Page 1 of 1

clamd failed to start after update --> BUT, this one is really strange...

Posted: 20 Apr 2008, 06:47
by jols
I noticed clamd was dead after the recent update to v0.93.

Then I tried this:

ldconfig
freshclam

Here's what I got:

getfile: Can't write 8192 bytes to /usr/local/share/clamav/clamav-1b9a1cdc8db5b52e7e73f910b4216b82
WARNING: Can't download main.cvd from database.clamav.net
`contrib/init/RedHat/clamd' -> `/etc/init.d/clamd'
Stopping clamd: [FAILED]
Starting clamd: LibClamAV Error: cli_loaddb(): No supported database files found in /usr/local/share/clamav
ERROR: Not supported data format
[FAILED]


Okay, now for the strange part:

Keep in mind, this server has plenty of room on it, at least for this operation:

Filesystem Size Used Avail Use% Mounted on
/dev/hda3 72G 59G 9.7G 86% /
/dev/hda1 99M 19M 76M 20% /boot
none 502M 0 502M 0% /dev/shm
/usr/tmpDSK 485M 36M 425M 8% /tmp
/tmp 485M 36M 425M 8% /var/tmp

-------------------------------------------------

So to resolve this I thought I would try a wget of the main.cvd file from another of our servers to at least get clamd going again. I then did a cd into /usr/local/share/clamav and tried the wget of this file. But the file would only download for a few seconds and then I would get a, "no space left on device" error.

No space left on device??? The main.cvd is only a 12MB file!

Then I found out that I could just cd to /usr/local/share/ then do the wget, then simply mv the main.cvd into /clamav and bingo, I got clamd to restart.

So what is the "no space left on device error" error all about for just and only the /clamav directory? And only when attempting to bring files into this directory from outside the server?

Obviously this is a problem for us because I can not rely on auto-updates of the clamav virus sigs.

By the way, there is actually very little data in the /clamav dir

[/usr/local/share]# du -h clamav
2.0M clamav/daily.inc
27M clamav/main.inc
43M clamav

Any idea what could be going on here? I've never seen anything like this before.

Thanks in advance for any help with this!

Posted: 22 Apr 2008, 04:06
by jols
Anyone have any idea what may be going on with this?