6

If I comment out the UpdateLogFile line from /etc/clamav/freshclam.conf like so...

\#UpdateLogFile /var/log/clamav/freshclam.log

...then I am able to run sudo freshclam no problem:

/etc/clamav$ sudo freshclam ClamAV update process started at Mon Feb 
6 00:17:07 2017 main.cvd is up to date (version: 57, sigs: 4218790,
f-level: 60, builder: amishhammer) daily.cld is up to date (version:
23009, sigs: 1509149, f-level: 63, builder: neo) bytecode.cld is up to
date (version: 290, sigs: 55, f-level: 63, builder: neo)

However, if I uncomment the UpdateLogFile line in freshclam.conf and run sudo freshclam, I get this:

/etc/clamav$ sudo freshclam 
ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).

Here are the permissions on /var/log:

drwxrwxrwx  1 root root     9 Feb  3  2016 log

Here are the permissions on /var/log/clamav:

drwxr-xr-x  2 clamav    clamav    4096 Feb  5 22:18 clamav

And here are the permissions on /var/log/clamav/freshclam.log:

-rw-r-----  1 clamav adm       0 Feb  5 22:18 freshclam.log

I spent all day trying solutions mentioned in various forums with no luck.

Here is the version of Ubuntu server I am running:

Description:    Ubuntu 14.04.5 LTS

And the engine version of clamav:

Engine version: 0.99.2

Could someone help me?

Stopping the clamav-daemon does not help:

/var/log$ sudo /etc/init.d/clamav-daemon stop 

* Stopping ClamAV daemon clamd        
[ OK ]  /var/log$ sudo freshclam
ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check
permissions!). ERROR: Problem with internal logger (UpdateLogFile =
/var/log/clamav/freshclam.log).

The output of sudo lsof | grep clam is nothing:

/var/log$ sudo lsof | grep clam
/var/log$

It appears that nothing has a lock on /var/log/clamav/freshclam.log

Here is the output of sudo service --status-all | grep clamav, not including the lines that had question marks and were unrelated to clamav:

$ sudo service --status-all | grep clamav 
[ - ] clamav-daemon
[ - ] clamav-freshclam
$

Same Can't open /var/log/clamav/freshclam.log in append mode (check permissions!) error when I try to run clamav-daemon:

$ sudo service clamav-daemon start
 * Starting ClamAV daemon clamd
ERROR: Can't open /var/log/clamav/clamav.log in append mode (check permissions!).
ERROR: Can't initialize the internal logger
$

UPDATE: purging and reinstalling clamav, clamav-freshclam and clamav-daemon did not resolve the issue. I still get the same error:

$ sudo freshclam
ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).
$

UPDATE 2: I did a sudo reboot, stopped clamav-freshclam, made sure sudo lsof | grep clam returned nothing and that the output of sudo service --status-all | grep clamav still only had minus symbols next to clamav and clamav-daemon. Ran sudo freshclam again, and same error as above (again).

  • My clam has the same permission with yours and the only thing I see when I try sudo freshclam is the log file is locked by the clamav daemon so I know clamav is working, this append issue with your is what I trying to understand. – George Udosen Feb 6 '17 at 5:51
  • Hi George. When I run sudo lsof | grep /var/log/clamav/clamav.log, I do not see a line for /var/log/clamav/clamav.log, no. Regarding clamav-daemon, it appears to be installed based on the output of apt list --installed | grep clamav: clamav-daemon/trusty-updates,trusty-security,now 0.99.2+addedllvm-0ubuntu0.14.04.1 amd64 [installed] – IcA Feb 6 '17 at 5:52
  • Please show me the result of cat /etc/passwd | grep clamav – George Udosen Feb 10 '17 at 5:10
  • Please do four things: 1) Comment out the line in the /etc/clamav/freshclam.conf, 2) restart your system, 3) run sudo tail -f /var/log/clamav/clamav.log, 4) run sudo tail -f /var/log/clamav/freshclam.log Please paste the results – George Udosen Feb 10 '17 at 5:23
  • Also please post the complete content of the /etc/clamav/freshclam.conf – George Udosen Feb 10 '17 at 5:30
13

sudo freshclam command is used for updating your antivirus database, which cannot be run while another instance (auto update) is already running.

Stop auto uptade process: sudo /etc/init.d/clamav-freshclam stop

Run manual update: sudo freshclam

Re-Start auto update process: sudo /etc/init.d/clamav-freshclam start

source.

| improve this answer | |
  • Hi Sirajus. Thanks for the response; however, running sudo freshclam is clearly not the problem in and of itself, since I can run sudo freshclam just fine as long as the UpdateLogFile line is commented out in /etc/clamav/freshclam.conf. The problem is with writing to /var/log/clamav/freshclam.log. I assume it's a permissions issue, I'm just not sure what the solution is. Your suggestion did not resolve the issue. – IcA Feb 6 '17 at 4:42
  • Hi Sirajus. Please help. – IcA Feb 9 '17 at 1:04
2

I had this issue as well and all that I really needed to do was set permissions on the log file :

chown -R clamav:adm /var/log/clamav/
| improve this answer | |
1

For me, I couldn't find the /var/log/clamav/ directory so I simply created it:

mkdir /var/log/clamav/

and changed ownership:

chown -R clamav:clamav /var/log/clamav/

And it worked!

| improve this answer | |
0

I used the command sudo freshclam and it kept timing out. However, I was able to download the main database

The download file is called main.cvd and is 112.4 Mb. There is a 178.4 Mb file in /var/lib/clamav/daily.cld and it is timestamped with today's date.

It seems I'm up to date anyway?

| improve this answer | |
0

I have looked at this article, and at my own clamav installation and would like to profer a solution.

Like you error message shows it's a permission problem and so try these solutions in sequence, I believe one should work:

Option 1

  1. Checking adm group members and adding $USERNAME to it:

     cat /etc/group | grep ^adm
    
     # Result should be some thing similar to this:
     adm:x:4:syslog,george
    
    • where syslog: generates a log message, which will be distributed by syslogd, and george: user or owner of the system
  2. If members of the adm don't include you or syslod add:

     sudo usermod -a -G adm syslog, and or
     sudo usermod -a -G adm $USERNAME 
    
  3. Restart the system and check if freshclam is working.

Option 2

  1. Change the ownership of these files:

     /var/log/clamav/clamav.log
     /var/log/clamav/freshclam.log
    
     sudo chgrp $USERNAME /var/log/clamav/freshclam.log
     sudo chgrp $USERNAME /var/log/clamav/clamav.log
    
  2. Restart our system and check if freshclam is working

Source(s):

| improve this answer | |
0

I had the same problem. I just changed the updatelogfile line in freshclam.conf to /var/log/clamav.

The freshclam.conf is located in /usr/local/etc/freshclam.conf

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.