Squid antivirus - allows to download bad files after 2.4.1 upgrade

chudak

My squid antivirus used to block files downloads from https://www.eicar.org/85-0-Download.html

And I noticed after 2.4.1 upgrade it does not any more.

I don't see any obvious breakages. The only unusual thing on UI status I see "Statistics - Unknown (no log exists)"

Anybody else has seen this?

Any ways to fix/troubleshoot?

Thx

chudak

/var/log/c-icap/server.log shows:

Thu Nov 2 17:48:49 2017, 3681/25273856, squidclamav.c(1709) dconnect: Thu Nov 2 17:48:49 2017, 3681/25273856, ERROR Can't connect to clamd on local socket /var/run/clamav/clamd.sock.
Thu Nov 2 17:48:49 2017, 3681/25273856, squidclamav.c(1844) squidclamav_safebrowsing: Thu Nov 2 17:48:49 2017, 3681/25273856, ERROR Can't connect to Clamd daemon.
Thu Nov 2 17:48:49 2017, 3681/25272576, squidclamav.c(1709) dconnect: Thu Nov 2 17:48:49 2017, 3681/25272576, ERROR Can't connect to clamd on local socket /var/run/clamav/clamd.sock.

what is it? seems bad

chudak

Anybody has seen this ?
https://forum.pfsense.org/index.php?topic=139344.msg761733#msg761733

Thx

kejianshi

Yes - They are going to fuss at you for making two threads for 1 issue. I read it.
I've had squid issues in the past that impacted clam. I'd check it.

Anyway. I'd wait that 1 thread for someone who has solved your issue before.

chudak

@kejianshi:

Yes - They are going to fuss at you for making two threads for 1 issue. I read it.
I've had squid issues in the past that impacted clam. I'd check it.

Anyway. I'd wait that 1 thread for someone who has solved your issue before.

Thx @kejianshi
The reason for two threads is it could be a legit upgrade issue. I just don't know

kejianshi

Do a search on deleting and rebuilding squid cache and restarting squid.

chudak

@kejianshi:

Do a search on deleting and rebuilding squid cache and restarting squid.

tried remove, and reinstall and cleared cache and so far nothing helped

any specifics i am missing ?

kejianshi

Nope - For me every time clam broke it was because squid broke.

ivor

Topics merged, please don't start multiple topics about the same issue.

chudak

@kejianshi:

Do a search on deleting and rebuilding squid cache and restarting squid.

@kejianshi can yo elaborate what steps did you do to celar and rebuild squid cache ?

kejianshi

https://doc.pfsense.org/index.php/Squid_Troubleshooting

Clearing the cache and rebooting is about all I ever had to do.

chudak

@kejianshi:

https://doc.pfsense.org/index.php/Squid_Troubleshooting

Clearing the cache and rebooting is about all I ever had to do.

Thanks buy still no love :(

kejianshi

Have you tied a clean wipe and config reinstall?

chudak

@kejianshi:

Have you tied a clean wipe and config reinstall?

Tried reinstall but with "Keep Settings/Data" enabled

You think it can make a difference ?

kejianshi

It worked fine before?

chudak

@kejianshi:

It worked fine before?

Yes, definitely on pfSense 2.3.4, but I have not pinged pointed when exactly it stopped working, so suspecting maybe 2.4.1 broke it

kejianshi

Install the previous version and restore your config to test if that is true. If it works, it will get attention.

chudak

@kejianshi:

Install the previous version and restore your config to test if that is true. If it works, it will get attention.

the previous version of pfSense?
Oh no, I feel it's too risky.

kejianshi

Its not risky at all so long as you have saved your config.