SYMANTEC SECURITY ANALYTICS Solera-freshclamd.service Issue

Products

• Security Analytics

Issue/Introduction

Issue while downloading from database.clamav.net is not being received.

 

Environment

Release: SA 8.0.4

Cause

It looks like an older version of the freshclam client can no longer access the databases.  Clamav themselves seems to block them or Cloudflare or similar.

Resolution

We tested and there were no issues on 8.2.5. Upgrade to the latest version allowed by the centos version and that resolved the issue.

The workaround is this.

Add the latest repository for centos to the box.  Be aware that adding this and then doing any other yum updates could break the box.  It would be best to remove this after. Include removal in the instructions.

Here are the instructions that would need to be done on each sensor's command line.

1)rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

2)yum -y install clamav

3)chown clamscan:clamscan /var/lib/clamav/

4)freshclam -v

this should successfully download. Also, look at the files in /var/lib/clamav that should be updated to the current date

5)yum -y remove epel-release

That is it. But we still recommend upgrading to the latest but as an engineering solution, this should work fine.