When Security Analytics (SA) is configured via the GUI to use a web proxy, the ClamAV definition update service 'freshclam' will not use the proxy and cannot reach the Internet.
The following or similar messages may be present in /var/log/messages:
Nov 11 13:18:26 solera1 freshclam: nonblock_connect: connect timing out (30 secs) Nov 11 13:18:26 solera1 freshclam: Can't connect to port 80 of host database.clamav.net (IP: 18.104.22.168) Nov 11 13:18:26 solera1 freshclam: Can't download daily.cvd from database.clamav.net Nov 11 13:18:26 solera1 freshclam: Giving up on database.clamav.net... Nov 11 13:18:26 solera1 freshclam: Update failed. Your network may be down or none of the mirrors listed in /etc/freshclam.conf is working. Check http://www.clamav.net/support/mirror-problem for possible reasons.
The freshclam program is not designed to recognize standard Linux environmental variables used by Security Analytics which define the web proxy.
Further manual configuration is needed for freshclam.
cp /etc/freshclam.conf /etc/freshclam.conf.orig
# Proxy settings # Default: disabled #HTTPProxyServer myproxy.com #HTTPProxyPort 1234 #HTTPProxyUsername myusername #HTTPProxyPassword mypass # If your servers are behind a firewall/proxy which applies User-Agent # filtering you can use this option to force the use of a different # User-Agent header. # Default: clamav/version_number #HTTPUserAgent SomeUserAgentIdString