LibClamAV Warning

[aerogator]

I started seeing this warning in the message on scan results:

"LibClamAV Warning: **************************************************\nLibClamAV Warning: *** The virus database is older than 7 days! ***\nLibClamAV Warning: *** Please update it as soon as possible. ***\nLibClamAV Warning: **************************************************\n"
I re-ran cdk deploy and it updated the Lambda functions, but I continue to see that warning.

Is there another step to update the virus database and get rid of the warning message?

[dontirun]

Hey! What version of the construct are you using?

Additionally has the download_defs lambda function run recently and is it returning any errors?

[aerogator]

According to CloudWatch, it looks like download_defs is running every 12 hours. I'm not seeing any errors in the Log streams for the download_defs lambda.

I picked up version 0.0.105 earlier in the week because I noticed there was a fix for redeploying the lambda functions. Prior to that, I was working with 0.0.43 when I first built the stack.

[dontirun]

When was the most recent update in the Virus Definitions Bucket? Are there any old files with similar names to the new ones?

[aerogator]

I won’t be able to check on that until Monday but I think they were updated recently.

…

On Fri, Oct 1, 2021 at 5:18 PM Arun Donti ***@***.***> wrote: When was the most recent update in the Virus Definitions Bucket? Are there any old files with similar names to the new ones? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#143 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAHHSK2HVWLPFRWXSVOE7CTUEYQRLANCNFSM5FFIPD6A> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[aerogator]

The virus definitions bucket does seem to be updating. Most of the files have today's date, mirrors.dat is the oldest at Sept 29.

daily.cvd cvd October 4, 2021, 03:24:35 (UTC-04:00) 53.7 MB
freshclam.conf conf October 4, 2021, 03:24:35 (UTC-04:00) 75.0 B
freshclam.dat dat October 4, 2021, 03:24:35 (UTC-04:00) 69.0 B
main.cvd cvd October 4, 2021, 03:24:32 (UTC-04:00) 162.6 MB
daily.cld cld October 3, 2021, 15:24:45 (UTC-04:00) 168.6 MB
mirrors.dat dat September 29, 2021, 14:56:38 (UTC-04:00) 69.0 B

[dontirun]

The scan function might not be properly pulling the definitions from S3 and updating the local database on the EFS. I'll need to take a closer look at that

Additionally have there been any manual changes made to the bucket policy?

[aerogator]

I ran a few files through just now, after no files being uploaded since Friday, and I'm not getting the message any more. Not sure what resolved that issue.

What is the difference between this message I was seeing and the “Your ClamAV installation is OUTDATED” message you mention in the README? And would that OUTDATED message appear in the same place that I was seeing this warning?

[dontirun]

Oversimplification, but ClamAV has two parts, the tool and the database

The Your ClamAV installation is OUTDATED” implies that the tool recognized that the database is for a newer version of ClamAV and the tool must be updated.

I believe the "The virus database is older than 7 days!" warning means that the local database is much older than expected (not updated) and that it needs to be updated to check for the latest threats

[dontirun]

Closing as the issue seems to be resolved

[shravanbabuyn]

We are seeing this issue as well. The virus definitions on the bucket are being updated. Is there a way to force update EFS?

LibClamAV Warning: ************************************************** LibClamAV Warning: *** The virus database is older than 7 days! *** LibClamAV Warning: *** Please update it as soon as possible. *** LibClamAV Warning: **************************************************