[root@primary ~]# freshclam
ClamAV update process started at Tue Mar 3 10:23:21 2009
main.cvd is up to date (version: 50, sigs: 500667, f-level: 38, builder: sven)
Trying host db.au.clamav.net (116.240.207.20)...
Downloading daily-9048.cdiff [100%]
Downloading daily-9049.cdiff [100%]
Downloading daily-9050.cdiff [100%]
Downloading daily-9051.cdiff [100%]
Downloading daily-9052.cdiff [100%]
Downloading daily-9053.cdiff [100%]
Downloading daily-9054.cdiff [100%]
Downloading daily-9055.cdiff [100%]
Downloading daily-9056.cdiff [100%]
Downloading daily-9057.cdiff [100%]
Downloading daily-9058.cdiff [100%]
Downloading daily-9059.cdiff [100%]
Downloading daily-9060.cdiff [100%]
Downloading daily-9061.cdiff [100%]
daily.cld updated (version: 9061, sigs: 13945, f-level: 38, builder: arnaud)
Database updated (514612 signatures) from db.au.clamav.net (IP: 116.240.207.20)
Clamd successfully notified about the update.
[root@primary ~]# /etc/init.d/clamd restart
Stopping Clam AntiVirus Daemon: [ OK ]
Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot dlopen: file not found - unrar support unavailable
LibClamAV Error: cli_loadmd5: Problem parsing database at line 52455
LibClamAV Error: Can't load /var/clamav/securiteinfo.hdb: Malformed database
ERROR: Malformed database
[FAILED]

What OS is this and which rpms? That error typically occurs when you are missing libclamunrar_iface.so.

Here's how dlopen works with libclamunrar:
- it looks for libclamunrar_iface.la, if it finds it, it reads it and
learns it must look for libclamunrar_iface.so.6
- if it doesn't, it looks for libclamunrar_iface.so

So if this is an unsupported distrobution, you should either install the .la file, or make sure the .so link is properly created.

Hi Michael,

No it's from atomic-testing, if you look in announcements Scott mentions this error it is normal.

But it won't start. It complains wrong format for securerite.

So I had to delete securerite - now it starts.

So is this normal the securerite is not used?

I hope clamd gets updated and they fix this unrar error.

Should I go back to 0.94 or stick to this?

Somebody didnt read the announcement: viewtopic.php?f=8&t=2877

No

I did I waited to -2 where you say in the changelog the update issue is fixed (freshclam).

But the particular rule is still bad.

freshclam != a repo distributing bad files. There is zero we can do about that

So I better go back to 0.94 until it's resolved. Perhaps you should pull the rpms until it's fixed it's obviously been broken since 0.95 is out as I tried -1 got the same results.

Or can I run without that rule?

What is your advise?

Why would I pull an RPM I am testing... from the testing channel?

Firstly clamav 0.95 I find out is beta and has issues.

So why is it not in bleeding?

I thought testing is releases of so called production candidates.

Read the clamav site it's not ready.

Next the rules (one set are screwed up) not surprising it's beta and therefore the rules maybe no one knows?

So the rpms should be in bleeding not testing and perhaps a warning. Also if you tested it would have found the rule is broken and remains so.

I thought this is what bleeding channel is for so why bother having it?

I too am seeing these issues, I saw your note about not reading the announcement, so I read it, and reading it didnt fix anything :p

if you need any troubleshooting on my end let me know


# rpm -q clamd clamav clamav-db
clamd-0.95-1.el5.art
clamav-0.95-1.el5.art
clamav-db-0.95-1.el5.art

Just delete the securerite file, the unrar/etc errors aren't really anything I have any control over. As I said before, these are upstream issues, theres nothing we can do about it.

I reverted back to the old version

Me too. I suggest everyone stick to 0.94 until 0.95 is officially released.

As it's beta I don't think anyone is QA the updates, so that is a bit scary!

It's been broken from the day 0.95 appeared so don't hold your breath waiting for it to fix, unless you like a deep shade of blue and want to be cold

Wow its almost like thats the point of having a -testing channel or something!

But as I said considering there ARE issues with clamd it should be bleeding not testing.

Testing is meant to be production release put up for final testing before a main stream release, so why bother having a bleeding channel?

Also its just a RC candidate and a 1 at that - no way that resembles a stable release in any shape or form.

I suggest in future any beta or RC builds should be bellding or just delete the bleeding channels and everyone will be very cautious of testing channels