ClamAV Protokolle

matze

Hallo,

ich habe seit gestern die Endian Community 2.4.1 als Firewall mit Proxyserver in unser Netz gehängt. Auf dem Dashboard sehe ich, dass ClamAV 108 Viren seitdem gefunden hat. In den Protokollen sehe ich allerdings keine Informationen darüber (Was für ein Virus, Wann, von welchen Client aufgerufen). Kann ich das irgendwo einsehen bzw. muss ich die Protokollierung hierfür gesondert aktivieren?

Über eine Info wäre ich sehr dankbar!

Gruß Matze!

wolfili

Guten Morgen,

bei den Allgemeinen Einstellungen im Bereich ClamAV gibt es keine weiteren Einstellungen mehr?
Ich würde sonnst alternativ mal mit WinSCP nach /var/log/clamav schauen hat es bestimmt da ob dort noch was genaues mit Protokolliert wird.

Wär jetzt mal so ein Ansatz wo ich raten würde, hab keine 2.4.1 vor Ort nur ne 2.2.

gruß Wolfi

matze

Hallo Wolfi,

vielen Dank für deine Antwort. Ich konnte unter den Einstellungen des ClamAV bezüglich der Protokollierung keine Einstellung finden. Es kann natürlich sein, dass ich Tomaten auf den Augen habe. Vielen Dank für den Tipp mit WinSCP. Ich werde da mal nachschauen. Es wäre allerdings ärgerlich, wenn ich das nicht in der Web-Oberfläche nicht einsehen könnte!

*Edit: Ich habe gerade mal nachgeschaut in dem Verzeichnis: /var/log/clamav . Leider konnte ich dort auch keine Information über gefundene Viren finden. Es muss doch irgendwo die Möglichkeit geben Informationen diesbezüglich zu finden?!

Gruß Matze

matze

Hallo,

hat wirklich niemand noch eine Idee / einen Hinweis???? Schade, das wäre wirklich interessant zu wissen, welche Datei geblockt wurde und welche IP-Adresse die Datei angefordert hat!

Gruß Matze

wolfili

Hallo,
wie ist den bei dir die Einstellung bei den Protokollen der Detaillierungsgrad? normal oder hoch?

gruß

ffischer

Hallo,

mal folgendes versuchen.

unter /etc/clamav/clamd.conf die Zeile 1
wichtig ist aber die Datei clamd.conf.tpml mit ab zu ändern sonnst wird es beim neustarten wieder überschrieben

LogFile /var/log/clamav/clamd.log das # davor entfernen

sowie in Zeile 7

das # vor dem LogVerbose yes entfernen danach Proxy einfach neustarten damit startet er auch ClamAV wieder neu.
Jetzt sollte was zu finden sein unter /var/log/clamav/

Code

Feb  7 08:07:29 efw-1297065629 clamd[8630]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:07:29 efw-1297065629 clamd[8630]: Running as user clamav (UID 1000, GID 107)
Feb  7 08:07:29 efw-1297065629 clamd[8630]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:07:29 efw-1297065629 clamd[8630]: Log file size limited to 2097152 bytes.
Feb  7 08:07:29 efw-1297065629 clamd[8630]: Reading databases from /usr/share/clamav
Feb  7 08:07:29 efw-1297065629 clamd[8630]: Not loading PUA signatures.
Feb  7 08:07:29 efw-1297065629 clamd[8630]: Loaded 2 signatures.
Feb  7 08:07:29 efw-1297065629 clamd[8630]: TCP: Bound to address 127.0.0.1 on port 3310
Feb  7 08:07:29 efw-1297065629 clamd[8630]: TCP: Setting connection queue length to 30
Feb  7 08:07:29 efw-1297065629 clamd[8631]: Limits: Global size limit set to 52428800 bytes.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: Limits: File size limit set to 31457280 bytes.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: Limits: Recursion level limit set to 5.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: Limits: Files limit set to 1000.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: Archive support enabled.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: Algorithmic detection enabled.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: Portable Executable support enabled.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: ELF support enabled.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: Detection of broken executables enabled.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: Mail files support enabled.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: Mail: RFC1341 handling enabled.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: OLE2 support enabled.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: PDF support enabled.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: HTML support enabled.
Feb  7 08:07:29 efw-1297065629 clamd[8631]: Heuristic: precedence enabled
Feb  7 08:07:29 efw-1297065629 clamd[8631]: Self checking every 600 seconds.
Feb  7 08:07:42 efw-1297065629 freshclam[8786]: ClamAV update process started at Mon Feb  7 08:07:42 2011
Feb  7 08:08:00 efw-1297065629 freshclam[8786]: Downloading main.cvd [100%]
Feb  7 08:08:05 efw-1297065629 freshclam[8786]: main.cvd updated (version: 53, sigs: 846214, f-level: 53, builder: sven)
Feb  7 08:08:06 efw-1297065629 freshclam[8786]: Downloading daily.cvd [100%]
Feb  7 08:08:06 efw-1297065629 freshclam[8786]: daily.cvd updated (version: 12638, sigs: 35883, f-level: 58, builder: ccordes)
Feb  7 08:08:25 efw-1297065629 freshclam[8786]: Downloading safebrowsing.cvd [100%]
Feb  7 08:08:27 efw-1297065629 freshclam[8786]: safebrowsing.cvd updated (version: 27126, sigs: 563107, f-level: 58, builder: google)
Feb  7 08:08:28 efw-1297065629 freshclam[8786]: Downloading bytecode.cvd [100%]
Feb  7 08:08:28 efw-1297065629 freshclam[8786]: bytecode.cvd updated (version: 123, sigs: 29, f-level: 58, builder: edwin)
Feb  7 08:08:28 efw-1297065629 freshclam[8786]: Database updated (1445233 signatures) from db.local.clamav.net (IP: 130.133.110.67)
Feb  7 08:08:28 efw-1297065629 freshclam[8786]: Clamd successfully notified about the update.
Feb  7 08:08:28 efw-1297065629 clamd[8631]: Reading databases from /usr/share/clamav
Feb  7 08:08:39 efw-1297065629 clamd[8863]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:08:39 efw-1297065629 clamd[8863]: Running as user clamav (UID 1000, GID 107)
Feb  7 08:08:39 efw-1297065629 clamd[8863]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:08:39 efw-1297065629 clamd[8863]: Log file size limited to 2097152 bytes.
Feb  7 08:08:39 efw-1297065629 clamd[8863]: Reading databases from /usr/share/clamav
Feb  7 08:08:39 efw-1297065629 clamd[8863]: Not loading PUA signatures.
Feb  7 08:09:11 efw-1297065629 clamd[8918]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:09:11 efw-1297065629 clamd[8918]: Running as user clamav (UID 1000, GID 107)
Feb  7 08:09:11 efw-1297065629 clamd[8918]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:09:11 efw-1297065629 clamd[8918]: Log file size limited to 2097152 bytes.
Feb  7 08:09:11 efw-1297065629 clamd[8918]: Reading databases from /usr/share/clamav
Feb  7 08:09:11 efw-1297065629 clamd[8918]: Not loading PUA signatures.
Feb  7 08:09:44 efw-1297065629 clamd[8932]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:09:44 efw-1297065629 clamd[8932]: Running as user clamav (UID 1000, GID 107)
Feb  7 08:09:44 efw-1297065629 clamd[8932]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:09:44 efw-1297065629 clamd[8932]: Log file size limited to 2097152 bytes.
Feb  7 08:09:44 efw-1297065629 clamd[8932]: Reading databases from /usr/share/clamav
Feb  7 08:09:44 efw-1297065629 clamd[8932]: Not loading PUA signatures.
Feb  7 08:10:16 efw-1297065629 clamd[9230]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:10:16 efw-1297065629 clamd[9230]: Running as user clamav (UID 1000, GID 107)
Feb  7 08:10:16 efw-1297065629 clamd[9230]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:10:16 efw-1297065629 clamd[9230]: Log file size limited to 2097152 bytes.
Feb  7 08:10:16 efw-1297065629 clamd[9230]: Reading databases from /usr/share/clamav
Feb  7 08:10:16 efw-1297065629 clamd[9230]: Not loading PUA signatures.
Feb  7 08:10:48 efw-1297065629 clamd[9280]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:10:48 efw-1297065629 clamd[9280]: Running as user clamav (UID 1000, GID 107)
Feb  7 08:10:48 efw-1297065629 clamd[9280]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:10:48 efw-1297065629 clamd[9280]: Log file size limited to 2097152 bytes.
Feb  7 08:10:48 efw-1297065629 clamd[9280]: Reading databases from /usr/share/clamav
Feb  7 08:10:48 efw-1297065629 clamd[9280]: Not loading PUA signatures.
Feb  7 08:11:07 efw-1297065629 clamd[9345]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:11:07 efw-1297065629 clamd[9345]: Running as user clamav (UID 1000, GID 107)
Feb  7 08:11:07 efw-1297065629 clamd[9345]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:11:07 efw-1297065629 clamd[9345]: Log file size limited to 2097152 bytes.
Feb  7 08:11:07 efw-1297065629 clamd[9345]: Reading databases from /usr/share/clamav
Feb  7 08:11:07 efw-1297065629 clamd[9345]: Not loading PUA signatures.
Feb  7 08:11:23 efw-1297065629 clamd[9371]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:11:23 efw-1297065629 clamd[9371]: Running as user clamav (UID 1000, GID 107)
Feb  7 08:11:23 efw-1297065629 clamd[9371]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:11:23 efw-1297065629 clamd[9371]: Log file size limited to 2097152 bytes.
Feb  7 08:11:23 efw-1297065629 clamd[9371]: Reading databases from /usr/share/clamav
Feb  7 08:11:23 efw-1297065629 clamd[9371]: Not loading PUA signatures.
Mon Feb  7 08:12:04 2011 -> +++ Started at Mon Feb  7 08:12:04 2011
Mon Feb  7 08:12:04 2011 -> clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:12:04 efw-1297065629 clamd[9440]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Mon Feb  7 08:12:04 2011 -> Running as user clamav (UID 1000, GID 107)
Feb  7 08:12:04 efw-1297065629 clamd[9440]: Running as user clamav (UID 1000, GID 107)
Mon Feb  7 08:12:04 2011 -> WARNING: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:12:04 efw-1297065629 clamd[9440]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Mon Feb  7 08:12:04 2011 -> Log file size limited to 2097152 bytes.
Feb  7 08:12:04 efw-1297065629 clamd[9440]: Log file size limited to 2097152 bytes.
Mon Feb  7 08:12:04 2011 -> Reading databases from /usr/share/clamav
Feb  7 08:12:04 efw-1297065629 clamd[9440]: Reading databases from /usr/share/clamav
Mon Feb  7 08:12:04 2011 -> Not loading PUA signatures.
Feb  7 08:12:04 efw-1297065629 clamd[9440]: Not loading PUA signatures.
Mon Feb  7 08:12:36 2011 -> +++ Started at Mon Feb  7 08:12:36 2011
Mon Feb  7 08:12:36 2011 -> clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:12:36 efw-1297065629 clamd[9533]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Mon Feb  7 08:12:36 2011 -> Running as user clamav (UID 1000, GID 107)
Feb  7 08:12:36 efw-1297065629 clamd[9533]: Running as user clamav (UID 1000, GID 107)
Mon Feb  7 08:12:36 2011 -> WARNING: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:12:36 efw-1297065629 clamd[9533]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Mon Feb  7 08:12:36 2011 -> Log file size limited to 2097152 bytes.
Feb  7 08:12:36 efw-1297065629 clamd[9533]: Log file size limited to 2097152 bytes.
Mon Feb  7 08:12:36 2011 -> Reading databases from /usr/share/clamav
Feb  7 08:12:36 efw-1297065629 clamd[9533]: Reading databases from /usr/share/clamav
Mon Feb  7 08:12:36 2011 -> Not loading PUA signatures.
Feb  7 08:12:36 efw-1297065629 clamd[9533]: Not loading PUA signatures.
Mon Feb  7 08:12:48 2011 -> Loaded 1443964 signatures.
Feb  7 08:12:48 efw-1297065629 clamd[9533]: Loaded 1443964 signatures.
Mon Feb  7 08:12:49 2011 -> TCP: Bound to address 127.0.0.1 on port 3310
Feb  7 08:12:49 efw-1297065629 clamd[9533]: TCP: Bound to address 127.0.0.1 on port 3310
Mon Feb  7 08:12:49 2011 -> TCP: Setting connection queue length to 30
Feb  7 08:12:49 efw-1297065629 clamd[9533]: TCP: Setting connection queue length to 30
Mon Feb  7 08:12:49 2011 -> ERROR: daemonize() failed: Cannot allocate memory
Feb  7 08:12:49 efw-1297065629 clamd[9533]: daemonize() failed: Cannot allocate memory
Mon Feb  7 08:12:49 2011 -> Closing the main socket.
Feb  7 08:12:49 efw-1297065629 clamd[9533]: Closing the main socket.
Feb  7 08:12:59 efw-1297065629 clamd[9654]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:12:59 efw-1297065629 clamd[9654]: Running as user clamav (UID 1000, GID 107)
Feb  7 08:12:59 efw-1297065629 clamd[9654]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:12:59 efw-1297065629 clamd[9654]: Log file size limited to 2097152 bytes.
Feb  7 08:12:59 efw-1297065629 clamd[9654]: Reading databases from /usr/share/clamav
Feb  7 08:12:59 efw-1297065629 clamd[9654]: Not loading PUA signatures.
Feb  7 08:13:11 efw-1297065629 clamd[9719]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:13:11 efw-1297065629 clamd[9719]: Running as user clamav (UID 1000, GID 107)
Feb  7 08:13:11 efw-1297065629 clamd[9719]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:13:11 efw-1297065629 clamd[9719]: Log file size limited to 2097152 bytes.
Feb  7 08:13:11 efw-1297065629 clamd[9719]: Reading databases from /usr/share/clamav
Feb  7 08:13:11 efw-1297065629 clamd[9719]: Not loading PUA signatures.
Feb  7 08:13:18 efw-1297065629 clamd[9747]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:13:18 efw-1297065629 clamd[9747]: Running as user clamav (UID 1000, GID 107)
Feb  7 08:13:18 efw-1297065629 clamd[9747]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:13:18 efw-1297065629 clamd[9747]: Log file size limited to 2097152 bytes.
Feb  7 08:13:18 efw-1297065629 clamd[9747]: Reading databases from /usr/share/clamav
Feb  7 08:13:18 efw-1297065629 clamd[9747]: Not loading PUA signatures.
Feb  7 08:13:27 efw-1297065629 clamd[9747]: Loaded 1443964 signatures.
Feb  7 08:13:27 efw-1297065629 clamd[9747]: TCP: Bound to address 127.0.0.1 on port 3310
Feb  7 08:13:27 efw-1297065629 clamd[9747]: TCP: Setting connection queue length to 30
Feb  7 08:13:27 efw-1297065629 clamd[9747]: daemonize() failed: Cannot allocate memory
Mon Feb  7 08:13:50 2011 -> +++ Started at Mon Feb  7 08:13:50 2011
Mon Feb  7 08:13:50 2011 -> clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:13:50 efw-1297065629 clamd[9768]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Mon Feb  7 08:13:50 2011 -> Running as user clamav (UID 1000, GID 107)
Feb  7 08:13:50 efw-1297065629 clamd[9768]: Running as user clamav (UID 1000, GID 107)
Mon Feb  7 08:13:50 2011 -> WARNING: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:13:50 efw-1297065629 clamd[9768]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Mon Feb  7 08:13:50 2011 -> Log file size limited to 2097152 bytes.
Feb  7 08:13:50 efw-1297065629 clamd[9768]: Log file size limited to 2097152 bytes.
Mon Feb  7 08:13:50 2011 -> Reading databases from /usr/share/clamav
Feb  7 08:13:50 efw-1297065629 clamd[9768]: Reading databases from /usr/share/clamav
Mon Feb  7 08:13:50 2011 -> Not loading PUA signatures.
Feb  7 08:13:50 efw-1297065629 clamd[9768]: Not loading PUA signatures.
Mon Feb  7 08:14:23 2011 -> +++ Started at Mon Feb  7 08:14:23 2011
Mon Feb  7 08:14:23 2011 -> clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Mon Feb  7 08:14:23 2011 -> Running as user clamav (UID 1000, GID 107)
Mon Feb  7 08:14:23 2011 -> WARNING: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Mon Feb  7 08:14:23 2011 -> Log file size limited to 2097152 bytes.
Mon Feb  7 08:14:23 2011 -> Reading databases from /usr/share/clamav
Mon Feb  7 08:14:23 2011 -> Not loading PUA signatures.
Feb  7 08:14:23 efw-1297065629 clamd[9920]: clamd daemon 0.96.3 (OS: linux-gnu, ARCH: i386, CPU: i586)
Feb  7 08:14:23 efw-1297065629 clamd[9920]: Running as user clamav (UID 1000, GID 107)
Feb  7 08:14:23 efw-1297065629 clamd[9920]: Running on 32-bit system, and RLIMIT_DATA > 2GB, lowering to 2GB!
Feb  7 08:14:23 efw-1297065629 clamd[9920]: Log file size limited to 2097152 bytes.
Feb  7 08:14:23 efw-1297065629 clamd[9920]: Reading databases from /usr/share/clamav
Feb  7 08:14:23 efw-1297065629 clamd[9920]: Not loading PUA signatures.
Mon Feb  7 08:14:28 2011 -> Closing the main socket.

Alles anzeigen

gruß

matze

Hallo,

vielen Dank für die Hinweise! Der Datailierungsgrad steht auf "hoch". Der ClamAV protokolliert leider trotzdem nichts! Die # vor den beiden Zeilen in den Konfigurationsdateien habe ich entfernt. Leider hat sich hier auch keine Besserung ergeben (trotz mehrfachen Neustarts der Endian). Im Gegenteil: In den Protokollen ist keine Information über eine geblockte Datei zu finden, dafür spielt das Dashboard jetzt komplett verrückt. Vor meinen Tests Stand im Dashboard unter Virus (Stunde: 0 Heute: 0). Jetzt habe ich Testweise mehrere Viren blocken lassen (die Endian hat die Viren korrekt gefunden und geblockt). Nun steht mal da ( Stunde: 6 Heute: 6 nach aktuliserierung der Dashboards wieder Stunde: 0 Heute: 0 dann mal wieder Stunde: 0 Heute: 3 oder Stunde: 0 Heute: 6 je nachdem wie die Endian gerade Lust hat.) Wie verhält sich hier die Enterprise in Verbindung mit Sophos? Wird hier "sauber" protokolliert?

Gruß Matze!