1

Topic: First time user, clamav log access issues

============ Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.6 MARIADB edition.
- Linux/BSD distribution name and version: Centos 7 (from 1611 DVD version), fully updated, running on Hyper-V.
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MariaDB
- Web server (Apache or Nginx): Apache
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Hello, I'm in the early stages of trying to replace an Exchange server running about 10 small domains with some simpler alternative. I've recently found iRedMail and thought I would to a test install to evaluate it. It's pretty good so far, but one issue I've encountered right off the bat is:

1. Install emitted errors:
   [INFO ] Updating ClamAV database (freshclam), please wait...
ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).
ERROR: Problem with internal logger (UpdateLogFile - /var/log/clamav/freshclam.log).
(above retyped from a screen cap, please excuse minor typos)

2. The install seems to work in spite of the above (it's just the AV logging that's failing, right?), except that I get an email to the postmaster:
From: (Cron Daemon) <root@<myfqdn>>
To: root@<myfqdn>
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).
ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).

FWIW, There is no clamav directory in /var/log, but there is an (empty) freshclam.log directly in /var/log

I followed the instructions for a plain vanilla CentOS install. I can't find anything in the install instructions about ClamAV. Has it been added recently? Or perhaps it's part of some other component, and is documented there?

I have a couple of other questions, but I'll post them separately to keep things simple.

Thanks in advance,
Paul

PS: is there a search function on this board? I tried to search for this issue, but can't see how to.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 (edited by evenmoreconfused 2017-06-20 04:00:56)

Re: First time user, clamav log access issues

Ok, so for the record, here's the progress so far:

As I mentioned, the install did not create the clamav folder in /var/log, and thus freshclam couldn't write to the log file specified in the config. It was giving me repeated error reports by email every three hours, so I did things slowly, one step at a time, to see what actually fixed it. Here's what I did (all as root):

1. Created /var/log/clamav folder  -> no improvement
2. Created short freshclam.log file in above folder -> no improvement
3. Changed permissions on above file to -rw-rw-rw- -> voila, it works on next update run

This is just a test install in a sandbox, so I'm not too worried about opening access to everyone, but ideally I'd like to know who the owner of the file should be, so I can restrict write permission.

I still don't know why the install failed to create clamav's log folder; the configuration details emailed at the end of the install clearly mention it, so something is wrong somewhere...

ClamAV:
    * Configuration files:
        - /etc/clamd.d/amavisd.conf
        - /etc/freshclam.conf
        - /etc/logrotate.d/clamav
    * RC scripts:
            + /etc/init.d/clamd@amavisd
            + /etc/init.d/freshclamd
    * Log files:
        - /var/log/clamav/clamd.log
        - /var/log/clamav/freshclam.log

PS: the above implies that I should be seeing clamd.log there too, I'll try a similar process for that one too.

PPS: found the forum search (I must be blind), and found a similar thread in which it is claimed that the folder will be created on the next service or machine restart, but in my case I tried that several times without the folder being created.

3

Re: First time user, clamav log access issues

Hypothesis: the clamav folder is normally created the first time an external message arrives, and the virus scanner gets invoked (I haven't tried sending the thing any messages yet, pending resolution of this issue).

Does this sound plausible?

4

Re: First time user, clamav log access issues

This is a known issue and fixed in latest development edition. Please comment out parameters "LogFile" and "UpdateLogFile" in /etc/clamd.conf and /etc/freshclam.conf to fix it.