ClamAV update to 0.93 took email down

[rwhirn]

Yesterday my server upgraded ClamAV to 0.93 and ever since then I've been getting the infamous "clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms" error message.

The system had ART 0.92 package running before the update.

Following your advice to a previous user I checked if it was running and it won't start with the following error:

service clamd start
Starting Clam AntiVirus Daemon: ERROR: Parse error at line 300: Unknown option ArchiveMaxCompressionRatio.
ERROR: Can't open/parse the config file /etc/clamd.conf
[FAILED]

[rwhirn]

I removed that option and another:
#ArchiveMaxCompressionRatio 300
#ArchiveBlockMax no

and it started up and the email is flowing again.

Still would like to know what happened/went wrong and how to fix and if this has happened to anyone else?

Now the question is, all the email that was not delivered yesterday, does anyone know where it is?

The server emails to local addresses on the server and even those messages didn't come through. And now that its working again yesterday's messages did not suddenly show up, so I'm guessing the sending SMTP server didn't hold them to retry later? Any ideas where they might have gone?

[franki]

The problem was caused by using old config files
/etc/freshclam.conf
/etc/clamd.conf
/etc/logrotate.d/clamav

After installed the new clamav 0.93, you have to backup the old config files and then rename or modify the new config files as needed.
mv /etc/freshclam.conf.rpmnew /etc/freshclam.conf
mv /etc/clamd.conf.rpmnew /etc/clamd.conf
mv /etc/logrotate.d/clamav.rpmnew /etc/logrotate.d/clamav

[modom46]

Hi,

Is that the same problem and fix that is causing these errors?

Code: Select all

Jun 10 13:59:26 godslove X-Qmail-Scanner-2.02st: [godslove.designhosting.biz12131207667914225] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2 
Jun 10 13:59:26 godslove X-Qmail-Scanner-2.02st: [godslove.designhosting.biz12131207667914232] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2 

I changed the /etc/clamd.conf.rpmnew file to clamd.conf and ran to start clamd and get a permissions problem:

Code: Select all

Starting Clam AntiVirus Daemon: ERROR: Can't open /var/log/clamav/clamd.log in append mode (check permissions!).
ERROR: Problem with internal logger. Please check the permissions on the /var/log/clamav/clamd.log file.
                                                           [FAILED]

I changed the permissions to 777 to get it started but what are the permissions suppose to be for this file?

I had:
-rw-rw-r-- 1 qscand qscand 48173 Jun 10 13:56 clamd.log
when I got the permissions problem.

And get this now:
LibClamAV Warning: *** The virus database is older than 7 days! ***
LibClamAV Warning: *** Please update it as soon as possible. ***

How do I also update the database?

After all this am still getting these errors in the maillog:

Code: Select all

Jun 10 14:27:40 godslove X-Qmail-Scanner-2.02st: [godslove.designhosting.biz121312245979120081] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2 
Jun 10 14:27:40 godslove X-Qmail-Scanner-2.02st: [godslove.designhosting.biz121312246079120089] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2 

[breun]

Check that you have 'DatabaseOwner qscand' in /etc/freshclam.conf (for clamd you need 'User qscand' in /etc/clamd.conf) and that all files in /var/log/clamav are owned by qscand:qscand. You can check if freshclam works by manually running the 'freshclam' command.