Retrieving http://db.be.clamav.net/daily-25104.cdiff
Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.187.138)
WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.187.138)
WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
Querying daily.25104.91.0.0.6810BB8A.ping.clamav.net
Retrieving http://db.be.clamav.net/daily-25104.cdiff
Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.185.138)
WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.185.138)
WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
Querying daily.25104.91.0.0.6810B98A.ping.clamav.net
...

# wget http://db.be.clamav.net/daily.cvd
converted 'http://db.be.clamav.net/daily.cvd' (646) -> 'http://db.be.clamav.net/daily.cvd' (UTF-
8)
--2018-11-11 17:03:08-- http://db.be.clamav.net/daily.cvd
Resolving db.be.clamav.net (db.be.clamav.net)... 104.16.188.138, 104.16.189.138,
104.16.187.138, ...
Connecting to db.be.clamav.net (db.be.clamav.net)|104.16.188.138|:80... connected.
HTTP request sent, awaiting response... 530
2018-11-11 17:03:08 ERROR 530: (no description).

The (temporary?) solution is to:

# vi .../freshclam.conf
=> replace db.be.clamav.net by db.de.clamav.net (for instance)

# rm ...clamav/db/mirrors.dat

# freshclam --update-db=daily --stdout
ClamAV update process started at Sun Nov 11 17:04:02 2018
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.100.0 Recommended version: 0.100.2
DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
Downloading daily-25104.cdiff [100%]
Downloading daily-25105.cdiff [100%]
Downloading daily-25106.cdiff [100%]
Downloading daily-25107.cdiff [100%]
Downloading daily-25108.cdiff [100%]
Downloading daily-25109.cdiff [100%]
Downloading daily-25110.cdiff [100%]
Downloading daily-25111.cdiff [100%]
daily.cld updated (version: 25111, sigs: 2148413, f-level: 63, builder: neo)
Database updated (2148413 signatures) from db.de.clamav.net (IP: 104.16.187.138)
Clamd successfully notified about the update.

Thanks
Pierre
_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Joel Esler (jesler)]

Okay, so a couple things.

Wget probably isn't going to work in the manner you expect. Which is why you got the 530 response.

What version of freshclam are you using?

> On Nov 11, 2018, at 11:18 AM, Pierre Dehaen <***@drever.be> wrote:
>
> Hi,
>
> It seems the db.be.clamav.net does not work any more since Nov 9th. I tried to delete the
> mirrors.dat but no way, I still get:
>
> # freshclam --update-db=daily --stdout
> ...
> daily.cvd version from DNS: 25111
> Retrieving http://db.be.clamav.net/daily-25104.cdiff
> Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.187.138)
> WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.187.138)
> WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
> Querying daily.25104.91.0.0.6810BB8A.ping.clamav.net
> Retrieving http://db.be.clamav.net/daily-25104.cdiff
> Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.185.138)
> WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.185.138)
> WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
> Querying daily.25104.91.0.0.6810B98A.ping.clamav.net
> ...
>
> # wget http://db.be.clamav.net/daily.cvd
> converted 'http://db.be.clamav.net/daily.cvd' (646) -> 'http://db.be.clamav.net/daily.cvd' (UTF-
> 8)
> --2018-11-11 17:03:08-- http://db.be.clamav.net/daily.cvd
> Resolving db.be.clamav.net (db.be.clamav.net)... 104.16.188.138, 104.16.189.138,
> 104.16.187.138, ...
> Connecting to db.be.clamav.net (db.be.clamav.net)|104.16.188.138|:80... connected.
> HTTP request sent, awaiting response... 530
> 2018-11-11 17:03:08 ERROR 530: (no description).
>
> The (temporary?) solution is to:
>
> # vi .../freshclam.conf
> => replace db.be.clamav.net by db.de.clamav.net (for instance)
>
> # rm ...clamav/db/mirrors.dat
>
> # freshclam --update-db=daily --stdout
> ClamAV update process started at Sun Nov 11 17:04:02 2018
> WARNING: Your ClamAV installation is OUTDATED!
> WARNING: Local version: 0.100.0 Recommended version: 0.100.2
> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
> Downloading daily-25104.cdiff [100%]
> Downloading daily-25105.cdiff [100%]
> Downloading daily-25106.cdiff [100%]
> Downloading daily-25107.cdiff [100%]
> Downloading daily-25108.cdiff [100%]
> Downloading daily-25109.cdiff [100%]
> Downloading daily-25110.cdiff [100%]
> Downloading daily-25111.cdiff [100%]
> daily.cld updated (version: 25111, sigs: 2148413, f-level: 63, builder: neo)
> Database updated (2148413 signatures) from db.de.clamav.net (IP: 104.16.187.138)
> Clamd successfully notified about the update.
>
> Thanks
> Pierre
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Pierre Dehaen]

Hi Joel,

# freshclam --version
ClamAV 0.100.0/25114/Mon Nov 12 15:08:04 2018

It's running on Solaris 11... I see now that 0.100.2 is available on opencsw, I'll try to upgrade
soon.

Thanks,
Pierre

On 12 Nov 2018 at 16:41, Joel Esler (jesler) wrote:

Okay, so a couple things.

Wget probably isn't going to work in the manner you expect. Which is why you got the 530
response.

What version of freshclam are you using?

> On Nov 11, 2018, at 11:18 AM, Pierre Dehaen <***@drever.be> wrote:
>
> Hi,
>
> It seems the db.be.clamav.net does not work any more since Nov 9th. I tried to delete the
> mirrors.dat but no way, I still get:
>
> # freshclam --update-db=daily --stdout
> ...
> daily.cvd version from DNS: 25111
> Retrieving http://db.be.clamav.net/daily-25104.cdiff
> Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.187.138)
> WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.187.138)
> WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
> Querying daily.25104.91.0.0.6810BB8A.ping.clamav.net
> Retrieving http://db.be.clamav.net/daily-25104.cdiff
> Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.185.138)
> WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.185.138)
> WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
> Querying daily.25104.91.0.0.6810B98A.ping.clamav.net
> ...
>
> # wget http://db.be.clamav.net/daily.cvd
> converted 'http://db.be.clamav.net/daily.cvd' (646) -> 'http://db.be.clamav.net/daily.cvd' (UTF-
> 8)
> --2018-11-11 17:03:08-- http://db.be.clamav.net/daily.cvd
> Resolving db.be.clamav.net (db.be.clamav.net)... 104.16.188.138, 104.16.189.138,
> 104.16.187.138, ...
> Connecting to db.be.clamav.net (db.be.clamav.net)|104.16.188.138|:80... connected.
> HTTP request sent, awaiting response... 530
> 2018-11-11 17:03:08 ERROR 530: (no description).
>
> The (temporary?) solution is to:
>
> # vi .../freshclam.conf
> => replace db.be.clamav.net by db.de.clamav.net (for instance)
>
> # rm ...clamav/db/mirrors.dat
>
> # freshclam --update-db=daily --stdout
> ClamAV update process started at Sun Nov 11 17:04:02 2018
> WARNING: Your ClamAV installation is OUTDATED!
> WARNING: Local version: 0.100.0 Recommended version: 0.100.2
> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
> Downloading daily-25104.cdiff [100%]
> Downloading daily-25105.cdiff [100%]
> Downloading daily-25106.cdiff [100%]
> Downloading daily-25107.cdiff [100%]
> Downloading daily-25108.cdiff [100%]
> Downloading daily-25109.cdiff [100%]
> Downloading daily-25110.cdiff [100%]
> Downloading daily-25111.cdiff [100%]
> daily.cld updated (version: 25111, sigs: 2148413, f-level: 63, builder: neo)
> Database updated (2148413 signatures) from db.de.clamav.net (IP: 104.16.187.138)
> Clamd successfully notified about the update.
>
> Thanks
> Pierre
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Joel Esler (jesler)]

Can you try now?

> On Nov 12, 2018, at 12:31 PM, Pierre Dehaen <***@drever.be> wrote:
>
> Hi Joel,
>
> # freshclam --version
> ClamAV 0.100.0/25114/Mon Nov 12 15:08:04 2018
>
> It's running on Solaris 11... I see now that 0.100.2 is available on opencsw, I'll try to upgrade
> soon.
>
> Thanks,
> Pierre
>
> On 12 Nov 2018 at 16:41, Joel Esler (jesler) wrote:
>
> Okay, so a couple things.
>
> Wget probably isn't going to work in the manner you expect. Which is why you got the 530
> response.
>
> What version of freshclam are you using?
>
>> On Nov 11, 2018, at 11:18 AM, Pierre Dehaen <***@drever.be> wrote:
>>
>> Hi,
>>
>> It seems the db.be.clamav.net does not work any more since Nov 9th. I tried to delete the
>> mirrors.dat but no way, I still get:
>>
>> # freshclam --update-db=daily --stdout
>> ...
>> daily.cvd version from DNS: 25111
>> Retrieving http://db.be.clamav.net/daily-25104.cdiff
>> Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.187.138)
>> WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.187.138)
>> WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
>> Querying daily.25104.91.0.0.6810BB8A.ping.clamav.net
>> Retrieving http://db.be.clamav.net/daily-25104.cdiff
>> Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.185.138)
>> WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.185.138)
>> WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
>> Querying daily.25104.91.0.0.6810B98A.ping.clamav.net
>> ...
>>
>> # wget http://db.be.clamav.net/daily.cvd
>> converted 'http://db.be.clamav.net/daily.cvd' (646) -> 'http://db.be.clamav.net/daily.cvd' (UTF-
>> 8)
>> --2018-11-11 17:03:08-- http://db.be.clamav.net/daily.cvd
>> Resolving db.be.clamav.net (db.be.clamav.net)... 104.16.188.138, 104.16.189.138,
>> 104.16.187.138, ...
>> Connecting to db.be.clamav.net (db.be.clamav.net)|104.16.188.138|:80... connected.
>> HTTP request sent, awaiting response... 530
>> 2018-11-11 17:03:08 ERROR 530: (no description).
>>
>> The (temporary?) solution is to:
>>
>> # vi .../freshclam.conf
>> => replace db.be.clamav.net by db.de.clamav.net (for instance)
>>
>> # rm ...clamav/db/mirrors.dat
>>
>> # freshclam --update-db=daily --stdout
>> ClamAV update process started at Sun Nov 11 17:04:02 2018
>> WARNING: Your ClamAV installation is OUTDATED!
>> WARNING: Local version: 0.100.0 Recommended version: 0.100.2
>> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
>> Downloading daily-25104.cdiff [100%]
>> Downloading daily-25105.cdiff [100%]
>> Downloading daily-25106.cdiff [100%]
>> Downloading daily-25107.cdiff [100%]
>> Downloading daily-25108.cdiff [100%]
>> Downloading daily-25109.cdiff [100%]
>> Downloading daily-25110.cdiff [100%]
>> Downloading daily-25111.cdiff [100%]
>> daily.cld updated (version: 25111, sigs: 2148413, f-level: 63, builder: neo)
>> Database updated (2148413 signatures) from db.de.clamav.net (IP: 104.16.187.138)
>> Clamd successfully notified about the update.
>>
>> Thanks
>> Pierre
>> _______________________________________________
>> clamav-users mailing list
>> clamav-***@lists.clamav.net
>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>>
>>
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>>
>> http://www.clamav.net/contact.html#ml
>
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Pierre Dehaen]

Yes,

# vi /etc/opt/csw/freshclam.conf
==> restore config to db.be.clamav.net
# freshclam --update-db=daily --stdout
ClamAV update process started at Mon Nov 12 19:46:46 2018
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.100.0 Recommended version: 0.100.2
DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
daily.cld is up to date (version: 25114, sigs: 2149227, f-level: 63, builder: neo)

It looks like it works now. I even tried:

# wget http://db.be.clamav.net/daily.cvd
converted 'http://db.be.clamav.net/daily.cvd' (646) -> 'http://db.be.clamav.net/daily.cvd' (UTF-
8)
--2018-11-12 19:49:27-- http://db.be.clamav.net/daily.cvd
Resolving db.be.clamav.net (db.be.clamav.net)... 104.16.185.138, 104.16.187.138,
104.16.188.138, ...
Connecting to db.be.clamav.net (db.be.clamav.net)|104.16.185.138|:80... connected.
HTTP request sent, awaiting response... 200 OK

Thank you very much,
Pierre

On 12 Nov 2018 at 18:12, Joel Esler (jesler) wrote:

Can you try now?

> On Nov 12, 2018, at 12:31 PM, Pierre Dehaen <***@drever.be> wrote:
>
> Hi Joel,
>
> # freshclam --version
> ClamAV 0.100.0/25114/Mon Nov 12 15:08:04 2018
>
> It's running on Solaris 11... I see now that 0.100.2 is available on opencsw, I'll try to upgrade
> soon.
>
> Thanks,
> Pierre
>
> On 12 Nov 2018 at 16:41, Joel Esler (jesler) wrote:
>
> Okay, so a couple things.
>
> Wget probably isn't going to work in the manner you expect. Which is why you got the 530
> response.
>
> What version of freshclam are you using?
>
>> On Nov 11, 2018, at 11:18 AM, Pierre Dehaen <***@drever.be> wrote:
>>
>> Hi,
>>
>> It seems the db.be.clamav.net does not work any more since Nov 9th. I tried to delete the
>> mirrors.dat but no way, I still get:
>>
>> # freshclam --update-db=daily --stdout
>> ...
>> daily.cvd version from DNS: 25111
>> Retrieving http://db.be.clamav.net/daily-25104.cdiff
>> Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.187.138)
>> WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.187.138)
>> WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
>> Querying daily.25104.91.0.0.6810BB8A.ping.clamav.net
>> Retrieving http://db.be.clamav.net/daily-25104.cdiff
>> Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.185.138)
>> WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.185.138)
>> WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
>> Querying daily.25104.91.0.0.6810B98A.ping.clamav.net
>> ...
>>
>> # wget http://db.be.clamav.net/daily.cvd
>> converted 'http://db.be.clamav.net/daily.cvd' (646) -> 'http://db.be.clamav.net/daily.cvd'
(UTF-
>> 8)
>> --2018-11-11 17:03:08-- http://db.be.clamav.net/daily.cvd
>> Resolving db.be.clamav.net (db.be.clamav.net)... 104.16.188.138, 104.16.189.138,
>> 104.16.187.138, ...
>> Connecting to db.be.clamav.net (db.be.clamav.net)|104.16.188.138|:80... connected.
>> HTTP request sent, awaiting response... 530
>> 2018-11-11 17:03:08 ERROR 530: (no description).
>>
>> The (temporary?) solution is to:
>>
>> # vi .../freshclam.conf
>> => replace db.be.clamav.net by db.de.clamav.net (for instance)
>>
>> # rm ...clamav/db/mirrors.dat
>>
>> # freshclam --update-db=daily --stdout
>> ClamAV update process started at Sun Nov 11 17:04:02 2018
>> WARNING: Your ClamAV installation is OUTDATED!
>> WARNING: Local version: 0.100.0 Recommended version: 0.100.2
>> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
>> Downloading daily-25104.cdiff [100%]
>> Downloading daily-25105.cdiff [100%]
>> Downloading daily-25106.cdiff [100%]
>> Downloading daily-25107.cdiff [100%]
>> Downloading daily-25108.cdiff [100%]
>> Downloading daily-25109.cdiff [100%]
>> Downloading daily-25110.cdiff [100%]
>> Downloading daily-25111.cdiff [100%]
>> daily.cld updated (version: 25111, sigs: 2148413, f-level: 63, builder: neo)
>> Database updated (2148413 signatures) from db.de.clamav.net (IP: 104.16.187.138)
>> Clamd successfully notified about the update.
>>
>> Thanks
>> Pierre
>> _______________________________________________
>> clamav-users mailing list
>> clamav-***@lists.clamav.net
>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>>
>>
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>>
>> http://www.clamav.net/contact.html#ml
>
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Joel Esler (jesler)]

Awesome. This was my fault. Thank one of my team members for fixing my screw up.

--
Joel Esler
Manager, Communities Division
Cisco Talos Intelligence Group
http://www.talosintelligence.com

> On Nov 12, 2018, at 1:51 PM, Pierre Dehaen <***@drever.be> wrote:
>
> Yes,
>
> # vi /etc/opt/csw/freshclam.conf
> ==> restore config to db.be.clamav.net
> # freshclam --update-db=daily --stdout
> ClamAV update process started at Mon Nov 12 19:46:46 2018
> WARNING: Your ClamAV installation is OUTDATED!
> WARNING: Local version: 0.100.0 Recommended version: 0.100.2
> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
> daily.cld is up to date (version: 25114, sigs: 2149227, f-level: 63, builder: neo)
>
> It looks like it works now. I even tried:
>
> # wget http://db.be.clamav.net/daily.cvd
> converted 'http://db.be.clamav.net/daily.cvd' (646) -> 'http://db.be.clamav.net/daily.cvd' (UTF-
> 8)
> --2018-11-12 19:49:27-- http://db.be.clamav.net/daily.cvd
> Resolving db.be.clamav.net (db.be.clamav.net)... 104.16.185.138, 104.16.187.138,
> 104.16.188.138, ...
> Connecting to db.be.clamav.net (db.be.clamav.net)|104.16.185.138|:80... connected.
> HTTP request sent, awaiting response... 200 OK
>
> Thank you very much,
> Pierre
>
> On 12 Nov 2018 at 18:12, Joel Esler (jesler) wrote:
>
> Can you try now?
>
>> On Nov 12, 2018, at 12:31 PM, Pierre Dehaen <***@drever.be> wrote:
>>
>> Hi Joel,
>>
>> # freshclam --version
>> ClamAV 0.100.0/25114/Mon Nov 12 15:08:04 2018
>>
>> It's running on Solaris 11... I see now that 0.100.2 is available on opencsw, I'll try to upgrade
>> soon.
>>
>> Thanks,
>> Pierre
>>
>> On 12 Nov 2018 at 16:41, Joel Esler (jesler) wrote:
>>
>> Okay, so a couple things.
>>
>> Wget probably isn't going to work in the manner you expect. Which is why you got the 530
>> response.
>>
>> What version of freshclam are you using?
>>
>>> On Nov 11, 2018, at 11:18 AM, Pierre Dehaen <***@drever.be> wrote:
>>>
>>> Hi,
>>>
>>> It seems the db.be.clamav.net does not work any more since Nov 9th. I tried to delete the
>>> mirrors.dat but no way, I still get:
>>>
>>> # freshclam --update-db=daily --stdout
>>> ...
>>> daily.cvd version from DNS: 25111
>>> Retrieving http://db.be.clamav.net/daily-25104.cdiff
>>> Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.187.138)
>>> WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.187.138)
>>> WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
>>> Querying daily.25104.91.0.0.6810BB8A.ping.clamav.net
>>> Retrieving http://db.be.clamav.net/daily-25104.cdiff
>>> Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.185.138)
>>> WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.185.138)
>>> WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
>>> Querying daily.25104.91.0.0.6810B98A.ping.clamav.net
>>> ...
>>>
>>> # wget http://db.be.clamav.net/daily.cvd
>>> converted 'http://db.be.clamav.net/daily.cvd' (646) -> 'http://db.be.clamav.net/daily.cvd'
> (UTF-
>>> 8)
>>> --2018-11-11 17:03:08-- http://db.be.clamav.net/daily.cvd
>>> Resolving db.be.clamav.net (db.be.clamav.net)... 104.16.188.138, 104.16.189.138,
>>> 104.16.187.138, ...
>>> Connecting to db.be.clamav.net (db.be.clamav.net)|104.16.188.138|:80... connected.
>>> HTTP request sent, awaiting response... 530
>>> 2018-11-11 17:03:08 ERROR 530: (no description).
>>>
>>> The (temporary?) solution is to:
>>>
>>> # vi .../freshclam.conf
>>> => replace db.be.clamav.net by db.de.clamav.net (for instance)
>>>
>>> # rm ...clamav/db/mirrors.dat
>>>
>>> # freshclam --update-db=daily --stdout
>>> ClamAV update process started at Sun Nov 11 17:04:02 2018
>>> WARNING: Your ClamAV installation is OUTDATED!
>>> WARNING: Local version: 0.100.0 Recommended version: 0.100.2
>>> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
>>> Downloading daily-25104.cdiff [100%]
>>> Downloading daily-25105.cdiff [100%]
>>> Downloading daily-25106.cdiff [100%]
>>> Downloading daily-25107.cdiff [100%]
>>> Downloading daily-25108.cdiff [100%]
>>> Downloading daily-25109.cdiff [100%]
>>> Downloading daily-25110.cdiff [100%]
>>> Downloading daily-25111.cdiff [100%]
>>> daily.cld updated (version: 25111, sigs: 2148413, f-level: 63, builder: neo)
>>> Database updated (2148413 signatures) from db.de.clamav.net (IP: 104.16.187.138)
>>> Clamd successfully notified about the update.
>>>
>>> Thanks
>>> Pierre
>>> _______________________________________________
>>> clamav-users mailing list
>>> clamav-***@lists.clamav.net
>>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>>>
>>>
>>> Help us build a comprehensive ClamAV guide:
>>> https://github.com/vrtadmin/clamav-faq
>>>
>>> http://www.clamav.net/contact.html#ml
>>
>> _______________________________________________
>> clamav-users mailing list
>> clamav-***@lists.clamav.net
>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>>
>>
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>>
>> http://www.clamav.net/contact.html#ml
>>
>> _______________________________________________
>> clamav-users mailing list
>> clamav-***@lists.clamav.net
>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>>
>>
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>>
>> http://www.clamav.net/contact.html#ml
>
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Pierre Dehaen]

Thank you Joel and the team member,

I waited for some updates to be available before answering so that now I can confirm it works
correctly:

ClamAV update process started at Tue Nov 13 07:37:01 2018
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.100.0 Recommended version: 0.100.2
DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
main.cld is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
nonblock_connect: connect(): fd=5 errno=128: Network is unreachable
Can't connect to port 80 of host db.be.clamav.net (IP: 2606:4700::6810:bb8a)
Downloading daily-25116.cdiff [100%]
daily.cld updated (version: 25116, sigs: 2149904, f-level: 63, builder: neo)
bytecode.cld is up to date (version: 327, sigs: 91, f-level: 63, builder: neo)
Database updated (6716244 signatures) from db.be.clamav.net (IP: 104.16.189.138)
Clamd successfully notified about the update.

Rgds,
Pierre

On 12 Nov 2018 at 19:11, Joel Esler (jesler) wrote:

Awesome. This was my fault. Thank one of my team members for fixing my screw up.

--
Joel Esler
Manager, Communities Division
Cisco Talos Intelligence Group
http://www.talosintelligence.com

> On Nov 12, 2018, at 1:51 PM, Pierre Dehaen <***@drever.be> wrote:
>
> Yes,
>
> # vi /etc/opt/csw/freshclam.conf
> ==> restore config to db.be.clamav.net
> # freshclam --update-db=daily --stdout
> ClamAV update process started at Mon Nov 12 19:46:46 2018
> WARNING: Your ClamAV installation is OUTDATED!
> WARNING: Local version: 0.100.0 Recommended version: 0.100.2
> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
> daily.cld is up to date (version: 25114, sigs: 2149227, f-level: 63, builder: neo)
>
> It looks like it works now. I even tried:
>
> # wget http://db.be.clamav.net/daily.cvd
> converted 'http://db.be.clamav.net/daily.cvd' (646) -> 'http://db.be.clamav.net/daily.cvd' (UTF-
> 8)
> --2018-11-12 19:49:27-- http://db.be.clamav.net/daily.cvd
> Resolving db.be.clamav.net (db.be.clamav.net)... 104.16.185.138, 104.16.187.138,
> 104.16.188.138, ...
> Connecting to db.be.clamav.net (db.be.clamav.net)|104.16.185.138|:80... connected.
> HTTP request sent, awaiting response... 200 OK
>
> Thank you very much,
> Pierre
>
> On 12 Nov 2018 at 18:12, Joel Esler (jesler) wrote:
>
> Can you try now?
>
>> On Nov 12, 2018, at 12:31 PM, Pierre Dehaen <***@drever.be> wrote:
>>
>> Hi Joel,
>>
>> # freshclam --version
>> ClamAV 0.100.0/25114/Mon Nov 12 15:08:04 2018
>>
>> It's running on Solaris 11... I see now that 0.100.2 is available on opencsw, I'll try to
upgrade
>> soon.
>>
>> Thanks,
>> Pierre
>>
>> On 12 Nov 2018 at 16:41, Joel Esler (jesler) wrote:
>>
>> Okay, so a couple things.
>>
>> Wget probably isn't going to work in the manner you expect. Which is why you got the
530
>> response.
>>
>> What version of freshclam are you using?
>>
>>> On Nov 11, 2018, at 11:18 AM, Pierre Dehaen <***@drever.be> wrote:
>>>
>>> Hi,
>>>
>>> It seems the db.be.clamav.net does not work any more since Nov 9th. I tried to delete
the
>>> mirrors.dat but no way, I still get:
>>>
>>> # freshclam --update-db=daily --stdout
>>> ...
>>> daily.cvd version from DNS: 25111
>>> Retrieving http://db.be.clamav.net/daily-25104.cdiff
>>> Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.187.138)
>>> WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.187.138)
>>> WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
>>> Querying daily.25104.91.0.0.6810BB8A.ping.clamav.net
>>> Retrieving http://db.be.clamav.net/daily-25104.cdiff
>>> Trying to download http://db.be.clamav.net/daily-25104.cdiff (IP: 104.16.185.138)
>>> WARNING: getfile: Unknown response from db.be.clamav.net (IP: 104.16.185.138)
>>> WARNING: getpatch: Can't download daily-25104.cdiff from db.be.clamav.net
>>> Querying daily.25104.91.0.0.6810B98A.ping.clamav.net
>>> ...
>>>
>>> # wget http://db.be.clamav.net/daily.cvd
>>> converted 'http://db.be.clamav.net/daily.cvd' (646) -> 'http://db.be.clamav.net/daily.cvd'
> (UTF-
>>> 8)
>>> --2018-11-11 17:03:08-- http://db.be.clamav.net/daily.cvd
>>> Resolving db.be.clamav.net (db.be.clamav.net)... 104.16.188.138, 104.16.189.138,
>>> 104.16.187.138, ...
>>> Connecting to db.be.clamav.net (db.be.clamav.net)|104.16.188.138|:80... connected.
>>> HTTP request sent, awaiting response... 530
>>> 2018-11-11 17:03:08 ERROR 530: (no description).
>>>
>>> The (temporary?) solution is to:
>>>
>>> # vi .../freshclam.conf
>>> => replace db.be.clamav.net by db.de.clamav.net (for instance)
>>>
>>> # rm ...clamav/db/mirrors.dat
>>>
>>> # freshclam --update-db=daily --stdout
>>> ClamAV update process started at Sun Nov 11 17:04:02 2018
>>> WARNING: Your ClamAV installation is OUTDATED!
>>> WARNING: Local version: 0.100.0 Recommended version: 0.100.2
>>> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
>>> Downloading daily-25104.cdiff [100%]
>>> Downloading daily-25105.cdiff [100%]
>>> Downloading daily-25106.cdiff [100%]
>>> Downloading daily-25107.cdiff [100%]
>>> Downloading daily-25108.cdiff [100%]
>>> Downloading daily-25109.cdiff [100%]
>>> Downloading daily-25110.cdiff [100%]
>>> Downloading daily-25111.cdiff [100%]
>>> daily.cld updated (version: 25111, sigs: 2148413, f-level: 63, builder: neo)
>>> Database updated (2148413 signatures) from db.de.clamav.net (IP: 104.16.187.138)
>>> Clamd successfully notified about the update.
>>>
>>> Thanks
>>> Pierre
>>> _______________________________________________
>>> clamav-users mailing list
>>> clamav-***@lists.clamav.net
>>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>>>
>>>
>>> Help us build a comprehensive ClamAV guide:
>>> https://github.com/vrtadmin/clamav-faq
>>>
>>> http://www.clamav.net/contact.html#ml
>>
>> _______________________________________________
>> clamav-users mailing list
>> clamav-***@lists.clamav.net
>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>>
>>
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>>
>> http://www.clamav.net/contact.html#ml
>>
>> _______________________________________________
>> clamav-users mailing list
>> clamav-***@lists.clamav.net
>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>>
>>
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>>
>> http://www.clamav.net/contact.html#ml
>
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Dennis Peterson]

On 11/12/18 6:28 PM, Paul Kosinski wrote:
> As some of you may remember, I "solved" the problems of the Cloudflare
> mirrors being out of sync by not relying on what version the DNS TXT
> record reports, but double checking it by retrieving the head of the
> CVD file via curl.
>
Why are you looking at October reports?


dp


_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Dennis Peterson]

On 11/13/18 12:04 PM, Paul Kosinski wrote:
> "Why are you looking at October reports?"
>
> It was the first one. And it also shows that the problem began *before*
> 0.100.1 was deemed OUTDATED.
>
> So, here's one from this morning.
>
> I also have 4 from yesterday, 3 from Sunday Nov 11 etc. Posting them
> all would be a bit tedious.

What does this line mean - that is, what is fetching from that IP? Local mirror?

Using ip '10.11.14.160' for fetching.

And we're having a completely different experience here with reliability over the same time span:

Mirror #1
IP: 104.16.189.138
Successes: 19
Failures: 0
Last access: Thu Nov 15 07:01:02 2018
Ignore: No
-------------------------------------
Mirror #2
IP: 104.16.186.138
Successes: 19
Failures: 0
Last access: Wed Nov 14 23:01:03 2018
Ignore: No
-------------------------------------
Mirror #3
IP: 104.16.185.138
Successes: 18
Failures: 0
Last access: Mon Nov 12 21:05:32 2018
Ignore: No
-------------------------------------
Mirror #4
IP: 104.16.187.138
Successes: 18
Failures: 0
Last access: Sun Nov 11 01:07:46 2018
Ignore: No
-------------------------------------
Mirror #5
IP: 104.16.188.138
Successes: 19
Failures: 0
Last access: Mon Nov 12 14:03:05 2018
Ignore: No

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Joel Esler (jesler)]

Judging by the 60+TB of traffic we are transferring a day, it's working for at least 3M+ users.

> On Nov 15, 2018, at 1:34 PM, Dennis Peterson <***@inetnw.com> wrote:
>
> On 11/13/18 12:04 PM, Paul Kosinski wrote:
>> "Why are you looking at October reports?"
>>
>> It was the first one. And it also shows that the problem began *before*
>> 0.100.1 was deemed OUTDATED.
>>
>> So, here's one from this morning.
>>
>> I also have 4 from yesterday, 3 from Sunday Nov 11 etc. Posting them
>> all would be a bit tedious.
>
> What does this line mean - that is, what is fetching from that IP? Local mirror?
>
> Using ip '10.11.14.160' for fetching.
>
> And we're having a completely different experience here with reliability over the same time span:
>
> Mirror #1
> IP: 104.16.189.138
> Successes: 19
> Failures: 0
> Last access: Thu Nov 15 07:01:02 2018
> Ignore: No
> -------------------------------------
> Mirror #2
> IP: 104.16.186.138
> Successes: 19
> Failures: 0
> Last access: Wed Nov 14 23:01:03 2018
> Ignore: No
> -------------------------------------
> Mirror #3
> IP: 104.16.185.138
> Successes: 18
> Failures: 0
> Last access: Mon Nov 12 21:05:32 2018
> Ignore: No
> -------------------------------------
> Mirror #4
> IP: 104.16.187.138
> Successes: 18
> Failures: 0
> Last access: Sun Nov 11 01:07:46 2018
> Ignore: No
> -------------------------------------
> Mirror #5
> IP: 104.16.188.138
> Successes: 19
> Failures: 0
> Last access: Mon Nov 12 14:03:05 2018
> Ignore: No
>
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Benny Pedersen]

Paul Kosinski skrev den 2018-11-20 03:25:

> # Use aaa.bbb.ccc.ddd as client address for downloading databases.
> # Useful for multi-homed systems.
> # Default: Use OS'es default outgoing IP address.
> LocalIPAddress 10.11.14.160

comment that line

> No matter, are we so unlucky -- only 1 out of 3M -- in having the sync
> errors reappear? Or are we simply one of far fewer users who log (and
> actually examine) their entire freshclam output?

you did not make localmirror correct, whole 10.x.x.x/8 is non routed in
rfc1918, so not external problem to solve other then make freshclam get
a localmirror that works, if unsure how, comment that localipaddress
_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Joel Esler (jesler)]

Any particular reason that you are using a local mirror? I mean, if not strictly necessary, just point it at our mirrors and call it a day.

I've talked to a couple people off list in the last few days that were experiencing errors or delays, and 100% of them were using local proxies or mirrors.

One was because the proxy didn't know how to address "HTTP/1.0" (Instead of "HTTP/1.1").

So it could be the smallest of issues, eliminate any issues that are not strictly relevant.

--
Joel Esler
Manager, Communities Division
Cisco Talos Intelligence Group
http://www.talosintelligence.com

> On Nov 19, 2018, at 9:25 PM, Paul Kosinski <clamav-***@iment.com> wrote:
>
> Our Internet-facing ClamAV sits on our gateway/firewall and serves as
> our local mirror. It accesses the Internet via the NIC whose IP address
> is 10.11.14.160. (We used to have two NICs connected to the Internet,
> but now only have one, so this is historical only.)
>
> The msg "Using ip '10.11.14.160' for fetching" is produced by the
> freshclam binary itself and derives from our freshclam.conf entry:
>
> # Use aaa.bbb.ccc.ddd as client address for downloading databases.
> # Useful for multi-homed systems.
> # Default: Use OS'es default outgoing IP address.
> LocalIPAddress 10.11.14.160
>
> No matter, are we so unlucky -- only 1 out of 3M -- in having the sync
> errors reappear? Or are we simply one of far fewer users who log (and
> actually examine) their entire freshclam output?
>
> P.S. I have very recently updated our clamavs to 0.100.2. I wonder if
> that will improve things in this regard.
>
>
>
> On Thu, 15 Nov 2018 19:40:43 +0000
> "Joel Esler (jesler)" <***@cisco.com> wrote:
>
>> Judging by the 60+TB of traffic we are transferring a day, it's
>> working for at least 3M+ users.
>>
>>> On Nov 15, 2018, at 1:34 PM, Dennis Peterson <***@inetnw.com>
>>> wrote:
>>>
>>> On 11/13/18 12:04 PM, Paul Kosinski wrote:
>>>> "Why are you looking at October reports?"
>>>>
>>>> It was the first one. And it also shows that the problem began
>>>> *before* 0.100.1 was deemed OUTDATED.
>>>>
>>>> So, here's one from this morning.
>>>>
>>>> I also have 4 from yesterday, 3 from Sunday Nov 11 etc. Posting
>>>> them all would be a bit tedious.
>>>
>>> What does this line mean - that is, what is fetching from that IP?
>>> Local mirror?
>>>
>>> Using ip '10.11.14.160' for fetching.
>>>
>>> And we're having a completely different experience here with
>>> reliability over the same time span:
>>>
>>> Mirror #1
>>> IP: 104.16.189.138
>>> Successes: 19
>>> Failures: 0
>>> Last access: Thu Nov 15 07:01:02 2018
>>> Ignore: No
>>> -------------------------------------
>>> Mirror #2
>>> IP: 104.16.186.138
>>> Successes: 19
>>> Failures: 0
>>> Last access: Wed Nov 14 23:01:03 2018
>>> Ignore: No
>>> -------------------------------------
>>> Mirror #3
>>> IP: 104.16.185.138
>>> Successes: 18
>>> Failures: 0
>>> Last access: Mon Nov 12 21:05:32 2018
>>> Ignore: No
>>> -------------------------------------
>>> Mirror #4
>>> IP: 104.16.187.138
>>> Successes: 18
>>> Failures: 0
>>> Last access: Sun Nov 11 01:07:46 2018
>>> Ignore: No
>>> -------------------------------------
>>> Mirror #5
>>> IP: 104.16.188.138
>>> Successes: 19
>>> Failures: 0
>>> Last access: Mon Nov 12 14:03:05 2018
>>> Ignore: No
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Joel Esler (jesler)]

It's possible. But, unless there is a vocal minority that no one is chiming in about, you are the only person/group that I have heard complain about the issue...

Millions of people are getting updates from Cloudflare a day, so something is working correctly, and there's been no configuration changes on our side.

If you receive Cloudflare blocks then that's a different story.

On Nov 20, 2018, at 1:55 PM, Paul Kosinski <clamav-***@iment.com<mailto:clamav-***@iment.com>> wrote:

We are using a local mirror to reduce Internet traffic and (mainly) to
reduce load on the ClamAV servers.

It is *only* the "master" (Internet-connected) ClamAV that sees these
delays, where the DNS TXT record advertises updates before whatever
Cloudflare server we (are unlucky enough to) actually hit has the files
available for download. The other ClamAVs on our LAN use an approach
wherein the mirror server (on the "master" ClamAV machine) simply
reports when new cvd (etc.) files are available locally.

It is only the "master" ClamAV that periodically does a DNS TXT query to
decide whether to run freshclam, whose source is the ClamAV (Clouflare)
server. If it does this immediately when the DNS TXT records suggests,
freshclam sometimes fails, complaining about things being out of sync.
(That's when I added the curl prefetch to see if the file really was
what the DNS TXT said.) All this has nothing to do with our local
mirroring,

Somebody suggested that our ISP (Comcast) may be proxying / caching the
ClamAV files -- and doing it badly. If that's the case, I don't know
what we can do about it.


On Tue, 20 Nov 2018 13:09:54 +0000
"Joel Esler (jesler)" <***@cisco.com<mailto:***@cisco.com>> wrote:

Any particular reason that you are using a local mirror? I mean, if
not strictly necessary, just point it at our mirrors and call it a
day.

I've talked to a couple people off list in the last few days that
were experiencing errors or delays, and 100% of them were using local
proxies or mirrors.

One was because the proxy didn't know how to address
"HTTP/1.0" (Instead of "HTTP/1.1").

So it could be the smallest of issues, eliminate any issues that are
not strictly relevant.

--
Joel Esler
Manager, Communities Division
Cisco Talos Intelligence Group
http://www.talosintelligence.com

On Nov 19, 2018, at 9:25 PM, Paul Kosinski <clamav-***@iment.com>
wrote:

Our Internet-facing ClamAV sits on our gateway/firewall and serves
as our local mirror. It accesses the Internet via the NIC whose IP
address is 10.11.14.160. (We used to have two NICs connected to the
Internet, but now only have one, so this is historical only.)

The msg "Using ip '10.11.14.160' for fetching" is produced by the
freshclam binary itself and derives from our freshclam.conf entry:

# Use aaa.bbb.ccc.ddd as client address for downloading databases.
# Useful for multi-homed systems.
# Default: Use OS'es default outgoing IP address.
LocalIPAddress 10.11.14.160

No matter, are we so unlucky -- only 1 out of 3M -- in having the
sync errors reappear? Or are we simply one of far fewer users who
log (and actually examine) their entire freshclam output?

P.S. I have very recently updated our clamavs to 0.100.2. I wonder
if that will improve things in this regard.



On Thu, 15 Nov 2018 19:40:43 +0000
"Joel Esler (jesler)" <***@cisco.com> wrote:

Judging by the 60+TB of traffic we are transferring a day, it's
working for at least 3M+ users.

On Nov 15, 2018, at 1:34 PM, Dennis Peterson <***@inetnw.com>
wrote:

On 11/13/18 12:04 PM, Paul Kosinski wrote:
"Why are you looking at October reports?"

It was the first one. And it also shows that the problem began
*before* 0.100.1 was deemed OUTDATED.

So, here's one from this morning.

I also have 4 from yesterday, 3 from Sunday Nov 11 etc. Posting
them all would be a bit tedious.

What does this line mean - that is, what is fetching from that IP?
Local mirror?

Using ip '10.11.14.160' for fetching.

And we're having a completely different experience here with
reliability over the same time span:

Mirror #1
IP: 104.16.189.138
Successes: 19
Failures: 0
Last access: Thu Nov 15 07:01:02 2018
Ignore: No
-------------------------------------
Mirror #2
IP: 104.16.186.138
Successes: 19
Failures: 0
Last access: Wed Nov 14 23:01:03 2018
Ignore: No
-------------------------------------
Mirror #3
IP: 104.16.185.138
Successes: 18
Failures: 0
Last access: Mon Nov 12 21:05:32 2018
Ignore: No
-------------------------------------
Mirror #4
IP: 104.16.187.138
Successes: 18
Failures: 0
Last access: Sun Nov 11 01:07:46 2018
Ignore: No
-------------------------------------
Mirror #5
IP: 104.16.188.138
Successes: 19
Failures: 0
Last access: Mon Nov 12 14:03:05 2018
Ignore: No


_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net<mailto:clamav-***@lists.clamav.net>
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Dennis Peterson]

On 11/22/18 8:51 PM, Paul Kosinski wrote:
> I wonder how many users of ClamAV actually log their freshclam updates.
> Those who don't likely won't notice freshclam temporary failures due
> to an out-of-sync condition.

I just checked logs on two systems dating from July 1 and see no failures. I
isolated the signature serial numbers and time tags and all were received with
clock like precision. Freshclam is launched every three hours from cron.d and
incorporates a randomizer to create a delay to help avoid pileups on common
cardinal clock positions. No serial numbers were missed within the time slot.

dp

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Pierre Dehaen]

> On 11/22/18 8:51 PM, Paul Kosinski wrote:
> I wonder how many users of ClamAV actually log their freshclam updates.
> Those who don't likely won't notice freshclam temporary failures due
> to an out-of-sync condition.

I do log and do analyze all logs on all servers everyday, sometimes every hour (a little script
sends me an email if anything abnormal happens).

If you mean "Mirror not synchronized" messages, I've received some since 2016 (list
attached) but there was no big issue excepted the recent problem with the "be" mirror, now
fixed, that I submitted here. The logs show that the errors generally happen in a row, maybe
some temporary issues on some servers?

Pierre

[Joel Esler (jesler)]

The “be” error was my fault. Plain and simple. I misconfigured a dns entry.

Sent from my  iPhone

On Nov 23, 2018, at 04:28, Pierre Dehaen <***@drever.be> wrote:

>> On 11/22/18 8:51 PM, Paul Kosinski wrote:
>> I wonder how many users of ClamAV actually log their freshclam updates.
>> Those who don't likely won't notice freshclam temporary failures due
>> to an out-of-sync condition.
>
> I do log and do analyze all logs on all servers everyday, sometimes every hour (a little script
> sends me an email if anything abnormal happens).
>
> If you mean "Mirror not synchronized" messages, I've received some since 2016 (list
> attached) but there was no big issue excepted the recent problem with the "be" mirror, now
> fixed, that I submitted here. The logs show that the errors generally happen in a row, maybe
> some temporary issues on some servers?
>
> Pierre
>
>
> <freshclam.zip>
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

[Gene Heskett]

On Friday 23 November 2018 03:43:40 Dennis Peterson wrote:

> On 11/22/18 8:51 PM, Paul Kosinski wrote:
> > I wonder how many users of ClamAV actually log their freshclam
> > updates. Those who don't likely won't notice freshclam temporary
> > failures due to an out-of-sync condition.
>
> I just checked logs on two systems dating from July 1 and see no
> failures. I isolated the signature serial numbers and time tags and
> all were received with clock like precision. Freshclam is launched
> every three hours from cron.d and incorporates a randomizer to create
> a delay to help avoid pileups on common cardinal clock positions. No
> serial numbers were missed within the time slot.
>
> dp

I did keep a tail on mine, but it Just Works(TM) That is what its
supposed to do I believe. :)

> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml



--
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>
_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Gary R. Schmidt]

On 23/11/2018 22:45, Gene Heskett wrote:
> On Friday 23 November 2018 03:43:40 Dennis Peterson wrote:
>
>> On 11/22/18 8:51 PM, Paul Kosinski wrote:
>>> I wonder how many users of ClamAV actually log their freshclam
>>> updates. Those who don't likely won't notice freshclam temporary
>>> failures due to an out-of-sync condition.
>>
>> I just checked logs on two systems dating from July 1 and see no
>> failures. I isolated the signature serial numbers and time tags and
>> all were received with clock like precision. Freshclam is launched
>> every three hours from cron.d and incorporates a randomizer to create
>> a delay to help avoid pileups on common cardinal clock positions. No
>> serial numbers were missed within the time slot.
>>
>> dp
>
> I did keep a tail on mine, but it Just Works(TM) That is what its
> supposed to do I believe. :)
>
As does mine, as it has since I don't know when, and my freshclam.conf
has logging turned on.

It *didn't* work during the switch over to Cloudflare, but has been fine
since that stabilised, but when it wasn't working I had a cron job that
deleted "mirrors.dat" every hour, which reduced the failure rate.

But the OP has refused to consider trying that.

Cheers,
Gary B-)
_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Joel Esler (jesler)]

The "out of date at one mirror" issue you are speaking of is fine. Once someone requests a file, it is cached at that POP site. All further requests to other POPs then check "sister" POP sites to see if the other POP sites have the file first, then download it laterally from one POP to another.

So, if you are hitting two POPs at once, you may just be the first one at that POP to request the file.

After the first request it should grab the file and serve it.

> On Nov 26, 2018, at 7:19 PM, Paul Kosinski <clamav-***@iment.com> wrote:
>
> I believe that the delays we have been observing are due to some
> problem with the Boston Cloudflare servers, or, perhaps, Comcast has a
> "transparent" caching proxy which is causing us trouble.
>
> I recently installed the same build and configuration of ClamAV 0.100.2
> on our Web server, a virtual machine hosted in NYC. It runs the same
> extra code (curl etc.) to check the cvd version number that we have
> locally. Since Friday, there have been no delays there, although there
> have been several significant delays locally. They check at exactly
> the same time as each other (i.e., via NTP synced cron jobs).
>
> I also am now running, at each location, simple curls to read the first
> few bytes of the cvd files (to get the version number), *and* to log
> all the headers sent and received. These are also run at exactly the
> same time (as each other) via cron.
>
> The headers show that our local system uses the 'BOS' Cloudflare server,
> while the remote one uses the 'IAD' server:
>
> CF-RAY: 47fd0b7af79dae32-BOS
> CF-RAY: 47fd0b8064d9c1b8-IAD
>
> Interestingly, these two cron jobs sometimes show that the BOS server
> is out of date relative to the IAD server. For example, the following
> curls show that one cvd file served by the BOS server is one version
> behind that served by the IAD server at the *same* time. The files'
> "Last-modified" lines are of particular interest. The BOS server says
> the file was last modified on Mon, 26 Nov 2018 at 06:19:22 GMT, while
> the IAD server says the file was last modified on Mon, 26 Nov 2018 at
> 14:15:24 GMT.
>
> In particular, the BOS "Date:" header says it's already about 14 mins
> *later* than the IAD "Last-modified:" timestamp indicates. In other
> words, the file delivered by the BOS server is, at time of *delivery*,
> already about 14 minutes out of date.
>
> --- BOS server ---
>
> ------------------------------ Monday 26 November 2018 at 09:29:01 ------------------------------
>
> /usr/bin/curl -4 -0 -s -v -r 0-99 -H Connection:close -A ClamAV/0.100.2 database.clamav.net/daily.cvd 2>&1
> * About to connect() to database.clamav.net port 80 (#0)
> * Trying 104.16.187.138...
> * connected
> * Connected to database.clamav.net (104.16.187.138) port 80 (#0)
>> GET /daily.cvd HTTP/1.0
>> Range: bytes=0-99
>> User-Agent: ClamAV/0.100.2
>> Host: database.clamav.net
>> Accept: */*
>> Connection:close
>>
> * additional stuff not fine transfer.c:1042: 0 0
> * HTTP 1.1 or later with persistent connection, pipelining supported
> < HTTP/1.1 206 Partial Content
> < Date: Mon, 26 Nov 2018 14:29:01 GMT
> < Content-Type: application/octet-stream
> < Content-Length: 100
> < Connection: close
> < Set-Cookie: __cfduid=d6eb82c36b149e2a4d07b430117606e581543242541; expires=Tue, 26-Nov-19 14:29:01 GMT; path=/; domain=.clamav.net; HttpOnly
> < Last-Modified: Mon, 26 Nov 2018 06:19:22 GMT
> < ETag: "5bfb906a-321a420"
> < Expires: Mon, 26 Nov 2018 18:23:39 GMT
> < Cache-Control: public, max-age=14078
> < CF-Cache-Status: HIT
> < Content-Range: bytes 0-99/52536352
> < Server: cloudflare
> < CF-RAY: 47fd0b7af79dae32-BOS
> <
> { [data not shown]
> * Closing connection #0
> ClamAV-VDB:26 Nov 2018 01-15 -0500:25154:2160594:63:083b8d4aa3824a865ac0e3ebeb3f7ce0:MT9OksyAAA34bbI
>
> ------------------------------ Monday 26 November 2018 at 09:29:01 ------------------------------
>
>
> --- IAD server ---
>
> ------------------------------ Monday 26 November 2018 at 09:29:02 ------------------------------
>
> /usr/bin/curl -4 -0 -s -v -r 0-99 -H Connection:close -A ClamAV/0.100.2 database.clamav.net/daily.cvd 2>&1
> * About to connect() to database.clamav.net port 80 (#0)
> * Trying 104.16.185.138...
> * Connected to database.clamav.net (104.16.185.138) port 80 (#0)
>> GET /daily.cvd HTTP/1.0
>> Range: bytes=0-99
>> User-Agent: ClamAV/0.100.2
>> Host: database.clamav.net
>> Accept: */*
>> Connection:close
>>
> < HTTP/1.1 206 Partial Content
> < Date: Mon, 26 Nov 2018 14:29:02 GMT
> < Content-Type: application/octet-stream
> < Content-Length: 100
> < Connection: close
> < Set-Cookie: __cfduid=d426fd78ff1d6c6e42029baf939e5bbee1543242542; expires=Tue, 26-Nov-19 14:29:02 GMT; path=/; domain=.clamav.net; HttpOnly
> < Last-Modified: Mon, 26 Nov 2018 14:15:24 GMT
> < ETag: "5bfbfffc-321bb54"
> < Expires: Mon, 26 Nov 2018 18:23:46 GMT
> < Cache-Control: public, max-age=14084
> < CF-Cache-Status: HIT
> < Content-Range: bytes 0-99/52542292
> < Server: cloudflare
> < CF-RAY: 47fd0b8064d9c1b8-IAD
> <
> { [data not shown]
> * Closing connection 0
> ClamAV-VDB:26 Nov 2018 09-14 -0500:25155:2160841:63:9817036334370e1482f3fc58c6ed745a:MDvX2VW3tQr3ba4
>
> ------------------------------ Monday 26 November 2018 at 09:29:02 ------------------------------
>
>
> P.S. As far as I can tell, there are no Cloudflare "blocks".
>
>
> ===================================================================================
>
> On Tue, 20 Nov 2018 22:39:44 +0000
> "Joel Esler (jesler)" <***@cisco.com> wrote:
>
>> It's possible. But, unless there is a vocal minority that no one is
>> chiming in about, you are the only person/group that I have heard
>> complain about the issue...
>>
>> Millions of people are getting updates from Cloudflare a day, so
>> something is working correctly, and there's been no configuration
>> changes on our side.
>>
>> If you receive Cloudflare blocks then that's a different story.
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

[Dennis Peterson]

I think these reports don't tell you what you think they mean. In fact they're
pretty much meaningless. The two different servers have different versions of
the signature. That is perfectly normal - there is simply zero chance and it is
naive to think they will always be fully synced in the same second of time of
day. You can infer nothing when this occurs.

In any event these signature serial numbers are associated with the DNS txt
record. The designed process is entirely serial - freshclam knows your installed
signature file serial number, it knows the DNS txt record, and it requests
updates from any of the signature servers if the local version is different from
the DNS txt record. It will try all the mirrors until success or the list of
mirrors is exhausted. Other things that mess with the fully synchronized state
is that DNS caching, TTL, local system clock differences, and policies of
various name service admins to ignore authoritative TTL suggestions.

The database.clamav.net dns is a round robin of 5 different servers and you
cannot predict what you will receive. In fact in the best case the list be
reordered each time you request the A record. And the chances of two different
clients getting the same A record is very low.

Your own local resolver looks in its own cache to see if it has expired. The TTL
record for the TXT record is 1800 seconds. If you use the dig command retrieve
the TXT record you can watch the TTL count down:

    dig  txt current.cvd.clamav.net |grep TXT

To eliminate this as a problem source you can always use host table entries
rather than dns for your tests. The round robin records ensure reliability for
the client and crude load balancing for the server farm.

So worst case is the record you see can be 1800 seconds behind an updated TXT
record. Obviously polling the current.cvd.clamav.net server directly will return
an uncached record at the expense of recursing queries (use the IP instead of
the hostname to avoid this).

Because these variables exist, freshclam is somewhat fault tolerant and will
retry 3 times per mirror (default and is configurable), and if a mirror is in a
failed state freshclam will map it out of the servers to try next time
(mirrors.dat). The other variable is some of the sync process is demand-driven.
In very busy systems (which these are) stale files should not exist very long.
Your request just might be a trigger to refresh a stale file, and the next
person to hit that server will retrieve the updated file and your system will
move to another mirror. This scenario presumes files are pulled to the mirrors,
not pushed.

I do believe your angst over not having complete system synchronization is
unwarranted as there are too many uncontrollable variables and it's really not
critical if the first mirror doesn't respond.

Finally - the current cloudflare process is pretty solid - it is a vast
improvement over the historical mirror collaboration

On 11/26/18 4:19 PM, Paul Kosinski wrote:
> I believe that the delays we have been observing are due to some
> problem with the Boston Cloudflare servers, or, perhaps, Comcast has a
> "transparent" caching proxy which is causing us trouble.
>
> I recently installed the same build and configuration of ClamAV 0.100.2
> on our Web server, a virtual machine hosted in NYC. It runs the same
> extra code (curl etc.) to check the cvd version number that we have
> locally. Since Friday, there have been no delays there, although there
> have been several significant delays locally. They check at exactly
> the same time as each other (i.e., via NTP synced cron jobs).
>
> I also am now running, at each location, simple curls to read the first
> few bytes of the cvd files (to get the version number), *and* to log
> all the headers sent and received. These are also run at exactly the
> same time (as each other) via cron.
>
> The headers show that our local system uses the 'BOS' Cloudflare server,
> while the remote one uses the 'IAD' server:
>
> CF-RAY: 47fd0b7af79dae32-BOS
> CF-RAY: 47fd0b8064d9c1b8-IAD
>
> Interestingly, these two cron jobs sometimes show that the BOS server
> is out of date relative to the IAD server. For example, the following
> curls show that one cvd file served by the BOS server is one version
> behind that served by the IAD server at the *same* time. The files'
> "Last-modified" lines are of particular interest. The BOS server says
> the file was last modified on Mon, 26 Nov 2018 at 06:19:22 GMT, while
> the IAD server says the file was last modified on Mon, 26 Nov 2018 at
> 14:15:24 GMT.
>
> In particular, the BOS "Date:" header says it's already about 14 mins
> *later* than the IAD "Last-modified:" timestamp indicates. In other
> words, the file delivered by the BOS server is, at time of *delivery*,
> already about 14 minutes out of date.
>

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

[G.W. Haywood]

Hi there,

On Thu, 22 Nov 2018, Paul Kosinski wrote:

> I wonder how many users of ClamAV actually log their freshclam updates.

I've been using ClamAV for more than a decade. I've already said on
the list that I log all freshclam updates and that in general my
experience is that the mirrors are very reliable. During the switch
to Cloudflare I experienced no problems. There was an issue back in
March/April this year which I believe was the first that ran for more
than a day for as long as I can remember.

Like Mr. Peterson (and *un*like this mailing list's configuration :) I
run freshclam so as to avoid pile-ups. Typically I fetch three updates
per day and they succeed as regularly as clockwork.

On Wed, 21 Nov 2018, Paul Kosinski wrote:

> ... 'LocalIPAddress' is the *outgoing* IP address ...
> .. To sum up, the "LocalIPAddress 10.11.14.160" is ...

I might be a little late to the party here, but are you saying that
10.11.14.160 is the IP address which the Cloudflare servers see? Some
ISPs do issue RFC1918 addresses to their clients but I'd expect a NAT
gateway somewhere between your interface and Cloudflare, so that the
Cloudflare servers see an Internet-routable IP. If there is such a
gateway, maybe it's worth a look on the other side of it. If there
isn't, I'd expect problems because packets from/to RFC1918 addresses
should never be allowed onto the public Internet. Please forgive me
for teaching granny; this *might* be news to some who are reading now.

--

73,
Ged.
_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml