Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
On 11/13/19 10:39 AM, Andrew Watkins via clamav-users wrote: On 11/13/19 10:33 AM, G.W. Haywood via clamav-users wrote: Perhaps clamd is reloading its databases when you see this. Depending on configuration and the host performance it can take anywhere between a few tens of seconds and several minutes to reload all the databases, and during that time currently released versions of clamd won't scan. Check the logs for the reload messages. There's a patch currently in testing which permits clamd to continue scanning while reloading, the patch is available if you wish to build clamd yourself, and it should be available in a released version of clamd quite soon I hope. There has been some discussion on this list recently if you'd like to look. Ah! I had read that discussion, but didn't put 2 and 2 together since I thought the database re-load had finished, but I think it may be this. I will look at download and build patched version. Thanks! I installed latest devel version "ClamAV 0.103.0-devel-20191113/25633/Thu Nov 14 09:50:04 2019" and have not had any errors in 24hours. Will keep it running to see if any other problems with next release. Anyway, great work. Andrew -- Andrew Watkins * Birkbeck, University of London * Computer Science * * http://notallmicrosoft.blogspot.com * * UKOUG Systems * * UKOUG Tech committee * * tel: 020 7631 6720 * ::e-mails are only read & actioned between 0900 and 1730 hours (Monday - Friday) ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
Hi there, On Wed, 13 Nov 2019, Andrew Watkins via clamav-users wrote: On 11/13/19 10:33 AM, G.W. Haywood via clamav-users wrote: Perhaps clamd is reloading its databases when you see this. Depending on configuration and the host performance it can take anywhere between a few tens of seconds and several minutes to reload all the databases... Ah! I had read that discussion, but didn't put 2 and 2 together since I thought the database re-load had finished, but I think it may be this. I will look at download and build patched version. You could of course just increase your timeouts. :) -- 73, Ged. ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
On 11/13/19 10:33 AM, G.W. Haywood via clamav-users wrote: Perhaps clamd is reloading its databases when you see this. Depending on configuration and the host performance it can take anywhere between a few tens of seconds and several minutes to reload all the databases, and during that time currently released versions of clamd won't scan. Check the logs for the reload messages. There's a patch currently in testing which permits clamd to continue scanning while reloading, the patch is available if you wish to build clamd yourself, and it should be available in a released version of clamd quite soon I hope. There has been some discussion on this list recently if you'd like to look. Ah! I had read that discussion, but didn't put 2 and 2 together since I thought the database re-load had finished, but I think it may be this. I will look at download and build patched version. Cheers, Andrew -- Andrew Watkins * Birkbeck, University of London * Computer Science * * http://notallmicrosoft.blogspot.com * * UKOUG Systems * * UKOUG Tech committee * * tel: 020 7631 6720 * ::e-mails are only read & actioned between 0900 and 1730 hours (Monday - Friday) ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
On 11/13/19 10:26 AM, Reio Remma via clamav-users wrote: On 13/11/2019 12:19, Andrew Watkins via clamav-users wrote: Check if it's coinciding with clamd reloading its databases. Clamd currently doesn't scan when reloading databases. Look for: Nov 13 11:37:04 clamd clamd[15795]: SelfCheck: Database modification detected. Forcing reload. Nov 13 11:37:04 clamd clamd[15795]: Reading databases from /var/lib/clamav Nov 13 11:37:56 clamd clamd[15795]: Database correctly reloaded (13057843 signatures) Good luck, Reio Thanks, but should have said. Reload takes place at 10 mins past the hour, but saying that most errors are between 11 to 29 past the hour. Will look again... Andrew -- Andrew Watkins * Birkbeck, University of London * Computer Science * * http://notallmicrosoft.blogspot.com * * UKOUG Systems * * UKOUG Tech committee * * tel: 020 7631 6720 * ::e-mails are only read & actioned between 0900 and 1730 hours (Monday - Friday) ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
Hi there, On Wed, 13 Nov 2019, Andrew Watkins via clamav-users wrote: I get the following error a few times a day for a while, so I thought I would look into it. I am using mimedefang to send mail to clamd and it works fine, but at random point of the day I get the error: mimedefang.pl[26234]: xAD8PbeZ009878: Timeout reading from clamd daemon at /var/spool/MIMEDefang/clamd.sock Perhaps clamd is reloading its databases when you see this. Depending on configuration and the host performance it can take anywhere between a few tens of seconds and several minutes to reload all the databases, and during that time currently released versions of clamd won't scan. Check the logs for the reload messages. There's a patch currently in testing which permits clamd to continue scanning while reloading, the patch is available if you wish to build clamd yourself, and it should be available in a released version of clamd quite soon I hope. There has been some discussion on this list recently if you'd like to look. -- 73, Ged. ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
On 13/11/2019 12:19, Andrew Watkins via clamav-users wrote: Hello, I get the following error a few times a day for a while, so I thought I would look into it. I am using mimedefang to send mail to clamd and it works fine, but at random point of the day I get the error: mimedefang.pl[26234]: xAD8PbeZ009878: Timeout reading from clamd daemon at /var/spool/MIMEDefang/clamd.sock mimedefang.pl[26234]: xAD8PbeZ009878: Problem running virus scanner: code=999, category=cannot-execute, The problem is clamd has not being sent any other mails so don't see it is a queuing problem. For example I added a debug in mimedefang when it sends data to clamd: mail 1) Nov 13 08:19:10 mimedefang send data to clamd mail 1) Nov 13 08:19:11 mimedefang receives an answer mail 2) Nov 13 08:25:38 mimedefang send data to clamd mail 2) Nov 13 08:26:38 Timeout reading from clamd daemon at /var/spool/MIMEDefang/clamd.sock YES! 60 seconds mail 2) Nov 13 08:26:38 mimedefang tries again mail 2) Nov 13 08:26:38 mimedefang gets error: Problem running virus scanner: code=999, category=cannot-execute, action=tempfail mail 3) Nov 13 08:28:21 works again So, my question is there any tracing I can put in place so that I can see what clamd is doing at this time. I looked at clamdtop but that show live information so no good. At this time the email it breaks on is randon and small. Check if it's coinciding with clamd reloading its databases. Clamd currently doesn't scan when reloading databases. Look for: Nov 13 11:37:04 clamd clamd[15795]: SelfCheck: Database modification detected. Forcing reload. Nov 13 11:37:04 clamd clamd[15795]: Reading databases from /var/lib/clamav Nov 13 11:37:56 clamd clamd[15795]: Database correctly reloaded (13057843 signatures) Good luck, Reio ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
[clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail
Hello, I get the following error a few times a day for a while, so I thought I would look into it. I am using mimedefang to send mail to clamd and it works fine, but at random point of the day I get the error: mimedefang.pl[26234]: xAD8PbeZ009878: Timeout reading from clamd daemon at /var/spool/MIMEDefang/clamd.sock mimedefang.pl[26234]: xAD8PbeZ009878: Problem running virus scanner: code=999, category=cannot-execute, The problem is clamd has not being sent any other mails so don't see it is a queuing problem. For example I added a debug in mimedefang when it sends data to clamd: mail 1) Nov 13 08:19:10 mimedefang send data to clamd mail 1) Nov 13 08:19:11 mimedefang receives an answer mail 2) Nov 13 08:25:38 mimedefang send data to clamd mail 2) Nov 13 08:26:38 Timeout reading from clamd daemon at /var/spool/MIMEDefang/clamd.sock YES! 60 seconds mail 2) Nov 13 08:26:38 mimedefang tries again mail 2) Nov 13 08:26:38 mimedefang gets error: Problem running virus scanner: code=999, category=cannot-execute, action=tempfail mail 3) Nov 13 08:28:21 works again So, my question is there any tracing I can put in place so that I can see what clamd is doing at this time. I looked at clamdtop but that show live information so no good. At this time the email it breaks on is randon and small. Thanks, Andrew -- Andrew Watkins * Birkbeck, University of London * Computer Science * * http://notallmicrosoft.blogspot.com * * UKOUG Systems * * UKOUG Tech committee * * tel: 020 7631 6720 * ::e-mails are only read & actioned between 0900 and 1730 hours (Monday - Friday) ___ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [Clamav-users] Problem running virus scanner: code=999
Noel Jones wrote: Richard J. Kieran wrote: I can't believe I got not a single response to this, so I'm trying again: I'm running clamd with MIMEDefang on a CentOS machine. Once in a while there will be a day when there are many Problem running virus scanner: code=999 errors, anywhere from 1 or 2 (who cares?) to 4486 (now I'm concerned...), like yesterday. The next day, all will be back to normal until it happens again. Here is a maillog entry: Dec 1 00:03:15 fdr mimedefang.pl[4798]: mB153Ere005745: Could not connect to clamd daemon at /var/spool/MIMEDefang/clamd.sock This is the real problem, mimedefang can't connect to clamd. Maybe clamd isn't running, or maybe there are too many connections. If clamd is running, check the settings of MaxConnectionQueueLength and MaxThreads in clamd.conf. Thanks. I tried bumping these settings up from the defaults. We'll see what happens. The clamd clamd.sock is in use error will only occur when you start clamd when it's already running. I have a script that shuts down then restarts all of the spam-filter related programs. I sometimes see this error when I run it manually. I also invoke this script when too many virus scanner errors are seen in the log file by a script that runs under cron hourly. I'll build in a delay between killing and restarting clamd and see if that helps with this one. Richard -- Noel Jones ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
[Clamav-users] Problem running virus scanner: code=999
I can't believe I got not a single response to this, so I'm trying again: I'm running clamd with MIMEDefang on a CentOS machine. Once in a while there will be a day when there are many Problem running virus scanner: code=999 errors, anywhere from 1 or 2 (who cares?) to 4486 (now I'm concerned...), like yesterday. The next day, all will be back to normal until it happens again. Here is a maillog entry: Dec 1 00:03:15 fdr mimedefang.pl[4798]: mB153Ere005745: Could not connect to clamd daemon at /var/spool/MIMEDefang/clamd.sock Dec 1 00:03:15 fdr mimedefang.pl[4798]: Problem running virus scanner: code=999, category=cannot-execute, action=tempfail Dec 1 00:03:15 fdr mimedefang.pl[4798]: filter: mB153Ere005745: tempfail=1 Dec 1 00:03:15 fdr mimedefang[4793]: mB153Ere005745: Tempfailing because filter instructed us to Dec 1 00:03:15 fdr sm-mta[5745]: mB153Ere005745: Milter: data, reject=451 4.3.0 Problem running virus-scanner I found this entry in the clamd.log: Mon Dec 1 11:02:11 2008 - ERROR: LOCAL: Socket file /var/spool/MIMEDefang/clamd.sock is in use by another process. Occurrences of the first error seem to be vaguely accompanied by the second, but I have seen the second when restarting clamd manually, and I have a script that restarts clamd when it sees virus scanner errors in the maillog, so that may explain the relationship. If that is a separate problem, I'd like to solve it also, but the tempfails are more of a concern at the moment. Richard ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
Re: [Clamav-users] Problem running virus scanner: code=999
Richard J. Kieran wrote: I can't believe I got not a single response to this, so I'm trying again: I'm running clamd with MIMEDefang on a CentOS machine. Once in a while there will be a day when there are many Problem running virus scanner: code=999 errors, anywhere from 1 or 2 (who cares?) to 4486 (now I'm concerned...), like yesterday. The next day, all will be back to normal until it happens again. Here is a maillog entry: Dec 1 00:03:15 fdr mimedefang.pl[4798]: mB153Ere005745: Could not connect to clamd daemon at /var/spool/MIMEDefang/clamd.sock This is the real problem, mimedefang can't connect to clamd. Maybe clamd isn't running, or maybe there are too many connections. If clamd is running, check the settings of MaxConnectionQueueLength and MaxThreads in clamd.conf. Dec 1 00:03:15 fdr mimedefang.pl[4798]: Problem running virus scanner: code=999, category=cannot-execute, action=tempfail Dec 1 00:03:15 fdr mimedefang.pl[4798]: filter: mB153Ere005745: tempfail=1 Dec 1 00:03:15 fdr mimedefang[4793]: mB153Ere005745: Tempfailing because filter instructed us to Dec 1 00:03:15 fdr sm-mta[5745]: mB153Ere005745: Milter: data, reject=451 4.3.0 Problem running virus-scanner These four entries are mimedefang errors and not really useful beyond they tell us that the message was tempfailed because mimedefang couldn't talk to clamd. I found this entry in the clamd.log: Mon Dec 1 11:02:11 2008 - ERROR: LOCAL: Socket file /var/spool/MIMEDefang/clamd.sock is in use by another process. Something tried to (re)start clamd but the socket already existed and something was using the socket. My assumption is that clamd is already running and something/someone tried to start it again. Occurrences of the first error seem to be vaguely accompanied by the second, but I have seen the second when restarting clamd manually, and I have a script that restarts clamd when it sees virus scanner errors in the maillog, so that may explain the relationship. If that is a separate problem, I'd like to solve it also, but the tempfails are more of a concern at the moment. Richard It's not clear what you mean by first and second error. I expect the mimedefang.pl could not connect error to always be followed by one or more of the code=999 friends error sequence. The clamd clamd.sock is in use error will only occur when you start clamd when it's already running. -- Noel Jones ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
[Clamav-users] Problem running virus scanner: code=999
I'm running clamd with MIMEDefang on a CentOS machine. Once in a while there will be a day when there are many Problem running virus scanner: code=999 errors, anywhere from 1 or 2 (who cares?) to 4486 (now I'm concerned...), like yesterday. The next day, all will be back to normal until it happens again. Here is a maillog entry: Dec 1 00:03:15 fdr mimedefang.pl[4798]: mB153Ere005745: Could not connect to clamd daemon at /var/spool/MIMEDefang/clamd.sock Dec 1 00:03:15 fdr mimedefang.pl[4798]: Problem running virus scanner: code=999, category=cannot-execute, action=tempfail Dec 1 00:03:15 fdr mimedefang.pl[4798]: filter: mB153Ere005745: tempfail=1 Dec 1 00:03:15 fdr mimedefang[4793]: mB153Ere005745: Tempfailing because filter instructed us to Dec 1 00:03:15 fdr sm-mta[5745]: mB153Ere005745: Milter: data, reject=451 4.3.0 Problem running virus-scanner I found this entry in the clamd.log: Mon Dec 1 11:02:11 2008 - ERROR: LOCAL: Socket file /var/spool/MIMEDefang/clamd.sock is in use by another process. Occurrences of the first error seem to be vaguely accompanied by the second, but I have seen the second when restarting clamd manually, and I have a script that restarts clamd when it sees virus scanner errors in the maillog, so that may explain the relationship. If that is a separate problem, I'd like to solve it also, but the tempfails are more of a concern at the moment. Richard ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
