Mailing List Archive: ClamAV: users

Number of signatures not changing in stats report

Index | Next | Previous | View Threaded

cpollock at embarqmail

May 16, 2008, 7:08 PM

Post #1 of 8 (293 views)
Permalink

Number of signatures not changing in stats report

Hopefully that will get someone to read further. I run a script hourly for
an .html formatted output and nightly close to midnight for a text output
report that is sent to me. Since May 11th the number of database signatures
hasn't changed. Looking at the freshclam log I see that the last time there
were 284,345 signatures was in fact May 11th:

Sun May 11 16:17:58 2008 -> Database updated (284345 signatures) from
database.clamav.net (IP: 216.24.174.245)

On the next freshclam run the signature count increased but didn't on the
stats output:

Sun May 11 17:07:40 2008 -> Database updated (284348 signatures) from
database.clamav.net (IP: 194.47.250.218)

I installed ClamAv 0.93 on 19 April so it has been working (the script) since
then. It just seems to be stuck on the number of signatures as of May 11th.

ClamAV Statistics
cpollock

--------------------------------------------------------
clamd last started              Wed May 14 20:37:57 2008
--------------------------------------------------------
Statistics since                19 April 2008
Last Database Update            Thu May 15 23:26:38 2008
--------------------------------------------------------
Total viruses detected          219
Total Database Signatures       284,345

A link to the script I'm running is below:

http://www.thelinkup.com/shared/itp3cmb6hyr5

Thanks for any assistance.

--
Chris
KeyID 0xE372A7DA98E6705C

jimlinux at commspeed

May 16, 2008, 8:16 PM

Post #2 of 8 (280 views)
Permalink

Re: Number of signatures not changing in stats report [In reply to]

Chris wrote:
> Hopefully that will get someone to read further. I run a script hourly for
> an .html formatted output and nightly close to midnight for a text output
> report that is sent to me. Since May 11th the number of database signatures
> hasn't changed. Looking at the freshclam log I see that the last time there
> were 284,345 signatures was in fact May 11th:
>
> Sun May 11 16:17:58 2008 -> Database updated (284345 signatures) from
> database.clamav.net (IP: 216.24.174.245)
>
>
Chris,
Can you post or upload to the linkup the last 100 lines of both the
clamd.log and freshclam.log?
Thanks, Jim
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html

dennispe at inetnw

May 16, 2008, 8:36 PM

Post #3 of 8 (279 views)
Permalink

Re: Number of signatures not changing in stats report [In reply to]

Chris wrote:

> ClamAV Statistics
> cpollock
>
> --------------------------------------------------------
> clamd last started Wed May 14 20:37:57 2008
> --------------------------------------------------------
> Statistics since 19 April 2008
> Last Database Update Thu May 15 23:26:38 2008
> --------------------------------------------------------
> Total viruses detected 219
> Total Database Signatures 284,345
>
> A link to the script I'm running is below:
>
> http://www.thelinkup.com/shared/itp3cmb6hyr5
>
> Thanks for any assistance.

It looks at first glance like your script is not looking for main.cld or
daily.cld files.

dp
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html

cpollock at embarqmail

May 16, 2008, 8:41 PM

Post #4 of 8 (280 views)
Permalink

Re: Number of signatures not changing in stats report [In reply to]

On Friday 16 May 2008 10:16 pm, Jim Preston wrote:
> Chris wrote:
> > Hopefully that will get someone to read further. I run a script hourly
> > for an .html formatted output and nightly close to midnight for a text
> > output report that is sent to me. Since May 11th the number of database
> > signatures hasn't changed. Looking at the freshclam log I see that the
> > last time there were 284,345 signatures was in fact May 11th:
> >
> > Sun May 11 16:17:58 2008 -> Database updated (284345 signatures) from
> > database.clamav.net (IP: 216.24.174.245)
>
> Chris,
> Can you post or upload to the linkup the last 100 lines of both the
> clamd.log and freshclam.log?
> Thanks, Jim

Here is the link for both files:

http://www.thelinkup.com/shared/jma8qko8woy3

--
Chris
KeyID 0xE372A7DA98E6705C

cpollock at embarqmail

May 16, 2008, 8:42 PM

Post #5 of 8 (281 views)
Permalink

Re: Number of signatures not changing in stats report [In reply to]

jimlinux at commspeed

May 16, 2008, 8:52 PM

Post #6 of 8 (281 views)
Permalink

Re: Number of signatures not changing in stats report [In reply to]

Chris wrote:
> On Friday 16 May 2008 10:36 pm, Dennis Peterson wrote:
>
>>
>> It looks at first glance like your script is not looking for main.cld or
>> daily.cld files.
>>
>> dp
>>
>
> Thats odd though that it was working, or seemed to be, from the time I
> installed the new version until May 11.
>
>
Yes, I agree it is odd that it was working and stopped but......the logs
indicate that that freshclam is working correctly AND clamd is being
notified and reloading with the correct number of signatures.

I am not sufficiently proficient in perl to debug the logic in your script.

Jim
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html

dennispe at inetnw

May 16, 2008, 8:57 PM

Post #7 of 8 (280 views)
Permalink

Re: Number of signatures not changing in stats report [In reply to]

Jim Preston wrote:
> Chris wrote:
>> On Friday 16 May 2008 10:36 pm, Dennis Peterson wrote:
>>
>>> It looks at first glance like your script is not looking for main.cld or
>>> daily.cld files.
>>>
>>> dp
>>>
>> Thats odd though that it was working, or seemed to be, from the time I
>> installed the new version until May 11.
>>
>>
> Yes, I agree it is odd that it was working and stopped but......the logs
> indicate that that freshclam is working correctly AND clamd is being
> notified and reloading with the correct number of signatures.
>
> I am not sufficiently proficient in perl to debug the logic in your script.

This part is looing for cvd and inc extensions but not cld. I didn't
look further but my guess is there's some cvdor inc files in the
directory from May 11 and some newer cld files.

if
(/main\.(?:cvd|inc).+\(version:\s(\d+),\ssigs:\s(\d+),/) {
#print "MAIN: $2\n";
$fcmainversion = $1;
$fcmaincount = $2;
}
if
(/daily\.(?:cvd|inc).+\(version:\s(\d+),\ssigs:\s(\d+),/) {
#print "DAILY: $2\n";
$fcdailyversion = $1;
$fcdailycount = $2;
}

dp
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html

cpollock at embarqmail

May 16, 2008, 9:00 PM

Post #8 of 8 (279 views)
Permalink

Re: Number of signatures not changing in stats report [In reply to]

On Friday 16 May 2008 10:36 pm, Dennis Peterson wrote:
> Chris wrote:
> > ClamAV Statistics
> > cpollock
> >
> > --------------------------------------------------------
> > clamd last started Wed May 14 20:37:57 2008
> > --------------------------------------------------------
> > Statistics since 19 April 2008
> > Last Database Update Thu May 15 23:26:38 2008
> > --------------------------------------------------------
> > Total viruses detected 219
> > Total Database Signatures 284,345
> >
> > A link to the script I'm running is below:
> >
> > http://www.thelinkup.com/shared/itp3cmb6hyr5
> >
> > Thanks for any assistance.
>
> It looks at first glance like your script is not looking for main.cld or
> daily.cld files.
>
> dp

I see what you mean, I changed if (/daily\.(?:cvd|inc).+\(version:\s(\d+),
\ssigs:\s(\d+),/) { to (?:cld|inc) and that appeared to fix the problem.

Fri May 16 22:19:03 2008 -> main.cvd is up to date (version: 46, sigs: 231834
Fri May 16 22:19:03 2008 -> daily.cld is up to date (version: 7141, sigs:
57107

Adding the two up makes the number of signatures below correct now.

ClamAV Statistics
cpollock

--------------------------------------------------------
clamd last started              Wed May 14 20:37:57 2008
--------------------------------------------------------
Statistics since                19 April 2008
Last Database Update            Fri May 16 22:19:03 2008
--------------------------------------------------------
Total viruses detected          228
Total Database Signatures       288,941

Hmm, maybe it hadn't been working after all. Thanks for the clue to the fix. I
remember mention of the change in extension but I didn't even think about
looking at the script and making the one letter change.

Thanks again
Chris

--
Chris
KeyID 0xE372A7DA98E6705C

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact lists@gossamer-threads.com