#123 Clam-update always show message error

[Nicolas Croiset]

Like it is describe here : https://sourceforge.net/p/logwatch/discussion/1115929/thread/4af80708f6/
Logwatch always show the message No update detected.
I am using clamav 1.4.3
the freshclam.log located at : /var/log/clamav/ is really updated.

An extract of the new log file :
Thu Aug 7 07:50:58 2025 -> securiteinfo.wdb is up-to-date (version: custom database)
Thu Aug 7 08:50:58 2025 -> daily.cld database is up-to-date (version: 27724, sigs: 2076394, f-level: 90, builder: raynman)
Thu Aug 7 08:50:58 2025 -> main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)
Thu Aug 7 08:50:58 2025 -> bytecode.cvd database is up-to-date (version: 336, sigs: 83, f-level: 90, builder: nrandolp)
Thu Aug 7 08:51:00 2025 -> securiteinfo.hdb updated (version: custom database, sigs: 584202)

I attach the current freshclam.log for purpose tests.

[Bjorn]

I am puzzled by the lack of ClamAV update process startedin your freshclam.log, which is the statement that the clam-update service keys off to detect an update. Some questions:

• I assume you are logging through syslog, rather than journalctl?
• Can you try with setting the detail to one or higher? Command is logwatch --service clam-update --detail 1
• I assume that you don't have $Ignore_No_Updatesset in a conf/services/clam-update.conf file (the default is not set).

[Nicolas Croiset]

Yes syslog

With the command : same result

$Ignore_No_Updates : is commented

[Nicolas Croiset]

freshclam is launch as deamon mode :
9124 ? Ss 1:49 /usr/bin/freshclam -d --foreground=true

The log you search is not in freshclam.log but in syslog files :
2025-08-10T01:00:15.821331+02:00 server9 freshclam[9124]: ClamAV update process started at Sun Aug 10 01:00:15 2025

[Nicolas Croiset]

I notice all messages was in syslog file, so I try to use the case C in the message

C. If you are logging using syslog, you need to indicate that your
log file uses the syslog format. For example:
echo "OnlyService = freshclam" >> /etc/logwatch/conf/logfiles/clam-update.conf
echo "RemoveHeaders" >> /etc/logwatch/conf/logfiles/clam-update.conf

But there is one thing wrong in the message, the last line should be:
echo "*RemoveHeaders=" >> /etc/logwatch/conf/logfiles/clam-update.conf

The equal character is missing.

[Bjorn]

I've corrected the RemoveHeaders statement in the repository. With that change, does the clam-update service detect the update correctly? (Since it is being logged via syslog in your case.)

[Nicolas Croiset]

Now I don't have the error message, and I don't have the expected result also...

Logfile Name: clam-update
000-onlyservice = freshclam
001-removeheaders =
001-*applystddate =

Made Temp Dir: /var/cache/logwatch/logwatch.wE27Y7JD with tempdir
export LOGWATCH_DATE_RANGE='yesterday'
export LOGWATCH_GLOBAL_DETAIL='1'
export LOGWATCH_OUTPUT_TYPE='mail'
export LOGWATCH_FORMAT_TYPE='text'
export LOGWATCH_TEMP_DIR='/var/cache/logwatch/logwatch.wE27Y7JD/'
export LOGWATCH_DEBUG='10'

Preprocessing LogFile: syslog
cat '/var/log/syslog' | /usr/bin/perl /usr/share/logwatch/scripts/shared/expandrepeats ''| /usr/bin/perl /usr/share/logwatch/scripts/shared/removeservice 'talkd,telnetd,inetd,nfsd,/sbin/mingetty'| /usr/bin/perl /usr/share/logwatch/scripts/shared/applystddate ''>/var/cache/logwatch/logwatch.wE27Y7JD/syslog

export LOGWATCH_LOGFILE_LIST='/var/log/syslog '
export LOGWATCH_ARCHIVE_LIST='/var/log/syslog.1 /var/log/syslog.2.gz '
Processing Service: clam-update
( cat /var/cache/logwatch/logwatch.wE27Y7JD/syslog | /usr/bin/perl /usr/share/logwatch/scripts/shared/onlyservice 'freshclam' | /usr/bin/perl /usr/share/logwatch/scripts/shared/removeheaders '' | /usr/bin/perl /usr/share/logwatch/scripts/services/clam-update) 2>&1

When I launch it manually with the command logwatch --service clam-update --detail 1
It's OK :

--------------------- clam-update Begin ------------------------

DEBUG: Inside OnlyService for freshclam

TimeFilter: Period is day

TimeFilter: SearchDate is (Aug 21)

TimeFilter: Debug SearchDate is (Aug 21)

Last ClamAV update process started at Thu Aug 21 23:10:27 2025

Last Status:
daily.cld database is up-to-date (version: 27739, sigs: 2076445, f-level: 90, builder: raynman)
main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)
bytecode.cvd database is up-to-date (version: 336, sigs: 83, f-level: 90, builder: nrandolp)
securiteinfo.hdb is up-to-date (version: custom database)
securiteinfo.ign2 is up-to-date (version: custom database)
Testing database: '/var/lib/clamav/tmp.cf25279b05/clamav-d29f6439325bd111c95866693f96c300.tmp-javascript.ndb' ...
Database test passed.
javascript.ndb updated (version: custom database, sigs: 68810)
Testing database: '/var/lib/clamav/tmp.cf25279b05/clamav-b3e55bb36054de1fa372e966f58a2b2d.tmp-spam_marketing.ndb' ...
Database test passed.
spam_marketing.ndb updated (version: custom database, sigs: 18908)
securiteinfohtml.hdb is up-to-date (version: custom database)
securiteinfoascii.hdb is up-to-date (version: custom database)
securiteinfoandroid.hdb is up-to-date (version: custom database)
securiteinfoold.hdb is up-to-date (version: custom database)
securiteinfopdf.hdb is up-to-date (version: custom database)
Testing database: '/var/lib/clamav/tmp.cf25279b05/clamav-9ccce2a9536b557697b8c479d0965728.tmp-securiteinfo0hour.hdb' ...
Database test passed.
securiteinfo0hour.hdb updated (version: custom database, sigs: 1730)
securiteinfo.mdb is up-to-date (version: custom database)
securiteinfo.yara is up-to-date (version: custom database)
securiteinfo.pdb is up-to-date (version: custom database)
securiteinfo.wdb is up-to-date (version: custom database)
Clamd successfully notified about the update.

---------------------- clam-update End -------------------------

But when I launch it via cron.daily (./00logwatch) no output concerning clam-update :(

In the config file I have that parameter
Service = All

[Bjorn]

I've updated the clam-update script to use a service-specific variable clam_update_detail, which can be set in conf/services/clam-update.conf. The script also accepts the --debug option (logwatch --service clam-update --debug 1 --detail 1, for example) to show how the detail level is set.

It appears that when setting the detail to 1 it shows the output you expect.

[Nicolas Croiset]

When I launch manually : logwatch --service clam-update --debug 1 --detail 1

I obtain :
--------------------- clam-update Begin ------------------------

Detail set to 1 from conf/logwatch.conf

Last ClamAV update process started at Tue Aug 26 23:15:29 2025

Last Status:
daily.cld database is up-to-date (version: 27744, sigs: 2076458, f-level: 90, builder: raynman)
main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)
bytecode.cvd database is up-to-date (version: 336, sigs: 83, f-level: 90, builder: nrandolp)

I need to wait tomorrow to check with crontab launch :)

[Nicolas Croiset]

Hi,
my logwach today contains the list of virus detected not the release database :(

--------------------- Clamav Begin ------------------------

Viruses detected:
Sanesecurity.Foxhole.Zip_badexts48.UNOFFICIAL(3bf4419eb32e17251a28c570c018ad49:2300): 1 Time(s)

no clam-update section.

[Bjorn]

That appears to be the clamav service. Does that mean that the clam-update service did not show any output? Have you set $Clam_Update_Detail=1 in /etc/logwatch/conf/services/clam-update? Otherwise, what is the value of Detail in /etc/logwatch/conf/logwatch.conf?

Besides running logwatch --service clam-update, if you want to see what the cron/anacron job outputs, you can run logwatch --output mail. That is the command run by default every day. You can re-run it at any time (not having to wait overnight), as it should still pick up the freshclam log.

[Nicolas Croiset]

in clam-update.conf
It was :
clam_update_detail = 1
I change to :
$clam_update_detail = 1

logwatch.conf :
Detail = Low

with the prefix $, it is now working :)

Thanks !

[Orion Poplawski]

I needed the following in /etc/logwatch/conf/logfiles/clam-update.conf:

*OnlyService = freshclam
*RemoveHeaders
LogFile =
LogFile = syslog
LogFile = syslog.0
Archive =
Archive = syslog.*.gz

to really get it right for Ubuntu 22.04 I think.