On Wed, 30 Jun 2010 12:11:06 +0100 (BST) "G.W. Haywood" <[email protected]> wrote:
> Hi there, > > On Wed, 30 Jun 2010 hook wrote: > > > I am using last ClamAv in FreeBSD 8. > > I did install as normal, from .tar > > > > After some time, by external issue, > > External issue? > > > my server was rebooted by the ?button?, ie hard way. > > Who did that? Why? Was there no alternative? (Such as using > CTRL-ALT-DEL or one of the other keyboard interrupts, logging > in via a serial port, logging in over the network with ssh...) > > > After that, the clamd file is missing.... > > Incorrect. It is not missing. You can see the directory entry. > > > zero lenght! > > The directory listing tells you it has zero length. This may be true > or it may not. The filesystem has been damaged and requires repair. Journaling filesystems are supposed to prevent these kind of issues. I would understand getting a file that you just wrote to damaged if you hard reboot, getting some random file in /usr damaged sounds like a bug in the filesystem's design. What filesystem are you using? Is it a journaling FS? Do you have the journal turned on? Linux usually runs a journal recovery when mounting a filesystem that was not cleanly unmounted. I don't know if FreeBSD does that. > > Did you run a filesystem checking tool after the abnormal shutdown? > If not, then you should. It is possible that the filesystem damage > was serious, and that you cannot rely on it now. Agreed. > I do not know how > often FreeBSD 'syncs' its filesystems; if it is infrequent you might > want to consider a crontab entry to do that every few minutes so that > in the case of a system crash, a power failure or a hard reset there > is less risk of changes which are cached in RAM failing to be written > to disc. > > > Previous ?clean? reboots did not affect the behaviour. > > No surprise there. :) > > > After new install, all ok. > > Did you only reinstall ClamAV? If so I do not believe that you know > that all is OK. Under these circumstances, I would not know. > > > Tested a second ?hard reboot?, and same problem! > Did you run 'sync' after reinstalling ClamAV? (or wait long enough so the system does this) > No more surprising than the first time. :( > > > What can I do to prevent it ... > > It is a _very_ bad idea to shut down a modern operating system the > hard way unless the installation has been designed with that in mind. > You are probably starting to understand why. One way of preventing > filesystem damage under these circumstances is to mount it read only. > In that case you would need to re-structure your directory hierarchy. > You might also want to consider more extreme measures such as using > read-only media like CD-R or DVD-R to store the files. Performance > can become an issue so you can load the files into a RAM filesystem > for the actual operation each time the system boots. But I have to > say that all this should be completely unnecessary. Something is > wrong with the way your system is installed and/or operated and the > damage to a single file like the clamd binary is going to be just a > tip of one of many icebergs. You really need to fix your system and > your methods of working, not just try to hide the symptoms. > > Patient: Doctor, doctor, it hurts when I do this... > Doctor: Then don't do it! > > -- > > 73, > Ged. > _______________________________________________ > Help us build a comprehensive ClamAV guide: visit > http://wiki.clamav.net http://www.clamav.net/support/ml _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
