I've lost it -- sorry for bleating for urgent help. Slight panic, can't remember what to do:

in /etc/clamd.conf and /etc/freshclam.conf the user/database owner is usually "root" when you have asl installed.

These files get created via a template in /var/asl/data/templates/template-freshclam|clamd.conf

For both user an database owner, there's a @@USER@@ placeholder.

Where the heck does that @@USER@@ data come from? On one of my systems, it has become qscand when it should be root, and this is causing problems as the owner of the logs, tmp and so on is going wrong and I'm having lots of problems.

I've had a look in /etc/asl/config but I can't find anything obvious.

It appears to be fine on another system, with everyting owned by root.

Heeeeeelp

Thanks,

Faris.

OK.... this has mysteriously resolved itself. we are back to root after yet another asl -s -f

I'm mystified as to how this happened unless I somehow forgot to asl -s -f after upgrading clamd just now, but even so, that template file usually gets copied accross automatically every 5 minutes or so?

/var/log/clamav contents now owned by root as well (it was qscand as per the incorrectly set user in clamd)

I note that my clamd.conf was not overwritten during the clamd update. So I'm really mystified by all this.

As I recall there are rpm triggers that also would have touched it.