ClamWin Free Antivirus :: View topic - I am having to delete mirrors.dat many times a day...

Posted: Fri Jul 01, 2011 9:33 am

The hourly updates fail. None of the mirrors appear to be reliably up, working or synchronised. So the mirrors.dat file is deleted (as suggested in the help notes). The subsequent reload works perfectly. Next hourly update... same all over again. What *IS* the point of supplying mirror targets that are not working!? Sort of defeats the objective all round;-/

I have read the help notes stuff referred in the failure report. The dig and host commands suggested return cogent information. My network is not down. My DNS is working andt the reload following the deletion of mirrors.dat works normally and effectively. But leaving ClamWin to update itself reliably for more than an hour or few seems somewhat improbable at the moment.

My server runs ClamAV unattended. I cannot remember the YEAR when I last had to resort to any troubleshooting! Whereas for ClamWin on my workstation I can't remember the last DAY when I didn't have to babysit it and find a remedy to keep it running.

Please advise.

------------------- recently -----------------------
ClamAV update process started at Fri Jul 01 10:33:27 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getfile: daily-13258.cdiff not found on remote server (IP: 163.1.3.8)
WARNING: getpatch: Can't download daily-13258.cdiff from database.clamav.net
WARNING: getfile: daily-13258.cdiff not found on remote server (IP: 81.91.100.173)
WARNING: getpatch: Can't download daily-13258.cdiff from database.clamav.net
WARNING: getfile: daily-13258.cdiff not found on remote server (IP: 193.1.193.64)
WARNING: getpatch: Can't download daily-13258.cdiff from database.clamav.net
Downloading daily.cvd [100%]
Downloading daily.cvd [100%]
WARNING: Mirror 217.135.32.99 is not synchronized.
Trying again in 5 secs...
ClamAV update process started at Fri Jul 01 10:33:37 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getfile: daily-13258.cdiff not found on remote server (IP: 81.91.100.173)
WARNING: getpatch: Can't download daily-13258.cdiff from database.clamav.net
WARNING: getfile: daily-13258.cdiff not found on remote server (IP: 163.1.3.8)
WARNING: getpatch: Can't download daily-13258.cdiff from database.clamav.net
WARNING: getfile: daily-13258.cdiff not found on remote server (IP: 193.1.193.64)
WARNING: getpatch: Can't download daily-13258.cdiff from database.clamav.net
DownloaDownloading daDownloading daily.cvd [100%]
Downloading daily.cvd [100%]
WARNING: Mirror 163.1.3.8 is not synchronized.
Trying again in 5 secs...
ClamAV update process started at Fri Jul 01 10:33:43 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getfile: daily-13258.cdiff not found on remote server (IP: 217.135.32.99)
WARNING: getpatch: Can't download daily-13258.cdiff from database.clamav.net
WARNING: getfile: daily-13258.cdiff not found on remote server (IP: 81.91.100.173)
WARNING: getpatch: Can't download daily-13258.cdiff from database.clamav.net
WARNING: getfile: daily-13258.cdiff not found on remote server (IP: 193.1.193.64)
DownloaDownloading daDownloading daily.cvd [100%]
Downloading daily.cvd [100%]
WARNING: Mirror 81.91.100.173 is not synchronized.
Giving up on database.clamav.net...
Update failed. Your network may be down or none of the mirrors listed in c:\users\robert\appdata\local\temp\tmpurj5hc is working. Check https://www.clamav.net/support/mirror-problem for possible reasons.

--------------------------------------
Completed
--------------------------------------

Posted: Fri Jul 01, 2011 10:49 pm

I suspect you have some (transparent) proxy around that gives your client the old cvd files, I doubt all of these mirrors are broken
are you sure you have a direct internet connection?

Posted: Sat Jul 02, 2011 10:37 am

sherpya wrote:

I suspect you have some (transparent) proxy around that gives your client the old cvd files, I doubt all of these mirrors are broken
are you sure you have a direct internet connection?

My server uses a trouble-free utterly faultless transparent
proxy which has been in use for over a decade without issue.

I never actually stipulated that I had a direct internet connection.
It is somewhat difficult to actually define a 'direct' connection...
The router in connected to my server and my workstation is
connected to an unmanaged gigabit ethernet switched intranet.
There has never been a problem with that configuration.

Why does your updater ask for old files?
Why doesn't your updater ask for refreshed new files?

Co-incidently since filing this forum trouble report the
hourly updates have successfully managed to update
themselves without manual intervention. Nothing else
has been manually changed (so much nowadays is
automatically updated in the background). Reading
the forum elsewhere I installed Clam Sentinel
...as an experiment.

Posted: Sat Jul 02, 2011 11:40 am

There were not many signatures done at Clam earlier this week. Christoph Cordes, the primary sigmaker was off duty then, so there were none available for downloading then. He has been back for a day or so now.

Regards,

Posted: Sat Jul 02, 2011 11:42 am

So the issue was stale sources rather than a bug?

Posted: Sat Jul 02, 2011 1:00 pm

It could be--there was nothing to update. There will probably not be much signature activity this weekend either. I will do a few sigs late in the day (U. S. Central time).

Regards,

Posted: Sat Jul 02, 2011 1:17 pm

Noted.

Wishlist item:
ClamWin should not issue an update alarm
during periods of signature update inactivity.

Posted: Sun Jul 03, 2011 1:42 am

There was a signature update 13262 earlier today. I just did 13263, which should be posted some time after 9 pm USA central daylight time.

If you have these updates, then you are current. The ClamWin updater does not download old signature files--only new (incremental) files. In my stand-alone environment, if there are no new signatures, the updater churns a bit and then says the main, daily, and bytecode databases are up-to-date, and it quits.

Regards,

Posted: Sun Jul 03, 2011 1:50 am

I am not current. ClamWin has resumed failing to update.
Part of its log:
--------------------------------------
ClamAV update process started at Sat Jul 02 19:49:00 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
daily.cld is up to date (version: 13261, sigs: 131335, f-level: 60, builder: guitar)
bytecode.cvd is up to date (version: 143, sigs: 40, f-level: 60, builder: edwin)
--------------------------------------
ClamAV update process started at Sat Jul 02 20:49:00 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getfile: Unknown response from remote server (IP: 193.1.193.64)
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getfile: Unknown response from remote server (IP: 217.135.32.99)
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getfile: Unknown response from remote server (IP: 81.91.100.173)
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
WARNING: getfile: Unknown response from remote server (IP: 163.1.3.8)
WARNING: Can't download daily.cvd from database.clamav.net
Trying again in 5 secs...
ClamAV update process started at Sat Jul 02 20:49:07 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
WARNING: Can't download daily.cvd from database.clamav.net
Trying again in 5 secs...
ClamAV update process started at Sat Jul 02 20:49:12 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
ERROR: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
ERROR: Can't download daily.cvd from database.clamav.net
Giving up on database.clamav.net...
Update failed. Your network may be down or none of the mirrors listed in c:\users\robert\appdata\local\temp\tmpj3shp4 is working. Check https://www.clamav.net/support/mirror-problem for possible reasons.
--------------------------------------
ClamAV update process started at Sat Jul 02 20:54:13 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
WARNING: Can't download daily.cvd from database.clamav.net
Trying again in 5 secs...
ClamAV update process started at Sat Jul 02 20:54:18 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
WARNING: Can't download daily.cvd from database.clamav.net
Trying again in 5 secs...
ClamAV update process started at Sat Jul 02 20:54:23 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
ERROR: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
ERROR: Can't download daily.cvd from database.clamav.net
Giving up on database.clamav.net...
Update failed. Your network may be down or none of the mirrors listed in c:\users\robert\appdata\local\temp\tmpsz0cbv is working. Check https://www.clamav.net/support/mirror-problem for possible reasons.
--------------------------------------

considerable snipping ...last entry:
--------------------------------------
ClamAV update process started at Sun Jul 03 02:59:24 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
WARNING: Can't download daily.cvd from database.clamav.net
Trying again in 5 secs...
ClamAV update process started at Sun Jul 03 02:59:30 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
WARNING: Can't download daily.cvd from database.clamav.net
Trying again in 5 secs...
ClamAV update process started at Sun Jul 03 02:59:35 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13262.cdiff from database.clamav.net
ERROR: getpatch: Can't download daily-13262.cdiff from database.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
ERROR: Can't download daily.cvd from database.clamav.net
Giving up on database.clamav.net...
Update failed. Your network may be down or none of the mirrors listed in c:\users\robert\appdata\local\temp\tmpayxve4 is working. Check https://www.clamav.net/support/mirror-problem for possible reasons.

It's 0306hrs local.
Been a very long day.
g'Night.

Posted: Sun Jul 03, 2011 1:53 am

Deleted mirrors.dat (as per now usual)
Log:
ClamAV update process started at Sun Jul 03 03:08:28 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
Downloading daily-13262.cdiff [100%]
Downloading daily-13262.cdiff [100%]
daily.cld updated (version: 13262, sigs: 131889, f-level: 60, builder: ccordes)
bytecode.cvd is up to date (version: 143, sigs: 40, f-level: 60, builder: edwin)
Database updated (978143 signatures) from database.clamav.net (IP: 217.135.32.99)

--------------------------------------
Completed
--------------------------------------

...something somewhere needs fixing either
at my end or at your end but it needs fixing.
I have to crash now.
Out.

Posted: Sun Jul 03, 2011 2:47 am

Here is my update log after downloading the latest signature update. Everything is normal.

ClamAV update process started at Sat Jul 02 21:59:56 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getfile: Error while reading database from database.clamav.net (IP: 88.198.67.125): Connection reset by peer
WARNING: getpatch: Can't download daily-13263.cdiff from database.clamav.net
Downloading daily-13263.cdiff [100%]
Downloading daily-13263.cdiff [100%]
daily.cld updated (version: 13263, sigs: 131894, f-level: 60, builder: guitar)
bytecode.cld is up to date (version: 143, sigs: 40, f-level: 60, builder: edwin)
Database updated (978148 signatures) from database.clamav.net (IP: 88.198.67.125)

--------------------------------------
Completed

Regards,

Posted: Sun Jul 03, 2011 11:58 am

Shortly after power up (after dealing with 700+ exploit attempts):
ClamAV update process started at Sun Jul 03 13:13:15 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getpatch: Can't download daily-13263.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13263.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13263.cdiff from database.clamav.net
WARNING: Can't download daily.cvd from database.clamav.net
Trying again in 5 secs...
ClamAV update process started at Sun Jul 03 13:13:20 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getpatch: Can't download daily-13263.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13263.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13263.cdiff from database.clamav.net
WARNING: Can't download daily.cvd from database.clamav.net
Trying again in 5 secs...
ClamAV update process started at Sun Jul 03 13:13:25 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
WARNING: getpatch: Can't download daily-13263.cdiff from database.clamav.net
WARNING: getpatch: Can't download daily-13263.cdiff from database.clamav.net
ERROR: Can't download daily.cvd from database.clamav.net
Giving up on database.clamav.net...
Update failed. Your network may be down or none of the mirrors listed in c:\users\robert\appdata\local\temp\tmp6a8zui is working. Check https://www.clamav.net/support/mirror-problem for possible reasons.

--------------------------------------
Completed
--------------------------------------

Why does ClamWin give me so much trouble now?

Posted: Sun Jul 03, 2011 12:00 pm

Immediately afterwards delete mirrors.dat:

ClamAV update process started at Sun Jul 03 13:16:16 2011
main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
Downloading daily-13263.cdiff [100%]
Downloading daily-13263.cdiff [100%]
daily.cld updated (version: 13263, sigs: 131894, f-level: 60, builder: guitar)
bytecode.cvd is up to date (version: 143, sigs: 40, f-level: 60, builder: edwin)
Database updated (978148 signatures) from database.clamav.net (IP: 217.135.32.99)

--------------------------------------
Completed
--------------------------------------

Posted: Sun Jul 03, 2011 6:36 pm

It looks okay except for having to delete mirrors. Have you been using ClamWin sinc 2006 without any problems? Maybe you recently changed your system configuration and that is responsible.

Regards,

Posted: Sun Jul 03, 2011 6:45 pm

Been the recent past... month or two that has been problematic.
System configuration changes? That's quite a question GuitarBob!
Co-incidently I was sleuthing around and noticed the logging for
the router made no sense. Found its NTP source seems to no
longer exist. The router's OS was showing 'currently' as being
February. The uptime showed as 45days. Have now given it a
more valid timing lookup source and it is now in sync.
ClamWin is (currently) performing hourly periodic updating...
will advise if or when it begins mis-behaving. Have you
come across a network timing issue to affect ClamWin?