Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
On 11/13/19 10:39 AM, Andrew Watkins via clamav-users wrote: On 11/13/19 10:33 AM, G.W. Haywood via clamav-users wrote: Perhaps clamd is reloading its databases when you see this. Depending on configuration and the host performance it can take anywhere between a few tens of seconds and several minutes to reload all the databases, and during that time currently released versions of clamd won't scan. Check the logs for the reload messages. There's a patch currently in testing which permits clamd to continue scanning while reloading, the patch is available if you wish to build clamd yourself, and it should be available in a released version of clamd quite soon I hope. There has been some discussion on this list recently if you'd like to look. Ah! I had read that discussion, but didn't put 2 and 2 together since I thought the database re-load had finished, but I think it may be this. I will look at download and build patched version. Thanks! I installed latest devel version "ClamAV 0.103.0-devel-20191113/25633/Thu Nov 14 09:50:04 2019" and have not had any errors in 24hours. Will keep it running to see if any other problems with next release. Anyway, great work. Andrew -- Andrew Watkins * Birkbeck, University of London * Computer Science * * http://notallmicrosoft.blogspot.com * * UKOUG Systems * * UKOUG Tech committee * * tel: 020 7631 6720 * ::e-mails are only read & actioned between 0900 and 1730 hours (Monday - Friday) ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
Hi there, On Wed, 13 Nov 2019, Andrew Watkins via clamav-users wrote: On 11/13/19 10:33 AM, G.W. Haywood via clamav-users wrote: Perhaps clamd is reloading its databases when you see this. Depending on configuration and the host performance it can take anywhere between a few tens of seconds and several minutes to reload all the databases... Ah! I had read that discussion, but didn't put 2 and 2 together since I thought the database re-load had finished, but I think it may be this. I will look at download and build patched version. You could of course just increase your timeouts. :) -- 73, Ged. ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
On 11/13/19 10:33 AM, G.W. Haywood via clamav-users wrote: Perhaps clamd is reloading its databases when you see this. Depending on configuration and the host performance it can take anywhere between a few tens of seconds and several minutes to reload all the databases, and during that time currently released versions of clamd won't scan. Check the logs for the reload messages. There's a patch currently in testing which permits clamd to continue scanning while reloading, the patch is available if you wish to build clamd yourself, and it should be available in a released version of clamd quite soon I hope. There has been some discussion on this list recently if you'd like to look. Ah! I had read that discussion, but didn't put 2 and 2 together since I thought the database re-load had finished, but I think it may be this. I will look at download and build patched version. Cheers, Andrew -- Andrew Watkins * Birkbeck, University of London * Computer Science * * http://notallmicrosoft.blogspot.com * * UKOUG Systems * * UKOUG Tech committee * * tel: 020 7631 6720 * ::e-mails are only read & actioned between 0900 and 1730 hours (Monday - Friday) ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
On 11/13/19 10:26 AM, Reio Remma via clamav-users wrote: On 13/11/2019 12:19, Andrew Watkins via clamav-users wrote: Check if it's coinciding with clamd reloading its databases. Clamd currently doesn't scan when reloading databases. Look for: Nov 13 11:37:04 clamd clamd[15795]: SelfCheck: Database modification detected. Forcing reload. Nov 13 11:37:04 clamd clamd[15795]: Reading databases from /var/lib/clamav Nov 13 11:37:56 clamd clamd[15795]: Database correctly reloaded (13057843 signatures) Good luck, Reio Thanks, but should have said. Reload takes place at 10 mins past the hour, but saying that most errors are between 11 to 29 past the hour. Will look again... Andrew -- Andrew Watkins * Birkbeck, University of London * Computer Science * * http://notallmicrosoft.blogspot.com * * UKOUG Systems * * UKOUG Tech committee * * tel: 020 7631 6720 * ::e-mails are only read & actioned between 0900 and 1730 hours (Monday - Friday) ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
Hi there, On Wed, 13 Nov 2019, Andrew Watkins via clamav-users wrote: I get the following error a few times a day for a while, so I thought I would look into it. I am using mimedefang to send mail to clamd and it works fine, but at random point of the day I get the error: mimedefang.pl[26234]: xAD8PbeZ009878: Timeout reading from clamd daemon at /var/spool/MIMEDefang/clamd.sock Perhaps clamd is reloading its databases when you see this. Depending on configuration and the host performance it can take anywhere between a few tens of seconds and several minutes to reload all the databases, and during that time currently released versions of clamd won't scan. Check the logs for the reload messages. There's a patch currently in testing which permits clamd to continue scanning while reloading, the patch is available if you wish to build clamd yourself, and it should be available in a released version of clamd quite soon I hope. There has been some discussion on this list recently if you'd like to look. -- 73, Ged. ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
On 13/11/2019 12:19, Andrew Watkins via clamav-users wrote: Hello, I get the following error a few times a day for a while, so I thought I would look into it. I am using mimedefang to send mail to clamd and it works fine, but at random point of the day I get the error: mimedefang.pl[26234]: xAD8PbeZ009878: Timeout reading from clamd daemon at /var/spool/MIMEDefang/clamd.sock mimedefang.pl[26234]: xAD8PbeZ009878: Problem running virus scanner: code=999, category=cannot-execute, The problem is clamd has not being sent any other mails so don't see it is a queuing problem. For example I added a debug in mimedefang when it sends data to clamd: mail 1) Nov 13 08:19:10 mimedefang send data to clamd mail 1) Nov 13 08:19:11 mimedefang receives an answer mail 2) Nov 13 08:25:38 mimedefang send data to clamd mail 2) Nov 13 08:26:38 Timeout reading from clamd daemon at /var/spool/MIMEDefang/clamd.sock YES! 60 seconds mail 2) Nov 13 08:26:38 mimedefang tries again mail 2) Nov 13 08:26:38 mimedefang gets error: Problem running virus scanner: code=999, category=cannot-execute, action=tempfail mail 3) Nov 13 08:28:21 works again So, my question is there any tracing I can put in place so that I can see what clamd is doing at this time. I looked at clamdtop but that show live information so no good. At this time the email it breaks on is randon and small. Check if it's coinciding with clamd reloading its databases. Clamd currently doesn't scan when reloading databases. Look for: Nov 13 11:37:04 clamd clamd[15795]: SelfCheck: Database modification detected. Forcing reload. Nov 13 11:37:04 clamd clamd[15795]: Reading databases from /var/lib/clamav Nov 13 11:37:56 clamd clamd[15795]: Database correctly reloaded (13057843 signatures) Good luck, Reio ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
[clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
Hello, I get the following error a few times a day for a while, so I thought I would look into it. I am using mimedefang to send mail to clamd and it works fine, but at random point of the day I get the error: mimedefang.pl[26234]: xAD8PbeZ009878: Timeout reading from clamd daemon at /var/spool/MIMEDefang/clamd.sock mimedefang.pl[26234]: xAD8PbeZ009878: Problem running virus scanner: code=999, category=cannot-execute, The problem is clamd has not being sent any other mails so don't see it is a queuing problem. For example I added a debug in mimedefang when it sends data to clamd: mail 1) Nov 13 08:19:10 mimedefang send data to clamd mail 1) Nov 13 08:19:11 mimedefang receives an answer mail 2) Nov 13 08:25:38 mimedefang send data to clamd mail 2) Nov 13 08:26:38 Timeout reading from clamd daemon at /var/spool/MIMEDefang/clamd.sock YES! 60 seconds mail 2) Nov 13 08:26:38 mimedefang tries again mail 2) Nov 13 08:26:38 mimedefang gets error: Problem running virus scanner: code=999, category=cannot-execute, action=tempfail mail 3) Nov 13 08:28:21 works again So, my question is there any tracing I can put in place so that I can see what clamd is doing at this time. I looked at clamdtop but that show live information so no good. At this time the email it breaks on is randon and small. Thanks, Andrew -- Andrew Watkins * Birkbeck, University of London * Computer Science * * http://notallmicrosoft.blogspot.com * * UKOUG Systems * * UKOUG Tech committee * * tel: 020 7631 6720 * ::e-mails are only read & actioned between 0900 and 1730 hours (Monday - Friday) ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml