ClamAV

[chrisf]

/etc/cron.hourly/simscan_update:

LibClamAV Warning:
 **************************************************
LibClamAV Warning:
*** The virus database is older than 7 days! ***
LibClamAV Warning:
 *** Please update it as soon as possible.
 ***LibClamAV Warning:
**************************************************

I am getting these emailed to me from 6 servers hourly.  Something has failed with clamAV.

[chrisf]

First, there is a new version of clamAV.

ClamAV update process started at Sun Dec 14 10:32:21 2014
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.98.4 Recommended version: 0.98.5

'freshclam' fixed the out of date warnings, but investigating further I realized the problem was with /dev/null.

Whenever the server tried to use /dev/null a Permission Denied error would occur.  Somehow, on ALL my servers the file /dev/null contained characters.

Fixed with:
rm /dev/null; mknod -m 666 /dev/null c 1 3

A reboot would also correct this, but I don't take my servers offline unless absolutely needed.

My question is, what has incorrectly wrote to /dev/null?  If this happened on my entire cluster, I tend to believe it was with kloxoMR somewhere.  One server has NO clients at all, this also happened.

[MRatWork]

Where you information relate to '/dev/null'?.

[chrisf]

It relates because cron send output to /dev/null so no mail is sent, etc.  With /dev/null giving Permission denied whenever trying to run cron, cron was failing as well - freshclam was not updating clamAV.

Now that /dev/null is now fixed, all completes, no errors.  In search for why this happen, it is due to an incorrect handling of /dev/null where it actually writes a file.

Since this happened 7 or 8 days ago, across my entire cluster, as well as on servers with NO clients, i tend to think it was kloxoMR related.  It is only theory.