sanesecurity+clamac+freshclam disaster and how to fix

faris · **Joined:** Thu Dec 09, 2004 11:19 am **Posts:** 1846

Something seems to have gone very badly wrong with the sanesecurity updates.

All our servers got 0Kb updates overnight for the sanesecurity sigs.

Unfortunately clamav doesn't like 0Kb files, and would not start. Psmon therefore went nuts and sent out a few 10000 emails to me from each system.

Anyway, if you are affected in a similar way, go to /var/clamav and delete all 0Kb files then restart clamd and all will be well.

We need a way to check the updates aren't 0Kb in future though. We can't have this happening again. I'll raise a case in the upport portal as this is ASL related I guess.

Faris.

faris · **Joined:** Thu Dec 09, 2004 11:19 am **Posts:** 1846

OK, I've just checked and there IS a 0Kb test in the update script:

Code:

  # If file is not 0 size, apply it
  test -s $file     && \
        zcat $file > $new && \
        rm -f $file && \
        clamscan --quiet -d $new - < /dev/null

So something else must have happened....I wonder what?

Faris.

scott · **Posted:** Tue Jan 27, 2009 10:04 am

what version are you running? that one might not have the exception in it

faris · **Joined:** Thu Dec 09, 2004 11:19 am **Posts:** 1846

I'm using the 0.94.2-2.el4.art version

I know there's the 2-3 but I thought it was just the minor bugfix we talked about a couple of days ago so didn't install it.

Faris.

scott · **Posted:** Tue Jan 27, 2009 1:06 pm

That'll teach ya

faris · **Joined:** Thu Dec 09, 2004 11:19 am **Posts:** 1846

Soooo.., what you mean is that the -3 update would have handled things OK, for sure?

Faris.

scott · **Posted:** Tue Jan 27, 2009 4:29 pm

yeah, it has better exception code in it

faris · **Joined:** Thu Dec 09, 2004 11:19 am **Posts:** 1846

We are talking about better exception code in the binary, not in the updater, right? The updater hasn't actually changed as far as I can see.

Faris.

sanesecurity+clamac+freshclam disaster and how to fix

Who is online