clamdscan error since update to 0.9

Nothing · Unread post by **Nothing** » Tue Apr 10, 2007 9:09 am

Hi,

Since some day, I've a error in my maillog file :
#tail -f /usr/local/psa/var/log/maillog

Apr 10 15:01:52 hostname X-Qmail-Scanner-2.01st: [hostname117621011276323823] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2
Apr 10 15:11:54 hostname qmail: 1176210714.041487 warning: trouble injecting bounce message, will try later

I think it came after clamav update.
I've read http://atomicrocketturtle.com/forum/vie ... php?t=1472 .

But I always have the error. Is there any patch ?

qscand is the user used to execute clamav (definied in clamav.conf).

I've change the owner of some directories :

chown -R qscand.qscand /var/run/clamav/
chown -R qscand.qscand /var/log/clamav/

But none work, I've always get the error in maillog ... Any tips ? (I use FC5)

------
Edit :
------

I've remplaced clamd.conf by clamd.conf.rpmnew .
Chown(ed) again /var/log/clamav/ and /var/run/clamav/ to "clamav" user (and group).
I've run qmail-scanner-reconfigure.

Now clamav start, but error are always here ... strange, no ?

I've run yum update, but it didn't fix it !

----
Here is more infos :
clamd-0.90.1-3.fc5
clamav-db-0.90.1-3
clamav-0.90.1-3.fc

It's correct ?
It's running as clamav user ...

Nothing · Unread post by **Nothing** » Tue Apr 10, 2007 9:54 am

I've just removed clamav clamd & clamav-db from my system.
I've run qmail-scanner-reconfigure.

I have uninstalled clamav to reinstall it.

So I did :
yum install clamd clamav-db clamav
and again qmail-scanner-reconfigure.

Now I always have :

relaylock: /var/qmail/bin/relaylock: mail from IP SMTPSERVER

(I don't have qgreylist installed !!! that's strange !)

And I dont see any :
Apr 10 15:11:54 hostname qmail: 1176210714.041487 warning: trouble injecting bounce message, will try later

But I always have some :

Apr 10 15:01:52 hostname X-Qmail-Scanner-2.01st: [hostname117621011276323823] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2

And a lot of relaylock...
I don't have any new mail ...

That's strange that relaylock is here, because I don't installed it ... (it come with qmail by default ? not qgreylist?).

So ... what should I do ?

Since 5 hour I'm on this problem, I don't find anything to fix it ...

bad day ...

Nothing · Unread post by **Nothing** » Tue Apr 10, 2007 1:11 pm

Maybe it can help, here is my /etc/xinetd.d/smtp_psa :

service smtp
{
socket_type = stream
protocol = tcp
wait = no
disable = no
user = root
instances = UNLIMITED
server = /var/qmail/bin/tcp-env
server_args = /var/qmail/bin/relaylock /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true
}

Maybe I need to remove /var/qmail/bin/relaylock from my "server_args" line ?

Unread post by **scott** » Tue Apr 10, 2007 4:33 pm

is clamd actually running? (ps ax |grep clamd)

Nothing · Unread post by **Nothing** » Wed Apr 11, 2007 1:36 am

scott wrote:is clamd actually running? (ps ax |grep clamd)

yes !
(and errors messages in maillog continues : relaylock and clamd)

can you help me ?
how can I get my mail server back ?
what is relaylock ?

I think you know since I see there was a error some day ago in art rpm's and clamd say's "scanner error or memory/resource/perms problem" ...

breun · Unread post by **breun** » Wed Apr 11, 2007 5:53 am

relaylock is not an error.

Nothing · Unread post by **Nothing** » Wed Apr 11, 2007 7:24 am

breun wrote:relaylock is not an error.

But I don't have any new mail from Internet... what should I do ?

Maybe I don't get a single mail because I have this clamd error ?
I think is that because it came since I've upgraded to 0.9...

breun · Unread post by **breun** » Wed Apr 11, 2007 7:41 am

Nothing wrote:Maybe I don't get a single mail because I have this clamd error ?

I guess so, yes.

Nothing · Unread post by **Nothing** » Wed Apr 11, 2007 8:35 am

breun wrote:
Nothing wrote:Maybe I don't get a single mail because I have this clamd error ?
I guess so, yes.

I've check everything about perms, I think it's correctly configured.
Should I do something to check again ? What ?
Maybe FC5 packages is broken ?
Scott, any tips?

albans · Unread post by **albans** » Fri Apr 13, 2007 5:22 am

Hey, I have exactly the same problem, on a FC5, PSA 8.1.1:
Apr 10 15:01:52 hostname X-Qmail-Scanner-2.01st: [hostname117621011276323823] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2

Note that it worked for some hours, and then gets this error for every mail.

I personnaly turned back to 0.88.7...

huschi · Unread post by **huschi** » Fri Apr 13, 2007 5:50 am

Nothing wrote:Maybe I need to remove /var/qmail/bin/relaylock from my "server_args" line ?

I have the same problem. I removed relaylock for testing. Emails came in and i run a check about being a relayhost, tested all mail-functions and it seems to me it could be ok.
Is anybody able to say, what "relayhost" is for?
I think it's a compiled Perl-Script (like perl2exe) with many SQL-statements in there. It must be more than the relayhost-Scripts i have found with Google.
Has anybody an idea about that script?

huschi.

breun · Unread post by **breun** » Fri Apr 13, 2007 5:58 am

http://www.davideous.com/smtp-poplock/ says:

When anyone connects via SMTP the wrapper program "relaylock" is run before qmail-smtpd. Relaylock compares the accessing IP address with the database of allowed hosts maintained by readlog. If the connecting host is allowed to relay, then the environment variable "RELAYCLIENT" is set which is a flag to qmail-smtpd that this connection is allowed to relay mail. After relaylock has checked with the database and possibly set "RELAYCLIENT" it runs qmail-smtpd which carries on the smtp chat with the accessing user.

For qmail-smtpd to require the "RELAYCLIENT" environment variable before relaying mail, the file control/rcpthosts must exist and have the domain/host names which this server will accept mail for. ( For more information on the qmail-smtpd side of the mechanism see http://qmail-docs.surfdirect.com.au/doc ... relay.html

huschi · Unread post by **huschi** » Fri Apr 13, 2007 7:21 am

I found this thread because Nothing mentioned the file /etc/xinetd.d/smtp_psa. (psa == Plesk)
So i talk about the Plesk-Version of relayhost.
This might be very different from the poplock-relayhost-script.

huschi.

breun · Unread post by **breun** » Fri Apr 13, 2007 7:41 am

We're talking about relaylock, not relayhost, right? I have /var/qmail/bin/relaylock as part of server_args in /etc/xinetd.d/smtp_psa on my CentOS 4 machines (and no problems with ClamAV 0.90.1).

Nothing · Unread post by **Nothing** » Fri Apr 13, 2007 9:13 am

Yep, I'm talking about relaylock ... and clam 0.9 on FC5