This morning at 4:18 EST, we started getting the following notification every minute from our server, i tried to restart clamd but it fails. It seems to be a issue with the clam honeypot DB i think becuase of the message but not sure how to clear it out or get it to re-download the rule. I rebooted a couple times but it still has the issue & we have not done any updates or anything else to the server since the clam update last week when it came out. It seems to have started when the rules were updated this morning.
OSSEC HIDS Notification.
2011 Jun 22 07:30:11
Received From: xxx-1->/var/log/psa/maillog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):
Jun 22 07:30:10 xxx-1 X-Qmail-Scanner-2.08st: [xxx-1.xxxxxxxxxx.com130874220979828301] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2
Last edited by JnascECSI on Wed Jun 22, 2011 2:53 pm, edited 2 times in total.
James Nascimento Chief Information Officer
East Commerce Solutions, Inc.
22 Morris Lane
East Providence, RI 02914 Ph. 800-527-5395 x263
Fax. 888-999-5891
This also now seems to be affecting customers from sending and receiving mail thru the server now.
James Nascimento Chief Information Officer
East Commerce Solutions, Inc.
22 Morris Lane
East Providence, RI 02914 Ph. 800-527-5395 x263
Fax. 888-999-5891
Well i downloaded the honetpot file and removed the text on line 183974, the line was only partial filled with data which looks like it crapped out some how when it updated and did'nt not complete writing the string.
Once i did that and re-uploaded the file clamd started finally and i also updated the sigs like kalimari recommended and so far seems ok. The only thing is i never noticed that new message now when restarting clam "Starting Clam AntiVirus Daemon: Bytecode: Security mode set to "TrustSigned". " is this something new?
James Nascimento Chief Information Officer
East Commerce Solutions, Inc.
22 Morris Lane
East Providence, RI 02914 Ph. 800-527-5395 x263
Fax. 888-999-5891