On 26 Aug 2008 at 18:09, Phil (Medway Hosting) wrote: > Sun Aug 24 09:01:04 2008 -> SelfCheck: Database modification detected. > Forcing reload. > Sun Aug 24 09:01:04 2008 -> Reading databases from C:\Program > Files\clamAV\data > Sun Aug 24 09:01:04 2008 -> d:\Merak Mail\temp\200808240901020103.tmp: OK > Sun Aug 24 09:01:30 2008 -> ERROR: reload db failed: Malformed database > Sun Aug 24 09:01:30 2008 -> Terminating because of a fatal error. > Sun Aug 24 09:01:30 2008 -> Shutting down the main socket. > Sun Aug 24 09:01:30 2008 -> Closing the main socket. > Sun Aug 24 09:01:30 2008 -> --- Stopped at Sun Aug 24 09:01:30 2008 > > First question - Why might it be detecting database modifications when > freshclam hasn't been run ?
clamd does a check as set in clamd.conf (selfcheck) - default 1800 (30mins). Has anything else got rights to those data files that might stop clamd reading them? Any disk problems in system event log? It's strange too, that it reads the db just before processing a mail file, and then fails. How do you run freshclam - on a schedule? > 2nd - Why does it start up quite happily again after it detected "Malformed > database" ? It's misreporting the error? > Also when it bombs, only clamd fails but srvany.exe doesn't. Is there a way > to force srvany.exe to fail if it's child process fails ? because the system > won't recover and restart clamd all the time srvany.exe is running. Don't you want the service to restart automatically? If not run clamd manually without srvany. (There are other service wrappers like firedaemon, srvstart, ntwrapper, but I'm not sure if any of them can be set to stop if the app fails.) paul _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-win32
