LibClamAV Error: cli_loaddbdir(): No supported database files found in /tmp/clamav_defs

[YOGESH NILE]

Lambda throws the error when using clamav lambda.zip

clamscan output:
LibClamAV Error: cli_loaddbdir(): No supported database files found in /tmp/clamav_defs
ERROR: Can't open file or directory
----------- SCAN SUMMARY -----------
Known viruses: 0
Engine version: 0.103.1
Scanned directories: 0
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 0.124 sec (0 m 0 s)
Start Date: 2021:04:09 08:00:31
End Date:   2021:04:09 08:00:32
Unexpected exit code from clamscan: 2.
[ERROR] Exception: Unexpected exit code from clamscan: 2.
Traceback (most recent call last):
  File "/var/task/scan.py", line 236, in lambda_handler
    scan_result, scan_signature = clamav.scan_file(file_path)
  File "/var/task/clamav.py", line 210, in scan_file
    raise Exception(msg)

[David Gilmore]

@yogeshnile Did you ever resolve this? I am facing the same issue, with the updated Dockerfile, I am using the V2.0.0 Branch if that makes any difference

[Daniel Alvarez]

This happens because the one that creates and updates the clamav database is the updater. Until that process runs, the scan will fail.

[David Gilmore]

This happens because the one that creates and updates the clamav database is the updater. Until that process runs, the scan will fail.

Not in my case, I actually tracked this down and fixed it in my own version. The code is ignoring custom prefixes, so if I download my definitions to Key: XYZ and run the updated, the definitions end up there.

But when the scanner runs, and tries to grab the definitions, and the XYZ prefix is set in the Environment, this isn't used in the method, it is passed in, but isn't used.

Took me a while to find it, but got there in the end

[Leonard]

I edited the common.py that was in lambda.zip to use my s3 bucket as default value

AV_DEFINITION_S3_BUCKET = os.getenv("AV_DEFINITION_S3_BUCKET", "my-s3-bucket")

Added a folder named clamav_defs in my-s3-bucket, uploaded main,daily and bytecode cvd/cld to it and tags those file.

tagged with md5: [checksum of the file].