clamd statility issues?

orry for the slightly OT

I'm having some serious stability issues runing MD + clamd +
SA on
FreeBSD boxes.

Every couple of days, clamd dies for no aparent reason and
MD starts 
tempfailing the messages with "problem running
virus-scanner"

This happens on some old 4.11 as well as in some 5.x ones. I
tried updating
clamav but it didn't help.

Is there anyone else who's seeing this? would it help If I
switched from 
clamd to clamscan?

Thanks in advance

 		Fer
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in
the above
message, it is NULL AND VOID.  You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpengu
in.com
MIMEDefang mailing list MIMEDefanglists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mime
defang

Fernando Gleiser wrote:

> Every couple of days, clamd dies for no aparent reason
and MD starts
> tempfailing the messages with "problem running
virus-scanner"

Yes, the Clam developers seem to be having problems lately. 
On some
systems, we run a shell script from cron once a minute that
ensures that
clamd is still running and responding.  If not, we kill and
restart it.

> Is there anyone else who's seeing this? would it help
If I switched from
> clamd to clamscan?

Performance would be dramatically worse.

Regards,

David.
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in
the above
message, it is NULL AND VOID.  You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpengu
in.com
MIMEDefang mailing list MIMEDefanglists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mime
defang

On Wed, 7 Mar 2007, David F. Skoll wrote:

> Yes, the Clam developers seem to be having problems
lately.  On some
> systems, we run a shell script from cron once a minute
that ensures that
> clamd is still running and responding.  If not, we kill
and restart it.

Do you only see this problem on FreeBSD?  What about Linux
or Solaris?

ray
-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=
Ray DeJean  				       	 http://www.r-a-y.org
Systems Engineer                    Southeastern Louisiana
University
IBM Certified Specialist  	      AIX Administration, AIX
Support
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=

_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in
the above
message, it is NULL AND VOID.  You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpengu
in.com
MIMEDefang mailing list MIMEDefanglists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mime
defang

On Wed, Mar 07, 2007 at 06:33:07PM -0300, Fernando Gleiser
wrote:
> orry for the slightly OT
> 
> I'm having some serious stability issues runing MD +
clamd + SA on
> FreeBSD boxes.
> 
> Every couple of days, clamd dies for no aparent reason
and MD starts 
> tempfailing the messages with "problem running
virus-scanner"

Change the config to run clamd in the foreground start it
inside a shell
service loop akin to:

#!/bin/bash
while [ 1 ]
 do
   /path/to/clamd
   sleep 5
 done

We've run clamd like this ever since we've started using it
ages ago.  In
addition, we also have a perl watchdog that connects to it
and pings it, if
it fails to respond to N heath checks, it kills it, so the
service loop can
restart it.

-- 
Kelsey Cummings - kgccorp.sonic.net      sonic.net, inc.
System Architect                          2260 Apollo Way
707.522.1000                              Santa Rosa, CA
95407
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in
the above
message, it is NULL AND VOID.  You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpengu
in.com
MIMEDefang mailing list MIMEDefanglists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mime
defang

On 3/7/07, Fernando Gleiser <fgleisercactus.fi.uba.ar> wrote:
> orry for the slightly OT
>
> I'm having some serious stability issues runing MD +
clamd + SA on
> FreeBSD boxes.
>
> Every couple of days, clamd dies for no aparent reason
and MD starts
> tempfailing the messages with "problem running
virus-scanner"
>
> This happens on some old 4.11 as well as in some 5.x
ones. I tried updating
> clamav but it didn't help.
>
> Is there anyone else who's seeing this? would it help
If I switched from
> clamd to clamscan?

Yeah, if you take a look at the clamav mailing lists you'll
see that
there's some pretty major problems being seen by a lot of
people.
That said, I've not yet had any problems, though I'm using
it for
pretty low traffic volumes (a few hundreds of emails a
day).

The port should be updated to 0.90.1 soon and indicators on
the
freebsd-stable list is that the latest port (0.90_3) should
be ok too
(as it fixes some issues to do with the threading libraries
used).

A lot of people have gone back to the 0.8x series until
things improve.

-- 
                 Please keep list traffic on the list.

Rob MacGregor
      Whoever fights monsters should see to it that in the
process he
        doesn't become a monster.                  Friedrich
Nietzsche
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in
the above
message, it is NULL AND VOID.  You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpengu
in.com
MIMEDefang mailing list MIMEDefanglists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mime
defang

Hi,

This is the perl script we use to test the state of clamd
to
be able to kill and restart it (if it hangs). Maybe someone
finds it useful. We do 

This may work only on FreeBSD, since we use telnet to
connect to
a local unix domain socket. If you use different operating
systems
you'll need to connect to a tcp adress.

--
Martin

#!/usr/bin/perl

use Expect;

$return = &check_clamd();

if ($return == 4) {
 	print "Successful connected to clamd, exitn";
 	exit(0);
} else {
 	sleep 2;
 	$return = &check_clamd();
 	if ($return == 4) {
 		print "Successful connected to clamd, exitn";
 		exit(0);
 	} elsif ($return == 1) {
 		print "ERROR: Connect to clamd failed,
errorn";
 	}
 	exit(2);
}

sub check_clamd {
 	#
 	# Open the clamd_socket and disable expect debug
 	# and log_stdout.
 	#
 	my $exp = new Expect;
 	$exp->debug(0);
 	$exp->raw_pty(1);
 	$exp->log_stdout(0);
 	$exp->spawn("telnet
/var/run/clamav/clamd.sock")
 		or return 0;;
 	my $spawn_ok;

 	$timeout = 10;
 	$clammatch = $exp->expect($timeout,
 	[
 		qr'No connection.|Connected to .*',
 		sub {
 			$spawn_ok = 1;
 			my $fh = shift;
 			$fh->send("PINGn");
 			exp_continue;
 	       }
 	],
 	[
 		eof =>
 			sub {
 				if ($spawn_ok) {
 					print "ERROR: Premature EOF in login.n";
 					return 1;
 				} else {
 					print "ERROR: Could not spawn telnet.n";
 					return 1;
 				}
 			}
 	],
 	[
 		timeout =>
 			sub {
 				print "ERROR: No login.n";
 				return 1;
 			}
 	],
 		'-re', qr'PONG'
 	);

 	return $clammatch;
}


Martin Blapp, <mbimp.ch> <mbrFreeBSD.org>
------------------------------------------------------------
------
ImproWare AG, UNIXSP & ISP, Zurlindenstrasse 29, 4133
Pratteln, CH
Phone: +41 61 826 93 00 Fax: +41 61 826 93 01
PGP: <finger -l mbrfreebsd.org>
PGP Fingerprint: B434 53FC C87C FE7B 0A18 B84C 8686 EF22
D300 551E
------------------------------------------------------------
------

_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in
the above
message, it is NULL AND VOID.  You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpengu
in.com
MIMEDefang mailing list MIMEDefanglists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mime
defang