[SOLVED] Clamav from Source

[linuxdad]

I have spent the weekend working on getting Clamav to compile and Launch from Source code. This has not bee successful, though it was never an issue when I was deployed on Mandriva. Obviously some of my settings are not standard and may be obsolete for Mageia.

When I compile Clamav, here are some of the settings that I use for the application:

Owner - clamav

./configure --prefix=/usr --sysconfdir=/etc

Everything else is pretty much std linux OS. The biggest change is the systemctl which now runs the service scripts.

This is what I am currently seeing:

Code: Select all

[root@ns clamav-0.98]# systemctl status clamd.service
clamd.service - SYSV: clamdis a standard UNIX program that scans for Viruses.
          Loaded: loaded (/etc/rc.d/init.d/clamd)
          Active: failed (Result: exit-code) since Mon, 2013-12-02 10:34:33 EST; 27s ago
         Process: 27288 ExecStart=/etc/rc.d/init.d/clamd start (code=exited, status=1/FAILURE)
          CGroup: name=systemd:/system/clamd.service
                  â 11819 /usr/sbin/clamd

Dec 02 10:34:18 ns.IT-Security-inc.com clamd[27294]: Log file size limited to 10485760 bytes.
Dec 02 10:34:18 ns.IT-Security-inc.com clamd[27294]: Reading databases from /usr/share/clamav
Dec 02 10:34:18 ns.IT-Security-inc.com clamd[27294]: Not loading PUA signatures.
Dec 02 10:34:18 ns.IT-Security-inc.com clamd[27294]: Bytecode: Security mode set to "TrustSigned".
Dec 02 10:34:30 ns.IT-Security-inc.com clamd[27294]: Loaded 2964067 signatures.
Dec 02 10:34:33 ns.IT-Security-inc.com clamd[27288]: Starting clamd: ERROR: LOCAL: Socket file /tm...s.
Dec 02 10:34:33 ns.IT-Security-inc.com clamd[27294]: LOCAL: Socket file /tmpfs/clamd.sock is in us...s.
Dec 02 10:34:33 ns.IT-Security-inc.com clamd[27288]: [FAILED]
Dec 02 10:34:33 ns.IT-Security-inc.com systemd[1]: Failed to start SYSV: clamdis a standard UNIX ...s..
Dec 02 10:34:33 ns.IT-Security-inc.com systemd[1]: Unit clamd.service entered failed state

So, any suggestions as what is going wrong here?

Thank you in advance.

[doktor5000]

I have spent the weekend working on getting Clamav to compile and Launch from Source code.

What for exactly? If you need a newer version, get an src.rpm from Cauldron and rebuild it on your box, that takes only a few minutes.
Next time better ask before wasting so much time

Dec 02 10:34:33 ns.IT-Security-inc.com clamd[27288]: Starting clamd: ERROR: LOCAL: Socket file /tm...s.
Dec 02 10:34:33 ns.IT-Security-inc.com clamd[27294]: LOCAL: Socket file /tmpfs/clamd.sock is in us...s.

Dec 02 10:34:33 ns.IT-Security-inc.com systemd[1]: Failed to start SYSV: clamdis a standard UNIX ...s..

/tmpfs/... ? Looks pretty wrong there, should probably be /tmp/...

Also, please repost the output, but use

Code: Select all

systemctl status clamd.service -a

and use a wider terminal so the journal entries are not truncated.

[linuxdad]

/tmpfs is a Ram Disk, for faster access.

I am using clamav to scan emails, is that the purpose of the clamav.Milter package?

[doktor5000]

/tmpfs - you're aware that /tmp is also normally a tmpfs and you could simply use that? Or just put it to /var/run or /run/lock which are all mounted as tmpfs.

Code: Select all

mount | grep tmpfs
devtmpfs on /dev type devtmpfs (rw,nosuid,size=2002216k,nr_inodes=500554,mode=755)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
tmpfs on /run type tmpfs (rw,nosuid,nodev,mode=755)
tmpfs on /sys/fs/cgroup type tmpfs (rw,nosuid,nodev,noexec,mode=755)
none on /tmp type tmpfs (rw,relatime)

AFAIK clamav.milter is a virus scanner for sendmail.

BTW, in my opinion you could also simply disable that. Will you be affected by the virii? No.
Does clamav have a pretty decent detection rate and will it find all the malware? No and no.
So why bother protecting some windows user with a detection rate of ~50%?

[linuxdad]

No, really, /tmpfs is a true Ram mounted filesystem (ram beats disks hands down):

[/root] df
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 4.0G 356M 3.5G 10% /
/dev/sda8 44G 21G 23G 48% /home
/dev/sda11 13G 3.8G 7.9G 33% /opt
/dev/sda9 3.9G 388M 3.3G 11% /tmp
none 1.0G 516K 1.0G 1% /tmpfs

I will look into clamav.Milter then, Thank you. (I still would like to get the source configured to install).

[doktor5000]

For tmpfs have a look at https://www.kernel.org/doc/Documentatio ... /tmpfs.txt

[linuxdad]

Thank you, I am not questioning the Ram based filesystems, just how to get my source code compiled, installed and configured for Mageia.

[doktor5000]

Well, you opened the other thread for that: viewtopic.php?f=10&t=6442

As mentioned before, if you want a newer version, simply get the src.rpm from Cauldron,
and rebuild it on your box. Here's an example how to do this, pretty easy: viewtopic.php?f=41&t=5530

[linuxdad]

Thank you, this resolves this thread fully. I appreciate your assistance.

Now if I can begin to understand why systemctl, /etc/init.d/{scriptname}, and ./{scriptname} produce different results.

Thank you.

[isadora]

Linuxdad, please be so kind to mark the topic solved.

[doktor5000]

Now if I can begin to understand why systemctl, /etc/init.d/{scriptname}, and ./{scriptname} produce different results.

As mentioned, for the difference "/etc/init.d/{scriptname}, and ./{scriptname}" that could be a bug/oversight, but only triggered rarely as probably nobody does the latter.
And systemctl can only be used for native systemd units, and not directly for legacy SysVinit scripts. Therefore there's still a redirect from service command.