#1 he virus database is older than 7 days!

[Per N]

Hi,

I am probably missing something obvious here... ;)

I've installed ClamAV and php-clamav on two machines but now when I try the third (That is running a slightly older version of Ubuntu) I ran into some troubles. I've compiled clamav & installed it. No problems there.

$ freshclam
ClamAV update process started at Fri Jan 8 09:14:14 2010
main.cld is up to date (version: 51, sigs: 545035, f-level: 42, builder: sven)
daily.cld is up to date (version: 10273, sigs: 144217, f-level: 44, builder: mcichosz)

All up to date!

I've installed php-clamav from the source.. Installing fine, but it does not seem to locate the database properly for some reason on this installation..

The following simple script..
$ cat testClam.php
<?php

echo("ClamAV-engine: " . cl_version() . "\n");

?>

Gives the following output:
$ php testClam.php
LibClamAV Warning: **************************************************
LibClamAV Warning: *** The virus database is older than 7 days! ***
LibClamAV Warning: *** Please update it as soon as possible. ***
LibClamAV Warning: **************************************************
ClamAV-engine: 0.95.3

Installation of clamav points at /var/lib/clamav/ as does php-clamav.
# Extension for php-clamav
extension=clamav.so

[clamav]
clamav.dbpath=/var/lib/clamav

$ ls -l /var/lib/clamav/
total 29380
-rw-r--r-- 1 clamav clamav 8781312 2010-01-08 09:24 daily.cld
-rw-r--r-- 1 clamav clamav 21253696 2010-01-05 08:24 main.cvd
-rw------- 1 clamav clamav 156 2010-01-08 09:24 mirrors.dat

Files in that directory are up to date.

Unsure why the php-call to libclam reports that the engine is outdated.

Help would be appreciated!

[ARGOS]

Hi,

Do you have any entries for freshclam in your cron ?
For php-clamav, do you have enter a correct path in /etc/php5/conf.d/clamav.ini ?

Thanks,

[Per N]

Yes, a few lines.

Or rather, I used to have but right now it's only a few lines in php.ini as it's easier to disabled and can be limited to the CLI version in this case :)

Don't want to put it into the apache-version of the configuration file until I've verified that it works properly. Which is does in the other environments I've configured!

ClamAV itself does not report the virus signature as out of date. It's only the php-lib that does.

[Per N]

[clamav]
clamav.dbpath=/var/lib/clamav

These lines, to be specific. :)

[ARGOS]

Strange.

Normally, php-clamav reload clamav regulary.
In the last php-clamav 0.15.0, all configuration are stored in /etc/php5/conf.d/clamav.ini and not in /etc/php5/cli/php.ini or /etc/php5/apache2/php.ini.
Verify the correct parameter in this configuration file.

[ARGOS]

Please run a freshclam in root, and re-run your php script and report the result.

[Per N]

$ cat /etc/php5/conf.d/clamav.ini
[clamav]
clamav.dbpath=/var/lib/clamav

$ ls /var/lib/clamav/
daily.cld main.cld mirrors.dat

$ sudo freshclam
ClamAV update process started at Mon Feb 8 08:08:10 2010
main.cld is up to date (version: 51, sigs: 545035, f-level: 42, builder: sven)
daily.cld is up to date (version: 10364, sigs: 162848, f-level: 44, builder: guitar)

but..

$ sudo php phpclamav_test.php
LibClamAV Warning: **************************************************
LibClamAV Warning: *** The virus database is older than 7 days! ***
LibClamAV Warning: *** Please update it as soon as possible. ***
LibClamAV Warning: **************************************************
Functions available in the test extension :
cl_info
cl_scanfile
cl_engine
cl_pretcode
cl_version
cl_debug

etc..

[AMI]

Hi,

http://php-clamav.svn.sourceforge.net/viewvc/php-clamav/trunk/clamav.c?revision=18&view=markup

with my limited knowledge of C and PHP, I suspect that the Clamav engine in the module is not reading the correct DB path. look at line 155

cl_load(cl_retdbdir(), dbengine, &sig_num, CL_DB_STDOPT)))

sounds like the DB path comes from return value of cl_retdbdir() rather than reading the ini value.

What do you think?

[ARGOS]

Hi and thanks amiroot,

Amiroot, You are a good approach of this problem.
Please pnew, can you modify cl_retdbdir() entries by this CLAMAV_G(dbpath) and report if your problem is fixed.

bye,

[AMI]

Hi argos66,

1 one more suggestion. sounds like there no default value for the DB path, may I suggest to set it as cl_retdbdir() , which is the default db path of the clamav? Also in line 94 there's a hardcode path, is it better to set it as cl_retdbdir() also?

Rgds,
AMI

[AMI]

Hi,

line 308 and 320 also contain the cl_retdbdir (which is a reload of DB in RINIT). Please kindly change to CLAMAV_G(dbpath) as well.

[Per N]

I will look into this and get back to you as soon as I had the time to do the changes! Cheers, mates :-D

[ARGOS]

amiroot, in the documentation I have this description for the function cl_retdbdir :

cl_retdbdir() returns the default (hardcoded) path to the directory with ClamAV
databases.

But, where is the hardcoded path ?
At the line 94, it's a default value for the php-clamav, if a value isn't present in the /etc/php5/conf.d/clamav.ini this value will be define to default (contained at line 94 to 113).

thanks,

[AMI]

>> At the line 94, it's a default value for the php-clamav, if a value isn't present in the /etc/php5/conf.d/clamav.ini this value will be define to default

Let's of a situation like this:
1. install clamav with DB path located in /var/clamav
2. install php-clamav
3. do NOT setup clamav.dbpath in php.ini
4. restart apache after installing clamav.so

Your apache will fail and you'll get an error message like this:
PHP Warning: cl_load: failed (Can't get file status)\n in Unknown on line 0
PHP Fatal error: Unable to start clamav module in Unknown on line 0 LibClamAV Error: cl_load(): Can't get status of /var/lib/clamav

I suggest to change this value to a varible and let the configure config script to determine it. What do you think?

[ARGOS]

Fixed into release 0.15.2.