Problems aftre today's yum upgrade

[jujuthing]

Hi Scott,
I'm having some trouble with av and spam filter since today's update:
05/31/05 09:03:09 Updated: php-mbstring 4.3.11-8.rhfc2.art.i386
05/31/05 09:03:09 Updated: php 4.3.11-8.rhfc2.art.i386
05/31/05 09:03:09 Updated: php-mysql 4.3.11-8.rhfc2.art.i386
05/31/05 09:03:09 Updated: php-pear 4.3.11-8.rhfc2.art.i386
05/31/05 09:03:09 Updated: php-pgsql 4.3.11-8.rhfc2.art.i386
05/31/05 09:03:09 Updated: php-snmp 4.3.11-8.rhfc2.art.i386
05/31/05 09:03:09 Updated: clamav-db 0.85.1-1.rf.rhfc2.art.i386
05/31/05 09:03:09 Updated: php-imap 4.3.11-8.rhfc2.art.i386
05/31/05 09:03:09 Updated: dcc 1.3.5-1.rhfc2.art.i386
05/31/05 09:03:09 Updated: rkhunter 1.2.7-1.rhfc2.art.noarch
05/31/05 09:03:09 Updated: daemontools 0.76-1.rhfc2.art.i386
05/31/05 09:03:09 Updated: qmail-scanner 1:1.25-7.rhfc2.art.noarch
05/31/05 09:03:09 Updated: maildrop 1.8.1-1.rhfc2.art.i386

I'm running an FC2 box with Plesk 7.5.2 and when i ran yum update this morning i first had a conflict between drweb and qmail-scanner. as i don't use drweb i did yum remove drweb und then yum update
However since then my av and spam filter are not working. the services clamav and spamd are up, but both eicar and gtube fail (i.e. i can receive them unmodified).
qmail-queue.log has remained untouched since the update and clamd.log shows an error Can't unlink the pid file /var/run/clamav/clamd.pid

do i need drweb for this to work or did i miss something else here?
hints appreciated...
cheers
simon

[jamster]

I saw this on my system:

http://www.atomicrocketturtle.com/forum ... .php?t=367

The symptoms were the same, after today's update antivirus wasn't working until I'd installed that Perl package, rerun the qmail-scanner configuration script and restarted qmail.

[scott]

were going to be going through some growing pains as I bring ART into compliance with rpmforge.net for a while. Ive got a lot of other associated documentation to update as well. I'm adopting their packages when they exist, and sometimes they're using a very different package layout than I am. clamav is one of the bigger ones, you'll need to remove my older package completely, before installing clamd (thats the package name now, dont ask me, they named it that way not me ).

that conflict on dr. web is the real deal, they had to use the same magic to get their virus scanner to work with PSA that I did, which only works once therefore you need to remove it to get q-s and clamav in there.

[jamster]

Cheers scott, figured out the clamav thing in the end.

[jujuthing]

thanks for the pointer! did the trick: i removed q-s,spammassassin and clamav then reinstalled q-s and spamassassin with clamd. i also upgraded razoragents, now everything is working as before. with one noticable difference server load is down. perhaps uninstalling drweb wasn't such a bad idea
cheers
simon

[scott]

I added dcc and pyzor as well

[jujuthing]

damn! i was a bit too early there: spamassassin is working again, but clamav isn't. seems my smtp was filtering out the eicar test, so i thought i was back in business. i'm hitting myself over the head with my windows for workgroups 3.1 manual now!
the eicar test is still slipping through, even though the mail header claims it was scanned by clamav:
(clamdscan: 0.85.1/880. spamassassin: 3.0.3. perlscan: 1.25st.
Clear:RC:0(213.200.236.:SA:0(-1.3/5.0):.
anything else i can try here?
cheers
simon

[jujuthing]

damn! i was a bit too early there: spamassassin is working again, but clamav isn't. seems my smtp was filtering out the eicar test, so i thought i was back in business. i'm hitting myself over the head with my windows for workgroups 3.1 manual now!
the eicar test is still slipping through, even though the mail header claims it was scanned by clamav:
(clamdscan: 0.85.1/880. spamassassin: 3.0.3. perlscan: 1.25st.
Clear:RC:0(213.200.236.:SA:0(-1.3/5.0):.
anything else i can try here?
cheers
simon

[phatPhrog]

I added dcc and pyzor as well

Since running yum upgrade (06/01) I now have multiple instances of

Code: Select all

qmailq dccproc <defunct>

I've done everything but restart the server.

What can I do to correct this?

Thanks.

[scott]

For future reference, always post the basic information about your system when you're reporting a problem. Operating system, version of PSA, version of package(s) with the problem, and any other changes you made at the time.

That being said, Ive never seen dcc do that, so I'd look on the dcc, spamassassin, or qmail-scanner lists.

[phatPhrog]

Sorry. Since you work on our server, I just figured the messages would be sufficient.

Will post server info on any future message.

[scott]

I work on a lot of them, 20-30 a day!

[phatPhrog]

It seems razor may be causing the problem.

How do I roll back the razor install verify?

FC1/Plesk 7.04, php.4.3.11-6, mysql 4.0.24-4

All updates are from ART.

Les

[scott]

razor and dcc are pretty different packages that dont really touch each other. I dont see how one could interfere with the other (dcc is a C binary, and razor is a perl).

[phatPhrog]

The problem started only after the yum upgrade on 06/01 which only upgraded razor.

That's all I know.

There was never any dccproc error.

As a matter-a-fact according to rpm -q

dccproc isn't even installed on our server....nor is qmail....nor is any ART installed app.

Don't know what to say. Ran everything possible to try to figure it out, but can't figure it yet.

Thanks anyway.