Atomicorp

Posted: **Sun Jan 23, 2011 6:24 pm**

For the second time this week a freshclam update hangs clamd. Or at least I think it's freshclam. The last thing I see in clamd.log before the hickup:

Code: Select all

Sun Jan 23 13:01:27 2011 -> SelfCheck: Database modification detected. Forcing reload.
Sun Jan 23 13:01:27 2011 -> Stopping and restarting Clamuko.
Sun Jan 23 13:01:27 2011 -> Clamuko stopped.
Sun Jan 23 13:01:27 2011 -> Reading databases from /var/clamav
Sun Jan 23 13:01:36 2011 -> Database correctly reloaded (1888250 signatures)
Sun Jan 23 13:01:36 2011 -> Clamuko: Correctly registered with Dazuko.
Sun Jan 23 13:01:36 2011 -> Clamuko: Scan-on-open mode activated.
Sun Jan 23 13:01:36 2011 -> Clamuko: Scan-on-close mode activated.
Sun Jan 23 13:01:36 2011 -> Clamuko: Scan-on-exec mode activated.
Sun Jan 23 13:01:36 2011 -> Clamuko: Included path /home
Sun Jan 23 13:01:36 2011 -> Clamuko: Included path /var/tmp
Sun Jan 23 13:01:36 2011 -> Clamuko: Included path /usr/local/psa/tmp
Sun Jan 23 13:01:36 2011 -> Stopping and restarting Clamuko.
Sun Jan 23 13:01:36 2011 -> Clamuko: Included path /tmp
Sun Jan 23 22:59:58 2011 -> +++ Started at Sun Jan 23 22:59:58 2011

The last rows is obviously from when I restart the clamd daemon.

Freshclam tried to update one more time, but when it is unable to reconnect with clamd it stops updating and doesn't retry.

About half an hour after the stop I start to get these in the maillog:

Code: Select all

Jan 23 13:31:57 server7 X-Qmail-Scanner-2.08st: [server7.domain.tld129578471779017838] Requeuing: Maximum time exceeded. Something cannot handle this message. at /var/qmail/bin/qmail-scanner-queue.pl line 673.

I haven't got a clue where to start looking for errors. It is kind of worrisome, because it seems like some of the mail is lost in transition when qmail-scanner is failing to scan it.

From /var/log/messages

Code: Select all

Jan 23 13:01:24 server7 freshclam[17583]: ClamAV update process started at Sun Jan 23 13:01:24 2011
Jan 23 13:01:25 server7 freshclam[17583]: main.cvd is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)

Jan 23 13:01:25 server7 freshclam[17583]: daily.cld is up to date (version: 12560, sigs: 33049, f-level: 58, builder: gu
itar)
Jan 23 13:01:25 server7 freshclam[17583]: Downloading safebrowsing-26793.cdiff [100%]
Jan 23 13:01:27 server7 freshclam[17583]: safebrowsing.cld updated (version: 26793, sigs: 447604, f-level: 58, builder:
google)
Jan 23 13:01:27 server7 freshclam[17583]: bytecode.cld is up to date (version: 122, sigs: 30, f-level: 58, builder: edwi
n)
Jan 23 13:01:27 server7 freshclam[17583]: Database updated (1326897 signatures) from db.se.clamav.net (IP: 192.121.13.5)

Jan 23 13:01:27 server7 clamd[7462]: SelfCheck: Database modification detected. Forcing reload.
Jan 23 13:01:27 server7 clamd[7462]: Stopping and restarting Clamuko.
Jan 23 13:01:27 server7 clamd[7462]: Clamuko stopped.
Jan 23 13:01:28 server7 clamd[7462]: Reading databases from /var/clamav
Jan 23 13:01:36 server7 clamd[7462]: Database correctly reloaded (1888250 signatures)
Jan 23 13:01:36 server7 freshclam[17583]: Clamd successfully notified about the update.
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Correctly registered with Dazuko.
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Scan-on-open mode activated.
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Scan-on-close mode activated.
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Scan-on-exec mode activated.
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Included path /home
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Included path /var/tmp
Jan 23 13:01:36 server7 clamd[7462]: Clamuko: Included path /usr/local/psa/tmp
Jan 23 13:01:36 server7 clamd[7462]: Stopping and restarting Clamuko.

Posted: **Sun Jan 23, 2011 6:26 pm**

Hmm, I might be on to something. I update freshclam hourly. ASL updates hourly. ASL does some pax tests and might restart dazuko (at least the log indicates that.) I think I might move freshclam to every other our and see what is happening...

Posted: **Mon Jan 24, 2011 5:55 am**

What I can say is that I'm not using Dazuko/Clamuko and I don't have these issues. Maybe it helps to trigger it down.

Posted: **Mon Jan 24, 2011 8:38 am**

But Scott and Mike would be so disappointed if I turned it off...

Posted: **Mon Jan 24, 2011 4:10 pm**

For what its worth we run dazuko and qmail-scanner on all our boxes and I can't say I've seen this happen. Are you running the latest of both packages (clamav and qmail*)?

Posted: **Tue Jan 25, 2011 3:35 am**

Yes, I am. And it has been working since dazuko went into production status. It happened the first time about two weeks ago, and again this Sunday. I kinda get the feeling that two restarts/updates of clamd are triggered at the same time, making it crash. But that's just speculation from my side.

Posted: **Tue Jan 25, 2011 10:50 am**

That could be whats doing it, clamd is pretty fussy about being restarted simultaneously and with two freshclam processes running thats probably only compounding if not causing it. The model only expects one update process, so try running with just one.

Posted: **Tue Jan 25, 2011 12:10 pm**

Yeah, that's what I'm trying now. Can the hourly ASL-update trigger a clamd update/restart?

When you run freshclam with cron.hourly it get's executed the same time as the hourly asl script...

Posted: **Tue Jan 25, 2011 1:00 pm**

Yes, if we distribute an update it could cause that. ASL 3.0 changes this around a bit so it sends a reload signal instead of a restart one.

Posted: **Tue Jan 25, 2011 5:38 pm**

Keep in mind though that if you are running multiple copies of freshclam you will run into collisions if two of them try to restart clamd at the same time. Never run one more than one copy.

Posted: **Wed Jan 26, 2011 1:43 am**

Fortunately I'm only running one copy.

Posted: **Wed Jan 26, 2011 6:41 am**

Incidentally, what versions of qmail and clam are you using? And what signature sets for clam?

Posted: **Wed Jan 26, 2011 6:08 pm**

clamd-0.96.5-1.el5.art.i386
qmail-1.03-32.2.el4.art.i386

Cant really find a good list of signature sets. The ones in /var/clamav are:

Code: Select all

ASL-blacklist.ldb
ASL.hdb
ASL-h.ndb
ASL-honeypot.hdb
ASL-honeypot-hex.ndb
ASL.ldb
bytecode.cld
daily.cld
junk.ndb
lott.ndb
MSRBL-Images-FULL-SoN.hdb
MSRBL-SPAM.ndb
phish.ndb
rogue.hdb
safebrowsing.cld
scam.ndb
securiteinfo.hdb
spamimg.hdb
spam.ldb
spear.ndb

Atomicorp

freshclam hangs clamav - no mail delivered!

freshclam hangs clamav - no mail delivered!

Re: freshclam hangs clamav - no mail delivered!

Re: freshclam hangs clamav - no mail delivered!

Re: freshclam hangs clamav - no mail delivered!

Re: freshclam hangs clamav - no mail delivered!

Re: freshclam hangs clamav - no mail delivered!

Re: freshclam hangs clamav - no mail delivered!

Re: freshclam hangs clamav - no mail delivered!

Re: freshclam hangs clamav - no mail delivered!

Re: freshclam hangs clamav - no mail delivered!

Re: freshclam hangs clamav - no mail delivered!

Re: freshclam hangs clamav - no mail delivered!

Re: freshclam hangs clamav - no mail delivered!