search

splunk / twinclams

because twin clams are better than one clam?
BSD 2-Clause "Simplified" License
27 stars 6 forks source link

Failed to load new database: Malformed database #9

Closed kupschke closed 1 year ago

kupschke commented 1 year ago

Hi,

clamav fails loading the twinclams.ldb database:

Fri Sep 1 14:51:26 2023 -> Testing database: '/var/db/clamav/tmp.a5672504bc/clamav-1070400a5698556a9e548e429bac74b0.tmp-twinclams.ldb' ... WARNING: Fri Sep 1 14:51:26 2023 -> Stderr output from database load : WARNING: Fri Sep 1 14:51:26 2023 -> [LibClamAV] Invalid or unsupported ldb signature format [...] ERROR: Fri Sep 1 14:51:26 2023 -> Failed to load new database: Malformed database WARNING: Fri Sep 1 14:51:26 2023 -> Database load exited with "Test failed" ERROR: Fri Sep 1 14:51:26 2023 -> Database test FAILED. Fri Sep 1 14:51:26 2023 -> Unexpected error when attempting to update from custom database URL: https://github.com/splunk/twinclams/blob/master/twinclams.ldb WARNING: Fri Sep 1 14:51:26 2023 -> fc_download_url_databases: fc_download_url_database failed: Test failed (8) ERROR: Fri Sep 1 14:51:26 2023 -> Database update process failed: Test failed ERROR: Fri Sep 1 14:51:26 2023 -> Update failed.

I use clamav 1.0.3 on openbsd 7.3 amd64

wmetcalf commented 1 year ago

I'm pretty sure you are pointing your updater to the github rendering of the file. instead of the raw data.. try this link instead

https://raw.githubusercontent.com/splunk/twinclams/master/twinclams.ldb

kupschke commented 1 year ago

That was exactly the issue! Thank you!