logwatch: File path check failure

chris matthews

• August 16, 2025 07:07

Hi, were getting a lot of "warning file path check failure"  in the daily logwatch emails. These seem to occur after a file ( often in wordpress) has been updated, eg:

--------------------- Clamav Begin ------------------------ 

 Virus database reloaded 1 time(s) (last time with 8707332 viruses)
 
 **Unmatched Entries**
 WARNING: File path check failure for: /home/username/public_html/wp-content/upgrade/woocommerce-10.1.0-it_it/woocommerce-it_IT-d0258ce98e6189fd6bb704d043ce34fc.json

• 

  cPRex Jurassic Moderator

  • August 18, 2025 14:11

  Hey there!  This seems like normal behavior to me - the file path changed while the tool was attempting to do a scan so it gets flagged as potentially suspicious.  

  It's possible that this could perform better if the time of the cron was adjusted:

  https://docs.cpanel.net/whm/plugins/configure-clamav-scanner/#clamav-cron-job

  so you may want to think about changing the cron to a time when there isn't much other server activity happening.

  0
• 

  chris matthews

  • August 18, 2025 14:56

  Thanks for your reply @cPRex  ;)

  Well, its not normal for this server as its not reported this before in the last few years! it started reporting these changes just  few days ago.

  Will change the cron time and see if that fixes it. Thanks!

  0
• 

  cPRex Jurassic Moderator

  • August 18, 2025 14:57

  If that doesn't do the trick I'd recommend submitting a ticket so this can be investigated directly.

  0
• 

  Orient Rail

  • August 30, 2025 05:42

  Those “warning file path check failure” messages usually happen after WordPress (core, plugins, or themes) updates, since files are added/changed. If they line up with known updates, it’s normal and safe to ignore. If they appear randomly, check for unauthorized changes. You can also tweak Logwatch to ignore WordPress dirs if the noise is too much.

  0

Please sign in to leave a comment.