On Fri, Mar 22, 2013 at 1:11 PM, Ben Stuyts <[email protected]> wrote: > Hi, > > I was using clamscan for daily scanning of our user's home directories, > but it was getting too slow with scan times of up to 6 hours. Therefor I'm > testing clamdscan and using multiple threads to scan. (cmd line is > /usr/local/bin/clamdscan -m --fdpass /home) > > I am getting the following error messages from clamd while scanning, and > it's missing a lot of files. If put the Eicar test file at various spots > and it's being missed by the scan. > > Thu Mar 21 22:00:01 2013 -> SelfCheck: Database status OK. > Thu Mar 21 22:10:01 2013 -> SelfCheck: Database status OK. > Thu Mar 21 22:13:48 2013 -> Client disconnected while scanjob was active > Thu Mar 21 22:13:48 2013 -> Client disconnected while scanjob was active > (repeat...) > Thu Mar 21 22:14:06 2013 -> Client disconnected while scanjob was active > Thu Mar 21 22:17:29 2013 -> Reading databases from /var/db/clamav > Thu Mar 21 22:17:36 2013 -> Database correctly reloaded (2019434 > signatures) > > Output from clamdscan, no errors: > > ----------- SCAN SUMMARY ----------- > Infected files: 0 > Time: 3846.032 sec (64 m 6 s) > > This is on FreeBSD 7.4-stable, clamav-0.97.7 (clamav-0.97.6 had the same > problem). The home directories are all zfs based. clamd runs as user > clamav, clamdscan as user root. > > What could be causing this? > > Kind regards, > Ben > > _______________________________________________ > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://www.clamav.net/support/ml >
Ben, The "Client disconnected while scanjob was active" lines can also show up when the scanning threads are being told to shutdown. Did freshclam run and update your signatures during this scan? Dave R. -- --- Dave Raynor Sourcefire Vulnerability Research Team [email protected] _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
