On 2/26/07, Peter Peltonen <[EMAIL PROTECTED]> wrote:
At 12:50 the situation is: 8 clamdscan processes eating 100 % cpu
I notice that freshclam is not running:
# service freshclam status
freshclam dead but subsys locked
All I see in freshclam log are messages like this:
Received signal: wake up
ClamAV update process started at Mon Feb 26 10:40:41 2007
main.cvd is up to date (version: 42, sigs: 83951, f-level: 10, builder: tkojm)
daily.inc is up to date (version: 2654, sigs: 10790, f-level: 13,
builder: ccordes)
I restarted it:
# service freshclam stop
Stopping freshclam: [FAILED]
# service freshclam start
Starting freshclam: [ OK ]
And the log says:
freshclam daemon 0.90 (OS: linux-gnu, ARCH: i386, CPU: i386)
ClamAV update process started at Mon Feb 26 13:01:47 2007
main.cvd is up to date (version: 42, sigs: 83951, f-level: 10, builder: tkojm)
Downloading daily-2655.cdiff [100%]
daily.inc updated (version: 2655, sigs: 10791, f-level: 13, builder: ccordes)
Database updated (94742 signatures) from db.fi.clamav.net (IP: 62.236.254.228)
[EMAIL PROTECTED] root]# service freshclam status
freshclam (pid 11365) is running...
Any effect on clamdscan? Nope:
At 13:05 the situation is: 9 clamdscan processes eating 100 % cpu
After that I tried a testing procedure that I found at
http://wiki.clamav.net/Main/SimScan
which did not go quite well:
# QMAILQUEUE=/var/qmail/bin/simscan SIMSCAN_DEBUG=2 \
/var/qmail/bin/qmail-inject [EMAIL PROTECTED] < testmail.txt
qmail-inject: fatal: qq crashed (#4.3.0)
I found out that no email is going through again... I also see now 19 clamscan
processes.
When looking at the log I see that a reload has been issued before my
test (because of freshclam restart I suppose?):
2007-02-26 13:09:04.310381500 SelfCheck: Database modification detected. Forcing
reload.
2007-02-26 13:09:04.310385500 SelfCheck: Database modification detected. Forcing
reload.
2007-02-26 13:09:04.310387500 Reading databases from /usr/share/clamav
2007-02-26 13:09:04.310389500 Reading databases from /usr/share/clamav
2007-02-26 13:09:11.251511500 Database correctly reloaded (94742 signatures)
2007-02-26 13:09:11.251580500 Database correctly reloaded (94742 signatures)
I disable clam for all domains in /var/qmail/control/simcontrol and rebuild the
cdb:
[EMAIL PROTECTED] root]# service qmail cdb
Then I restart clamd:
root]# svc -h /var/qmail/supervise/clamd
The logs say:
2007-02-26 13:25:27.830833500 SIGHUP caught: re-opening log file.
2007-02-26 13:25:27.830879500 SIGHUP caught: re-opening log file.
Email seems to go through now. No effect on the clamscan processes though. Ok,
let's shutdown clamav totally:
svc -d /var/qmail/supervise/clamd
svc -t /var/qmail/supervise/clamd
Nothing happens, the processes still stay there, nothing in the logs. `service
qmail stat` says:
clamd: up (pid 26992) 6896 seconds, want down
After a few minutes this is still the issue. There are now 21
clamdscan processes
spawned by qmail-smtpd and simscan, at least pstree reports me the
processes like
this:
|-qmail-smtpd(31206)---simscan(31209)---clamdscan(31223)
|-qmail-smtpd(1462)---simscan(1465)---clamdscan(1468)
I kill the clamdscan processes with `kill -9` and the processes
disappear (also the
related qmail-smtpd processes). Clamd still won't shut itself down, I
have to kill
it also.
Mail seems to go through normally so I suppose I do not have to have the clamd
process running when no domains use it.
As this is a production server I'll stop my testing here... I hope it
gets resolved. I tried
to peek at ClamAV bugtracker / mailing list, but did not see any
similiar reports.
Regards,
Peter
I had the same problem in a FC4. I downgrade to the prior clamav
version and I´m waiting for a new update.
---------------------------------------------------------------------
QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
