ClamAV Service Not Starting -v2.5-dev (solved)

[NollipfSense]

@Impatient Yes, daily.cvd file is there!

[kiokoman]

it work for me.

try to change regional clamav database update mirror

press update av button and go chech the realtime log for the antivirus

if everything is ok go to status / services and press the start button

[NollipfSense]

@kiokoman Thank you for responding...I did changed to Canada, got the temporary file with what appears have data based on size...see image; yet, Squid's logs show connection failed!

[kiokoman]

change to another country
also check if pfblockerng is blocking it
go with a browser and see if youcan download https://database.clamav.net/main.cvd
i have no problem from here to reach that file so it is there but something is blocking you

[NollipfSense]

@kiokoman I was just able to download the file via the browser as well as had checked DNSbl logs, and no block reported. So, it's some process that is the cause...will try download from command line. Wondered what's the command...getcvd https://database.clamav.net/main.cvd ?

[kiokoman]

the command line to manually update is

freshclam --verbose --show-progress

[NollipfSense]

@kiokoman said in ClamAV Service Not Starting -v2.5-dev:

the command line to manually update is

freshclam --verbose --show-progress

Tried that and got this...see below!

[kiokoman]

you probably have a running process of clamav somehow

try with

killall clamd
rm /var/run/clamav/clamd.pid
freshclam --verbose --show-progress

ignore the error for the second command if the clamd.pid is not present

[NollipfSense]

@kiokoman said in ClamAV Service Not Starting -v2.5-dev:

freshclam --verbose --show-progress

Did as you directed and got the same result...see below! Would coping the file that I downloaded via the browser to both /usr/local/share/clamav-db and /var/db/clamav work! Also, I am running /Var and /Tmp in RAM.

[jdeloach]

@NollipfSense

Could the problem be due to the changes in the logging system that @jimp posted about in this post: https://forum.netgate.com/post/862873, since you show some issues with file logs being locked by another process.

Maybe ClamAV needs some updates since you are using -v2.5-dev?

[kiokoman]

but i'm using 2.5 too without problem
the problem could be -> I am running /Var and /Tmp in RAM.
i can't test this

[NollipfSense]

@jdeloach I had the ClamAV service running before in pfSense v2.5-del without issues until update 2.5-02/03/2020...so, the file system had already incorporated it.

[NollipfSense]

@kiokoman said in ClamAV Service Not Starting -v2.5-dev:

but i'm using 2.5 too without problem
the problem could be -> I am running /Var and /Tmp in RAM.
i can't test this

I saw this from the Squid: https://github.com/pfsense/FreeBSD-ports/commit/38872566f0001d804f33c3985ca28b199c49049c
/* If /var is in RAM, the AV database will not be persistent there and space is
limited, so relocate it. */
if (isset($config['system']['use_mfs_tmpvar'])) {
define('CLAMAV_DBDIR', '/usr/local/share/clamav-db/');
} else {
define('CLAMAV_DBDIR', '/var/db/clamav/');
}

However, those two places are where the file is supposed downloaded to... In my case, both /var and /tmp are in UFS in RAM.

[NollipfSense]

I ended up removing Squid and will give a week or so to reinstall the package...it seems that the database was downloaded but is not written to /var/db/clamav or to /usr/local/share/clamav-db/...so I'll wait.

[NollipfSense]

This was the fix...