freshclam hangs clamav - no mail delivered!

Forum for getting help with Project Gamera, Spamassassin, Clamav, qmail-scanner and other anti-spam tools.
biggles
Forum Regular
Forum Regular
Posts: 806
Joined: Tue Jul 15, 2008 2:38 pm
Location: Sweden
Contact:

freshclam hangs clamav - no mail delivered!

Unread post by biggles »

For the second time this week a freshclam update hangs clamd. Or at least I think it's freshclam. The last thing I see in clamd.log before the hickup:

Code: Select all

Sun Jan 23 13:01:27 2011 -> SelfCheck: Database modification detected. Forcing reload.
Sun Jan 23 13:01:27 2011 -> Stopping and restarting Clamuko.
Sun Jan 23 13:01:27 2011 -> Clamuko stopped.
Sun Jan 23 13:01:27 2011 -> Reading databases from /var/clamav
Sun Jan 23 13:01:36 2011 -> Database correctly reloaded (1888250 signatures)
Sun Jan 23 13:01:36 2011 -> Clamuko: Correctly registered with Dazuko.
Sun Jan 23 13:01:36 2011 -> Clamuko: Scan-on-open mode activated.
Sun Jan 23 13:01:36 2011 -> Clamuko: Scan-on-close mode activated.
Sun Jan 23 13:01:36 2011 -> Clamuko: Scan-on-exec mode activated.
Sun Jan 23 13:01:36 2011 -> Clamuko: Included path /home
Sun Jan 23 13:01:36 2011 -> Clamuko: Included path /var/tmp
Sun Jan 23 13:01:36 2011 -> Clamuko: Included path /usr/local/psa/tmp
Sun Jan 23 13:01:36 2011 -> Stopping and restarting Clamuko.
Sun Jan 23 13:01:36 2011 -> Clamuko: Included path /tmp
Sun Jan 23 22:59:58 2011 -> +++ Started at Sun Jan 23 22:59:58 2011
The last rows is obviously from when I restart the clamd daemon.

Freshclam tried to update one more time, but when it is unable to reconnect with clamd it stops updating and doesn't retry.

About half an hour after the stop I start to get these in the maillog:

Code: Select all

Jan 23 13:31:57 server7 X-Qmail-Scanner-2.08st: [server7.domain.tld129578471779017838] Requeuing: Maximum time exceeded. Something cannot handle this message. at /var/qmail/bin/qmail-scanner-queue.pl line 673.
I haven't got a clue where to start looking for errors. It is kind of worrisome, because it seems like some of the mail is lost in transition when qmail-scanner is failing to scan it.

From /var/log/messages

Code: Select all

Jan 23 13:01:24 server7 freshclam[17583]: ClamAV update process started at Sun Jan 23 13:01:24 2011
Jan 23 13:01:25 server7 freshclam[17583]: main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)

Jan 23 13:01:25 server7 freshclam[17583]: daily.cld is up to date (version: 12560, sigs: 33049, f-level: 58, builder: gu
itar)
Jan 23 13:01:25 server7 freshclam[17583]: Downloading safebrowsing-26793.cdiff [100%]
Jan 23 13:01:27 server7 freshclam[17583]: safebrowsing.cld updated (version: 26793, sigs: 447604, f-level: 58, builder:
google)
Jan 23 13:01:27 server7 freshclam[17583]: bytecode.cld is up to date (version: 122, sigs: 30, f-level: 58, builder: edwi
n)
Jan 23 13:01:27 server7 freshclam[17583]: Database updated (1326897 signatures) from db.se.clamav.net (IP: 192.121.13.5)

Jan 23 13:01:27 server7 clamd[7462]: SelfCheck: Database modification detected. Forcing reload.
Jan 23 13:01:27 server7 clamd[7462]: Stopping and restarting Clamuko.
Jan 23 13:01:27 server7 clamd[7462]: Clamuko stopped.
Jan 23 13:01:28 server7 clamd[7462]: Reading databases from /var/clamav
Jan 23 13:01:36 server7 clamd[7462]: Database correctly reloaded (1888250 signatures)
Jan 23 13:01:36 server7 freshclam[17583]: Clamd successfully notified about the update.
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Correctly registered with Dazuko.
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Scan-on-open mode activated.
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Scan-on-close mode activated.
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Scan-on-exec mode activated.
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Included path /home
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Included path /var/tmp
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Included path /usr/local/psa/tmp
Jan 23 13:01:36 server7 clamd[7462]: Stopping and restarting Clamuko.
biggles
Forum Regular
Forum Regular
Posts: 806
Joined: Tue Jul 15, 2008 2:38 pm
Location: Sweden
Contact:

Re: freshclam hangs clamav - no mail delivered!

Unread post by biggles »

Hmm, I might be on to something. I update freshclam hourly. ASL updates hourly. ASL does some pax tests and might restart dazuko (at least the log indicates that.) I think I might move freshclam to every other our and see what is happening...
BruceLee
Forum Regular
Forum Regular
Posts: 879
Joined: Sat Mar 28, 2009 6:58 pm
Location: Germany

Re: freshclam hangs clamav - no mail delivered!

Unread post by BruceLee »

What I can say is that I'm not using Dazuko/Clamuko and I don't have these issues. Maybe it helps to trigger it down.
biggles
Forum Regular
Forum Regular
Posts: 806
Joined: Tue Jul 15, 2008 2:38 pm
Location: Sweden
Contact:

Re: freshclam hangs clamav - no mail delivered!

Unread post by biggles »

But Scott and Mike would be so disappointed if I turned it off...
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: freshclam hangs clamav - no mail delivered!

Unread post by mikeshinn »

For what its worth we run dazuko and qmail-scanner on all our boxes and I can't say I've seen this happen. Are you running the latest of both packages (clamav and qmail*)?
biggles
Forum Regular
Forum Regular
Posts: 806
Joined: Tue Jul 15, 2008 2:38 pm
Location: Sweden
Contact:

Re: freshclam hangs clamav - no mail delivered!

Unread post by biggles »

Yes, I am. And it has been working since dazuko went into production status. It happened the first time about two weeks ago, and again this Sunday. I kinda get the feeling that two restarts/updates of clamd are triggered at the same time, making it crash. But that's just speculation from my side.
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: freshclam hangs clamav - no mail delivered!

Unread post by mikeshinn »

That could be whats doing it, clamd is pretty fussy about being restarted simultaneously and with two freshclam processes running thats probably only compounding if not causing it. The model only expects one update process, so try running with just one.
biggles
Forum Regular
Forum Regular
Posts: 806
Joined: Tue Jul 15, 2008 2:38 pm
Location: Sweden
Contact:

Re: freshclam hangs clamav - no mail delivered!

Unread post by biggles »

Yeah, that's what I'm trying now. Can the hourly ASL-update trigger a clamd update/restart?

When you run freshclam with cron.hourly it get's executed the same time as the hourly asl script...
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: freshclam hangs clamav - no mail delivered!

Unread post by scott »

Yes, if we distribute an update it could cause that. ASL 3.0 changes this around a bit so it sends a reload signal instead of a restart one.
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: freshclam hangs clamav - no mail delivered!

Unread post by mikeshinn »

Keep in mind though that if you are running multiple copies of freshclam you will run into collisions if two of them try to restart clamd at the same time. Never run one more than one copy.
biggles
Forum Regular
Forum Regular
Posts: 806
Joined: Tue Jul 15, 2008 2:38 pm
Location: Sweden
Contact:

Re: freshclam hangs clamav - no mail delivered!

Unread post by biggles »

Fortunately I'm only running one copy.
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: freshclam hangs clamav - no mail delivered!

Unread post by mikeshinn »

Incidentally, what versions of qmail and clam are you using? And what signature sets for clam?
biggles
Forum Regular
Forum Regular
Posts: 806
Joined: Tue Jul 15, 2008 2:38 pm
Location: Sweden
Contact:

Re: freshclam hangs clamav - no mail delivered!

Unread post by biggles »

clamd-0.96.5-1.el5.art.i386
qmail-1.03-32.2.el4.art.i386

Cant really find a good list of signature sets. The ones in /var/clamav are:

Code: Select all

ASL-blacklist.ldb
ASL.hdb
ASL-h.ndb
ASL-honeypot.hdb
ASL-honeypot-hex.ndb
ASL.ldb
bytecode.cld
daily.cld
junk.ndb
lott.ndb
MSRBL-Images-FULL-SoN.hdb
MSRBL-SPAM.ndb
phish.ndb
rogue.hdb
safebrowsing.cld
scam.ndb
securiteinfo.hdb
spamimg.hdb
spam.ldb
spear.ndb
Post Reply