You are correct. Problem is exactly in softlimit for qmail-smptd. I am runnig qmail in similar scenario (qmail+clamav+spamassassin+qmail-scanner) on another computer for 1 year already, but with different versions of software than now. And i put the same amount of memory for qmail-smptd in this new scenario too. It was 9900000 bytes. But it seems to be not enough for now. I just increased it to 23MB (in this moment for tests only) and it works perfectly. I also removed "--database=/path/to/database/directory" from options to pass to clamscan and it works without it as well. I was confused by clamscan message saying that clamscan is still looking somewhere else than it should. There could by better error reporting for it, but there is also that it may be memory/resource problem.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of peter Sent: Monday, May 03, 2004 11:29 AM To: [EMAIL PROTECTED] Subject: [Clamav-users] Re: malformed pattern
Look at these lines bottom (/var/spool/qmailscan/qmail-queue.log). In qmail-scanner-queue.pl is exactly what is in this log file '--database=/usr/local/share/clamav'. And next line (--output of clamscan was) showes that clamscan is looking somewhere else '/var/spool/qmailscan/tmp/samko.domain.tld24234/clamav-ab54545/VIR USES.DB' . I really don't understand WHY. Btw I think, that clamscan does not search for clamav.conf - this should do clamd/clamdscan only. But just to be sure i already put these settings in clamav.conf.
You are correct, clamscan does not use clamav.conf. Im not sure where clamscan looks for *.cvd files by default, but if its anything like sigtool, it uses a hardcoded path specified at compile time. However specifiying --database=/usr/local/share/clamav should overwrite any default values. So basically i have no idea why it is still looking in /var/spool/qmailscan/tmp/samko.domain.tld24234/clamav-ab54545/VIRUSES.DB. What i was trying to suggest earlier was that you should remove these .DB files wherever they are. This wont prevent clamscan from looking for them, but it WILL prevent clamscan from using them. If the problem still persists after removing these .db files then this was not the actual problem.
I don't understand why.... I tried check files/mbox as non-privileged user or root via command line and it worked. And if I run it via qmail-scanner I'm falling in this odd situation.
Mon, 03 May 2004 16:59:25 CEST:17541: scanloop: starting scan of directory "/var/spool/qmailscan/tmp/samko.domain.tld108359636548217541"... Mon, 03 May 2004 16:59:25 CEST:17541: scanloop: scanner=clamscan_scanner,plain_text_msg=0 Mon, 03 May 2004 16:59:25 CEST:17541: clamscan: starting scan of directory "/var/spool/qmailscan/tmp/samko.domain.tld108359636548217541"... Mon, 03 May 2004 16:59:25 CEST:17541: run /usr/local/bin/clamscan -r -m --disable-summary --database=/usr/local/share/clamav/ /var/spool/qmailscan/tmp/samko.domain.tld108359636548217541 2>&1 Mon, 03 May 2004 16:59:28 CEST:17541: --output of clamscan was: LibClamAV Error: readdb(): Malformed pattern line 13771 (file /var/spool/qmailscan/tmp/samko.domain.tld108359636548217541/clamav -ab19271867b1b5cf/viruses.db). LibClamAV Error: Incomplete block read. LibClamAV Error: cli_cvdload(): Can't unpack CVD file. ERROR: CVD extraction failure. -- Mon, 03 May 2004 16:59:28 CEST:17541: error_condition: X-Qmail-Scanner-1.22: clamscan: corrupt or unknown ClamAV scanner error or memory/resource/perms problem - exit status 50
If scanning manually works but you get the above error in your log then you may want to try raising your softlimit value in the qmail-smtpd run script. It may be failing to load the database because of insufficient memory allowed to the process.
Jim
-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
Thank you very much, Jim, for your help.
Peter
-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
