On 5 Jul 2006 at 10:22, Stephen Gran wrote:
> On Wed, Jul 05, 2006 at 10:08:22AM +0100, Beginner said:
> > Hi,
> >
> > Debian 3.1, Alpha GNU/Linux 2.4.27-2, clamd daemon 0.88.2
> >
> > I am using clamd with exim (exiscan) to scan emails. The other day the
> > systems became un-
> > responsive and would not accept input from the console. It was getting the
> > error "fork: Resource
> > temporarily unavailable (35)".
> >
> > The only reason I can find for this is the large number of defunct clamd
> > processes. I restart clamd
> > yesterday and I already have 622
>
> I have another report of problems on alpha (unaligned traps) - do you
> see anything in kern.log? Can you debug this a bit (strace, gdb, etc)?
I just ran an strace on clamd until it spawned 2 defunct processes.
clamav 29582 0.0 1.6 31016 21272 ? Ss 11:11 0:00 /usr/sbin/clamd
clamav 29598 0.0 1.6 31016 21272 ? S 11:11 0:00 /usr/sbin/clamd
clamav 29599 0.2 0.0 0 0 ? Z 11:11 0:00 [clamd] <defunct>
clamav 29761 0.0 0.0 0 0 ? Z 11:12 0:00 [clamd] <defunct>
The content of the output file from strace is a bit cryptic. I can't work out
which of these pid is
beind referred to so I am not sure what part of it to post. The output file has
6115 lines in.
================== snip of strace output========
stat("/tmp/clamav-48bf4dd36561a84d", {st_mode=S_IFDIR|0700, st_size=4096, ...})
= 0
rmdir("/tmp/clamav-48bf4dd36561a84d") = 0
close(6) = 0
close(5) = 0
munmap(0x2000001e000, 8192) = 0
getdents64(4, /* 0 entries */, 8192) = 0
close(4) = 0
gettimeofday({1152094304, 672942}, NULL) = 0
write(3, "Wed Jul 5 11:11:44 2006 -> Prot"..., 62) = 62
open("/dev/null", O_WRONLY) = 4
close(0) = 0
dup2(4, 1) = 1
dup2(4, 2) = 2
chdir("/") = 0
fork() = 29582
munmap(0x2000001c000, 8192) = 0
exit_group(0) = ?
=========================================
> > The only potential cause for this that I can find is the ScanArchive
> > directive in clamd.conf. I have
> > tried to comment it out but when I re-start clamav the log shows "Archive
> > support enabled"
> >
> > Is there something I can do to stop these zombie processes from growing (a
> > part from re-starting
> > clamd)? Is there some reason why the ScanArcive option is still enabled
> > when I have asked not
> > specified it?
>
> ScanArchive is one fo the default options, and in order to disable it,
> you need to add DisableDefaultScanOptions (I think I got the option
> right - check the man page), and then readd the defaults you do want.
Yes that is the option and it works thanx.
> Setting connection queue length to 15
> RECOMMENDED OPTIONS DISABLED.
> Archive support disabled.
> Portable Executable support enabled.
> Detection of broken executables enabled.
However it doesn't stop the defunct processes so I have enabled it again as
it's not the source of
my problem. Is there anything else I can do that might narrow things down?
Thanx.
Dp.
I
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
