ot: clamd monitor/restarter

whilst in the past clamd has proven extremely reliable, in
the last few
weeks I had clamd die maube on 3 ocassions for some reason
(perhaps
related to the additional third party  signature downloads
getting
corrupted?);

so I was thinking of some sort of deamon monitor, if it dies
to restart
it, any suggestions ?


-- 
Voytek


------------------------------------------------------------
-------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and
a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

I used a cronjob to check it.

Although I'm sure there must be something out there to do
this for you

------------------8<-----------------------
#!/bin/bash
#
# Monitor service, try to restart, mail if can't and then
mail again every
10 runs.
#

. $HOME/conf/config.txt

# Daemon you want to monitor exactly how it appears in
/etc/init.d/
SERVICE='clamd'
# Daemon you want to monitor exactly how it appears in
netstat -na
preceeded by a space
SLISTEN=' /var/run/clamav/clamd.sock'

NETSTAT=`netstat -na | grep -c $SLISTEN`
COUNTER=`cat $DATADIR/procs.$SERVICE.status`
PSCOUNT=`ps aux | grep -c $SERVICE`
if [ "$NETSTAT" -lt '1' ]; then
    if [ "$COUNTER" -eq '0' ]; then
        echo '1' >
"$DATADIR/procs.$SERVICE.status" ;
        `/etc/init.d/$SERVICE restart`
    fi
    if [ "$COUNTER" -eq '1' ]; then
        echo '2' >
"$DATADIR/procs.$SERVICE.status" ;
        ps aux | grep $SERVICE | mail -s "`hostname`:
$SERVICE not running"
$EMAIL ;
    fi
    if [ "$COUNTER" -eq '2' ]; then
        echo '3' >
"$DATADIR/procs.$SERVICE.status" ;
    fi
    if [ "$COUNTER" -eq '3' ]; then
        echo '4' >
"$DATADIR/procs.$SERVICE.status" ;
    fi
    if [ "$COUNTER" -eq '4' ]; then
        echo '5' >
"$DATADIR/procs.$SERVICE.status" ;
    fi
    if [ "$COUNTER" -eq '5' ]; then
        echo '6' >
"$DATADIR/procs.$SERVICE.status" ;
    fi
    if [ "$COUNTER" -eq '6' ]; then
        echo '7' >
"$DATADIR/procs.$SERVICE.status" ;
    fi
    if [ "$COUNTER" -eq '7' ]; then
        echo '8' >
"$DATADIR/procs.$SERVICE.status" ;
    fi
    if [ "$COUNTER" -eq '8' ]; then
        echo '9' >
"$DATADIR/procs.$SERVICE.status" ;
    fi
    if [ "$COUNTER" -eq '9' ]; then
        echo '1' >
"$DATADIR/procs.$SERVICE.status" ;
    fi
fi
if [ "$NETSTAT" -gt '0' ]; then
    echo '0' > "$DATADIR/procs.$SERVICE.status"
;
fi

echo $PSCOUNT > $DATADIR/procs.$SERVICE.txt
SQLquery1="INSERT INTO $PROCHISTTBL ( id , date , host
, proc , value )
VALUES ( NULL , NULL , '`hostname`', '$SERVICE', '$PSCOUNT'
)";
mysql --user="$"
--password="$" -D $MONDB -e
"$"
------------------8<-----------------------



On Thu, 8 Nov 2007 22:30:28 +1100 (EST), "Voytek
Eymont" <listssbt.net.au>
wrote:
> whilst in the past clamd has proven extremely reliable,
in the last few
> weeks I had clamd die maube on 3 ocassions for some
reason (perhaps
> related to the additional third party  signature
downloads getting
> corrupted?);
> 
> so I was thinking of some sort of deamon monitor, if it
dies to restart
> it, any suggestions ?
> 
> 
> --
> Voytek
> 
> 
>
------------------------------------------------------------
-------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems? 
Stop.
> Now Search log events and configuration files using
AJAX and a browser.
> Download your FREE copy of Splunk now >> http://get.splunk.com/
> _______________________________________________
> AMaViS-user mailing list
> AMaViS-userlists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/amavis-user

> AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
> AMaViS-HowTos:http://www.amavis.org/ho
wto/











------------------------------------------------------------
-------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and
a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

On Thu, November 8, 2007 10:46 pm, Marius Sturm wrote:

> have a look at monit:

> http://www.tildeslas
h.com/monit/

Marius,

thanks, that's exactly what I was after, I'll set crond with
it


-- 
Voytek


------------------------------------------------------------
-------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and
a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Voytek Eymont wrote:
> whilst in the past clamd has proven extremely reliable,
in the last few
> weeks I had clamd die maube on 3 ocassions for some
reason (perhaps
> related to the additional third party  signature
downloads getting
> corrupted?);
> 
> so I was thinking of some sort of deamon monitor, if it
dies to restart
> it, any suggestions ?

Are you testing third-party signature files before moving
them into production?
 There are several scripts available for downloading,
testing, and utilizing
third-party signatures (see www.sanesecurity.com).  My
script can also be set to
report the status of clamd and attempt to restart it if not
running.

Bill

------------------------------------------------------------
-------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and
a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

On Fri, November 9, 2007 12:05 am, Bill Landry wrote:
> Voytek Eymont wrote:

> Are you testing third-party signature files before
moving them into
> production? There are several scripts available for
downloading, testing,
> and utilizing third-party signatures (see
www.sanesecurity.com).  My
> script can also be set to report the status of clamd
and attempt to
> restart it if not running.

I don't think it's testing... though, need to check

thanks, found it, will try it
http://www.sanesecurity.com/clamav/unofficial-sigs.txt



-- 
Voytek


------------------------------------------------------------
-------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and
a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

On Fri, November 9, 2007 12:05 am, Bill Landry wrote:

> Are you testing third-party signature files before
moving them into
> production? There are several scripts available for
downloading, testing,
> and utilizing third-party signatures (see
www.sanesecurity.com).  My
> script can also be set to report the status of clamd
and attempt to
> restart it if not running.

Bill,

with your script, do I just run it from cron say 4 times a
day?
does it log what's it done ?

ooops, I'm trying to comapre what your script does vs what
I've installed
last week, and, guess what the 1st 2 lines of my current
script says:

'a modified version of a script by Bill Landry'

so perhaps I'm already using your script... just didn't know
it till now...


-- 
Voytek


------------------------------------------------------------
-------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and
a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/