Normally, I have two things on every Linux box so that I know whats going on
- NAGIOS monitoring (nrpe)
- Logwatch
Today, I got something in my logwatch email and it was strange because just the other day, I upgraded the clamav to latest version using epel reo.
--------------------- clam-update Begin ------------------------ The ClamAV update process (freshclam daemon) was not running! If you no longer wish to run freshclam, deleting the freshclam.log file will suppress this error message. ---------------------- clam-update End -------------------------
It appears that the latest version has some permission issues on the log file because when I try to run freshclam on command line I get this
root@cpanel [~]# freshclam ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!). ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).
The solution?
The solution is very simple 
just do the following
touch /var/log/clamav/freshclam.log chown clamav /var/log/clamav/freshclam.log chmod 666 /var/log/clamav/freshclam.log
and after that, run freshclam (the service that updates the virus-definition for clamav)
root@cpanel [~]# freshclam
