At 12:50 the situation is: 8 clamdscan processes eating 100 % cpu
I notice that freshclam is not running: # service freshclam status freshclam dead but subsys locked All I see in freshclam log are messages like this: Received signal: wake up ClamAV update process started at Mon Feb 26 10:40:41 2007 main.cvd is up to date (version: 42, sigs: 83951, f-level: 10, builder: tkojm) daily.inc is up to date (version: 2654, sigs: 10790, f-level: 13, builder: ccordes) I restarted it: # service freshclam stop Stopping freshclam: [FAILED] # service freshclam start Starting freshclam: [ OK ] And the log says: freshclam daemon 0.90 (OS: linux-gnu, ARCH: i386, CPU: i386) ClamAV update process started at Mon Feb 26 13:01:47 2007 main.cvd is up to date (version: 42, sigs: 83951, f-level: 10, builder: tkojm) Downloading daily-2655.cdiff [100%] daily.inc updated (version: 2655, sigs: 10791, f-level: 13, builder: ccordes) Database updated (94742 signatures) from db.fi.clamav.net (IP: 62.236.254.228) [EMAIL PROTECTED] root]# service freshclam status freshclam (pid 11365) is running... Any effect on clamdscan? Nope: At 13:05 the situation is: 9 clamdscan processes eating 100 % cpu After that I tried a testing procedure that I found at http://wiki.clamav.net/Main/SimScan which did not go quite well: # QMAILQUEUE=/var/qmail/bin/simscan SIMSCAN_DEBUG=2 \ /var/qmail/bin/qmail-inject [EMAIL PROTECTED] < testmail.txt qmail-inject: fatal: qq crashed (#4.3.0) I found out that no email is going through again... I also see now 19 clamscan processes. When looking at the log I see that a reload has been issued before my test (because of freshclam restart I suppose?): 2007-02-26 13:09:04.310381500 SelfCheck: Database modification detected. Forcing reload. 2007-02-26 13:09:04.310385500 SelfCheck: Database modification detected. Forcing reload. 2007-02-26 13:09:04.310387500 Reading databases from /usr/share/clamav 2007-02-26 13:09:04.310389500 Reading databases from /usr/share/clamav 2007-02-26 13:09:11.251511500 Database correctly reloaded (94742 signatures) 2007-02-26 13:09:11.251580500 Database correctly reloaded (94742 signatures) I disable clam for all domains in /var/qmail/control/simcontrol and rebuild the cdb: [EMAIL PROTECTED] root]# service qmail cdb Then I restart clamd: root]# svc -h /var/qmail/supervise/clamd The logs say: 2007-02-26 13:25:27.830833500 SIGHUP caught: re-opening log file. 2007-02-26 13:25:27.830879500 SIGHUP caught: re-opening log file. Email seems to go through now. No effect on the clamscan processes though. Ok, let's shutdown clamav totally: svc -d /var/qmail/supervise/clamd svc -t /var/qmail/supervise/clamd Nothing happens, the processes still stay there, nothing in the logs. `service qmail stat` says: clamd: up (pid 26992) 6896 seconds, want down After a few minutes this is still the issue. There are now 21 clamdscan processes spawned by qmail-smtpd and simscan, at least pstree reports me the processes like this: |-qmail-smtpd(31206)---simscan(31209)---clamdscan(31223) |-qmail-smtpd(1462)---simscan(1465)---clamdscan(1468) I kill the clamdscan processes with `kill -9` and the processes disappear (also the related qmail-smtpd processes). Clamd still won't shut itself down, I have to kill it also. Mail seems to go through normally so I suppose I do not have to have the clamd process running when no domains use it. As this is a production server I'll stop my testing here... I hope it gets resolved. I tried to peek at ClamAV bugtracker / mailing list, but did not see any similiar reports. Regards, Peter --------------------------------------------------------------------- QmailToaster hosted by: VR Hosted <http://www.vr.org> --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
