[Nagiosplug-help] check_clamav via nrpe and ClamAV 0.90

[Ugo Bellavance]

Thomas Guyot-Sionnest wrote:
> On 01/03/07 10:50 AM, Ugo Bellavance wrote:
>> Hi,
>>
>>      I don't know if it is related, but since I upgraded ClamAV to 0.90, 
>> I'm getting, via nrpe:
>>
>> ClamAV CRITICAL: daily.cvd  out of date by 2690 revisions.
>>
>> However, on the server itself, I get:
>>
>> [root at server plugins]# ./check_clamav
>> ClamAV OK: daily.cvd 2690 (Thu Mar  1 06:11:27 2007) is up to date.
>>
>> [root at server plugins]# ./check_clamav -v
>> DEBUG: Found clamd at /usr/local/sbin/clamd
>> DEBUG: Threshhold values: warning=1, critical=2
>> DEBUG: Removing extraneous quotes from returned TXT record (dig workaround.)
>> DEBUG: Local daily.cvd dated Thu Mar  1 06:11:27 2007
>> DEBUG: Local daily.cvd version = 2690
>> DEBUG: Latest daily.cvd version = 2690
>> DEBUG: Installed daily.cvd matches latest from clamav.net
>> ClamAV OK: daily.cvd 2690 (Thu Mar  1 06:11:27 2007) is up to date.
>>
>> All my other monitored servers use 0.88.7.
>>
>> Can it be caused by the fact that there is only 1 dot in the version 
>> with 0.90?
>>
>> [root at server plugins]# clamscan -V
>> ClamAV 0.90/2690/Thu Mar  1 06:11:27 2007
>>
>> [root at server2 plugins]# clamscan -V
>> ClamAV 0.88.7/2690/Thu Mar  1 06:11:27 2007
>>
>> To confuse me even more here I just updated another server to 0.90 and I 
>> don't have this problem.
> 
> check_clamav is not part of Nagios-plugins. I found one on
> Nagiosexchange and the match looks correct (doing a split on /\//). You
> should try it or seek help from the author of your check.
> 

I found the problem.  clamscan must be run as root to display 
definitions as of 0.90.x

Ugo