Cisco-Talos / clamav

ClamAV - Documentation is here: https://docs.clamav.net
https://www.clamav.net/
GNU General Public License v2.0
4.43k stars 706 forks source link

clamd reports wrong DB version through network connection. #1367

Closed saipriyam03 closed 1 month ago

saipriyam03 commented 2 months ago

Describe bug: clamd reports different DB version when command issued by a network connection.

How to reproduce the issue: clamd report correct DB version when the following command is exected clamd --version

When the version is pulled using network connection, it always reports the DB version when the image got build. nc localhost 3310 VERSION

example: Screenshot 2024-09-16 at 11 13 41

rsundriyal commented 2 months ago

@saipriyam03

As per current logic,

"clamd --version" shows the latest database version available, whereas "nc localhost 3310" shows the database version clamD engine is loaded with.

You can reload the ClamD engine using the "clamdscan --reload" command. Give it a minute to update. Then, it should be in sync.

Let me know if it answers your question.

saipriyam03 commented 1 month ago

The main issue is that the freshclam process gets completed before clamd starts up and fails to notify the current DB version to clamd. The following error is encountered in freshclam logs "WARNING: Clamd was NOT notified: Can't connect to clamd through /tmp/clamd.sock: No such file or directory"

micahsnyder commented 1 month ago

clamd will also check if the database directory has changed on its own every ~10 minutes (default; is configurable). If the files changed, it will reload on its own.

So you don't need to worry too much if freshclam tried to issue the reload command before clamd finished loading. It will eventually reload on its own.

micahsnyder commented 1 month ago

I'm going to close this issue because clamd version reporting is working as intended.