in the file clamav-unofficial-sigs.conf is the following:
# If you would like to reload the clamd databases after an update,
# change the following variable to "yes".
reload_dbs="yes"
# Set the reload or restart option if the "reload_dbs" variable above
# is set to "yes" (only select 'ONE' of the following variables or the
# last uncommented variable option will be the one used).
# - The next variable signals clamd daemon to reload databases (this
is the recommended reload option)
reload_opt="clamdscan --reload" # Default
# - The next variable signals clamd's Process ID (PID) to reload databases
#reload_opt="kill -USR2 `cat $clamd_pid`"
reload_opt="qmail-clam -s restart"
# - The next variable signals linux based systems to do a full clamd
service stop/start
#reload_opt="service clamd restart"
reload_opt="qmail-clam -s restart"
# - Use the next variable to set a custom or system specific
reload/restart option
#reload_opt=""
reload_opt="qmail-clam -s restart"
If I comment out the last three options and keep
"reload_opt="clamdscan --reload" clamd does not restart, and I think
it is still updating properly, but I am not 100% sure.
I do get the following in /var/log/qmail/clamd/current
Database correctly reloaded (1116267 signatures)
--
Aaron Powell
IT Manager
S&T Communications
Office: 785-460-7300
Fax: 785-460-7301
Quoting Eric Shubert <[email protected]>:
On 06/07/2011 08:15 AM, [email protected] wrote:
in log file /var/log/clamav/unofficial-sigs.log I have:
INFO - Next SecuriteInfo check will be performed in approximately 2
hour(s), 4 minute(s)
Jun 07 09:33:51 INFO - Checking for MalwarePatrol updates...
Jun 07 09:33:52 INFO - Testing updated database file: mbl.ndb
Jun 07 09:33:52 INFO - Clamscan reports Sanesecurity mbl.ndb database
integrity tested good
Jun 07 09:33:52 INFO - Successfully updated MalwarePatrol production
database file: mbl.ndb
Jun 07 09:33:52 INFO - Update(s) detected, reloaded ClamAV databases
these times also correlate to the log file /var/log/qmail/clamd/current:
Waiting for all threads to finish
2011-06-07 09:33:53.164200500 Shutting down the main socket.
2011-06-07 09:33:53.164416500 --- Stopped at Tue Jun 7 09:33:53 2011
2011-06-07 09:33:53.164440500 Closing the main socket.
2011-06-07 09:33:53.164485500 Socket file removed.
2011-06-07 09:33:53.632970500 LibClamAV Warning: Detected duplicate
databases /usr/share/clamav/main.cvd and /usr/share/clamav/main.cld,
please manually remove one of them
2011-06-07 09:33:57.103557500 Limits: Global size limit set to 104857600
bytes.
2011-06-07 09:33:57.103559500 Limits: File size limit set to 26214400
bytes.
2011-06-07 09:33:57.103560500 Limits: Recursion level limit set to 16.
2011-06-07 09:33:57.103560500 Limits: Files limit set to 10000.
2011-06-07 09:33:57.103561500 Limits: Core-dump limit is 0.
2011-06-07 09:33:57.103561500 Archive support enabled.
2011-06-07 09:33:57.103562500 Algorithmic detection enabled.
2011-06-07 09:33:57.103562500 Portable Executable support enabled.
2011-06-07 09:33:57.103563500 ELF support enabled.
2011-06-07 09:33:57.103602500 Mail files support enabled.
2011-06-07 09:33:57.103603500 OLE2 support enabled.
2011-06-07 09:33:57.103612500 PDF support enabled.
2011-06-07 09:33:57.103612500 HTML support enabled.
2011-06-07 09:33:57.103613500 Self checking every 600 seconds.
2011-06-07 09:33:57.103613500 Listening daemon: PID: 19474
2011-06-07 09:33:57.103614500 MaxQueue set to: 100
I also have found /etc/cron.d/clamav-unofficial-sigs-cron
I believe this file is what is updateing some of the clam sigs and
causing clam to restart.
The problem is that clam takes 4 to 5 seconds to restart, which is not a
lot but I am unlucky enough to have customers sending email at those
times causing the soft reject errors.
is anyone else having these problems?
Thanks
My servers aren't that busy. I do see an occasional problem with
submissions though, so perhaps this is why. I wonder why Bill's
script restarts clamav. Freshclam seems to update w/out needing to
restart clamav. I expect that some sort of refresh would suffice,
which would perhaps not cause the soft rejects. There's gotta be a
way for this to happen w/out impacting end users in such a way.
Can you post this to the sanesecurity list?
(http://sanesecurity.com/mailinglist.htm and also availble at
newsgroup gmane.comp.security.virus.clamav.sanesecurity)
I'm sure Bill and Steve there would know off hand how best to handle
this. FWIW, I keep an eye on that list, so I'll see what comes of
this. Please report back here though what you find there.
Thanks AP.
--
-Eric 'shubes'
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail:
[email protected]
For additional commands, e-mail: [email protected]
--
BEGIN-ANTISPAM-VOTING-LINKS
------------------------------------------------------
Teach CanIt if this mail (ID 03ERsLFgT) is spam:
Spam:
http://spam.st-tel.net/canit/b.php?i=03ERsLFgT&m=300030120eb1&t=20110608&c=s
Not spam:
http://spam.st-tel.net/canit/b.php?i=03ERsLFgT&m=300030120eb1&t=20110608&c=n
Forget vote:
http://spam.st-tel.net/canit/b.php?i=03ERsLFgT&m=300030120eb1&t=20110608&c=f
------------------------------------------------------
END-ANTISPAM-VOTING-LINKS
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
