Richard J. Kieran wrote: > I can't believe I got not a single response to this, so I'm trying again: > > I'm running clamd with MIMEDefang on a CentOS machine. Once in a while there > will be a day when there are many "Problem running virus scanner: code=999" > errors, anywhere from 1 or 2 (who cares?) to 4486 (now I'm concerned...), > like yesterday. The next > day, all will be back to normal until it happens again. Here is a maillog > entry: > > Dec 1 00:03:15 fdr mimedefang.pl[4798]: mB153Ere005745: Could not connect to > clamd daemon at /var/spool/MIMEDefang/clamd.sock
This is the real problem, mimedefang can't connect to clamd. Maybe clamd isn't running, or maybe there are too many connections. If clamd is running, check the settings of MaxConnectionQueueLength and MaxThreads in clamd.conf. > Dec 1 00:03:15 fdr mimedefang.pl[4798]: Problem running virus scanner: > code=999, category=cannot-execute, action=tempfail > Dec 1 00:03:15 fdr mimedefang.pl[4798]: filter: mB153Ere005745: tempfail=1 > Dec 1 00:03:15 fdr mimedefang[4793]: mB153Ere005745: Tempfailing because > filter instructed us to > Dec 1 00:03:15 fdr sm-mta[5745]: mB153Ere005745: Milter: data, reject=451 > 4.3.0 Problem running virus-scanner These four entries are mimedefang errors and not really useful beyond they tell us that the message was tempfailed because mimedefang couldn't talk to clamd. > > I found this entry in the clamd.log: > Mon Dec 1 11:02:11 2008 -> ERROR: LOCAL: Socket file > /var/spool/MIMEDefang/clamd.sock is in use by another process. Something tried to (re)start clamd but the socket already existed and "something" was using the socket. My assumption is that clamd is already running and something/someone tried to start it again. > > Occurrences of the first error seem to be vaguely accompanied by the second, > but I have seen the second when restarting clamd manually, and I have a > script that restarts clamd when it sees virus scanner errors in the maillog, > so that may explain the > relationship. If that is a separate problem, I'd like to solve it also, but > the tempfails are more of a concern at the moment. > Richard It's not clear what you mean by "first" and "second" error. I expect the mimedefang.pl "could not connect" error to always be followed by one or more of the code=999 & friends error sequence. The clamd "clamd.sock is in use" error will only occur when you start clamd when it's already running. -- Noel Jones _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
