[qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Michele Federici
Hi, I have a qmail server that today returns in the smtp log "mail server temporarily rejected message (# 4.3.0)". Everything works fine until the start of these errors on simscan Fri Jan 26 10:00:52 2018 -> /var/qmail/simscan/1516957251.438820.10197/doc05577520180126111044.pdf: OK Fri Jan

[qmailtoaster] how to disable clamav updates

2018-01-26 Thread Rajesh M
hi all, how to disable clamav updates basically i do not want clamav downloading the daily.cvd and other files automatically i removed the following but in sometime these got automatically updated daily.cld main.cld bytecode.cld mirrors.dat rajesh

Re: [qmailtoaster] clamav KO - ERROR: accept() failed

2018-01-26 Thread Havrla
heloo yes same: Jan 26 11:24:50 tonda clamd: LibClamAV Error: cli_gentempfd: Can't create temporary file /tmp/clamav-4cfa012223685613cbdd51ea20c64a9a.tmp/clamav-696c37f51f984623e21bb7af92cbbf08.tmp: Too many open files Jan 26 11:24:50 tonda clamd: LibClamAV Warning: fileblobScan, fullname ==

Re: [qmailtoaster] Simscan

2018-01-26 Thread Eric Broch
# qmailctl stop # qmailctl stat (make sure it's stopped) In /etc/tcprules.d/tcp.smtp change QMAILQUEUE="/var/qmail/bin/simscan" to QMAILQUEUE="/var/qmail/bin/qmail-queue.orig" qmailctl cdb qmailctl start On 1/26/2018 7:04 AM, Jeff Koch wrote: Hi Eric - we're having massive problems this

Re: [qmailtoaster] how to disable clamav updates

2018-01-26 Thread Havrla
systemctl stop clamav-freshclam.service systemctl disable clamav-freshclam.service or /etc/init.d/freshclam sto chkconfig --level 0123456 freshclam off H. Dne 26.1.2018 v 11:59 Rajesh M napsal(a): hi all, how to disable clamav updates basically i do not want clamav downloading the

Re: [qmailtoaster] Simscan

2018-01-26 Thread Havrla
Hi, Eric problem = clamav after update (antivir base) simscan no problem LOG: Jan 26 11:24:50 tonda clamd: LibClamAV Error: cli_gentempfd: Can't create temporary file /tmp/clamav-4cfa012223685613cbdd51ea20c64a9a.tmp/clamav-696c37f51f984623e21bb7af92cbbf08.tmp: Too many open files Jan 26

Re: [qmailtoaster] Simscan

2018-01-26 Thread Tommi Järvilehto
Same here one of our servers (CentOs6 64bit). CentOS5 and CentOS7 servers currently ok. I disabled now simscan temporarily. On 26.1.2018 16:24, Havrla wrote: Hi, Eric problem = clamav  after update (antivir base) simscan no problem LOG: Jan 26 11:24:50 tonda clamd: LibClamAV Error:

Re: [qmailtoaster] Simscan

2018-01-26 Thread Rajesh M
hi the temporary resolution is as such cd /var/lib/clamav service clamd stop mv daily.cld daily.cld.BAK mv main.cld main.cld.BAK mv bytecode.cld bytecode.cld.BAK also rename any main.cvd daily.cvd bytecode.cvd keep foxhole_all and badmacro.ndb unoffical which handles all kinds of bad

Re: [qmailtoaster] Simscan

2018-01-26 Thread Eric Broch
Thanks, Havrla!!! On 1/26/2018 7:24 AM, Havrla wrote: Hi, Eric problem = clamav  after update (antivir base) simscan no problem LOG: Jan 26 11:24:50 tonda clamd: LibClamAV Error: cli_gentempfd: Can't create temporary file

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Peter Peltonen
First thing that comes to my mind is to check qmail directory ownerships and permissions? On Fri, Jan 26, 2018 at 12:24 PM, Michele Federici wrote: > Hi, > > I have a qmail server that today returns in the smtp log "mail server > temporarily rejected message (# 4.3.0)". > >

Re: [qmailtoaster] Simscan

2018-01-26 Thread Eric Broch
Thanks, Rajesh!!! On 1/26/2018 8:34 AM, Rajesh M wrote: hi the temporary resolution is as such cd /var/lib/clamav service clamd stop mv daily.cld daily.cld.BAK mv main.cld main.cld.BAK mv bytecode.cld bytecode.cld.BAK also rename any main.cvd daily.cvd bytecode.cvd keep foxhole_all and

[qmailtoaster] Simscan

2018-01-26 Thread Eric Broch
Hi List, It seems we have more simscan issues with qq soft rejects of late though this has been plaguing qmail for a very long time. I'm sick of this issue and decided to build a version of simscan with more extensive debugging using thelibexplain

Re: [qmailtoaster] clamav KO - ERROR: accept() failed

2018-01-26 Thread Eric Broch
I think you're right...a server that all of a sudden stops working with no changes except clamav definitions On 1/26/2018 10:16 AM, Jeff Koch wrote: Hi - I don't think this has anything to do with the problem - the ClamAV team at Cisco released a buggy set of definitions last night and they

Re: [qmailtoaster] clamav KO - ERROR: accept() failed

2018-01-26 Thread Remo Mattei
I remember that my qmail7 is running on mem simscan-disk/var/qmail/simscan tmpfs size=5100M,nodev,noexec,noatime,uid=46,gid=46,mode=2750 0 0 Wonder if that does anything since I do not have any /tmp/clamav stuff > On Jan 26, 2018, at 6:00 PM, Havrla

Re: [qmailtoaster] clamav KO - ERROR: accept() failed

2018-01-26 Thread hav...@lhotkanet.cz
Run lsofH. Odesláno z mobil. zařízení Huawei Původní zpráva Předmět: Re: [qmailtoaster] clamav KO - ERROR: accept() failedOdesílatel: Remo Mattei Komu: qmailtoaster-list@qmailtoaster.comKopie: I remember that my qmail7 is running on mem simscan-disk      

Re: [qmailtoaster] clamav KO - ERROR: accept() failed

2018-01-26 Thread Michele Federici
Hi, A new versione was released 24258 http://lists.clamav.net/pipermail/clamav-virusdb/2018-January/thread.html Other news from clamav http://lists.clamav.net/pipermail/clamav-users/2018-January/005737.html Thank you all -- Michele

Re: [qmailtoaster] clamav KO - ERROR: accept() failed

2018-01-26 Thread Remo Mattei
On Centos 7 Qmail7 clamav >ls -al total 244040 drwxr-xr-x 3 clamav clamav 4096 Jan 26 07:41 . drwxr-xr-x. 47 root root4096 Dec 16 08:17 .. -rw-r--r-- 1 clamav clamav766976 Dec 6 20:20 bytecode.cld drwxr-xr-x 2 clamav clamav 4096 Dec 7 18:36

Re: [qmailtoaster] clamav KO - ERROR: accept() failed

2018-01-26 Thread Remo Mattei
On my qmail centos 5 Still good and running an older version ClamAV update process started at Fri Jan 26 10:29:30 2018 WARNING: Your ClamAV installation is OUTDATED! WARNING: Local version: 0.97 Recommended version: 0.99.3 DON'T PANIC! Read http://www.clamav.net/support/faq main.cld is up to

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Eric Broch
Ahhh! ClamAV again. On 1/26/2018 8:57 AM, Havrla wrote: Peter: detail my log: Jan 26 11:24:50 tonda clamd: LibClamAV Error: cli_gentempfd: Can't create temporary file /tmp/clamav-4cfa012223685613cbdd51ea20c64a9a.tmp/clamav-696c37f51f984623e21bb7af92cbbf08.tmp: Too many open files Havrla

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Sean Murphy
This seems like the situation we were experiencing back in March of last year, where a bad daily hit servers running CentOS 5 until they changed how clamav used pcre to link the database.  I don't know if it's the same case here. Our CentOS 5 server (32-bit) and CentOS 7 server (64-bit) are

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Havrla
Hi Restart clamav fix only for cca 1 hour. After problem back. I turned off simscan for clamav. file /var/qmail/control/simcontrol :clam=no,spam=yes,spam_hits=12,attach=.src:.bat:.pif:.js /etc/init.d/qmail cdb I'm waiting for another update clamav (antivir base). We'll see tomorrow. H.

Re: [qmailtoaster] clamav KO - ERROR: accept() failed

2018-01-26 Thread Remo Mattei
Here is what is mine set to -rws--x--x 1 clamav root 34774 Apr 6 2016 simscan And increased the exec /usr/bin/softlimit -m 6400 \ All good here. Remo > On Jan 26, 2018, at 11:55 AM, Havrla wrote: > > Can't create temporary file

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Remo Mattei
Michele a me funziona con la versione che hai tu. I have the same version and it’s all working permissions check my email Inviato da iPhone > Il giorno 26 gen 2018, alle ore 16:47, Peter Peltonen > ha scritto: > > First thing that comes to my mind is to check

Re: [qmailtoaster] This day - ClamAV problem

2018-01-26 Thread Havrla
"statement" Problem: Fri Jan 26 10:01:20 2018 -> /var/qmail/simscan/1516957279.523709.10292/textfile3: Can't open file or directory ERROR or Jan 26 11:24:50 tonda clamd: LibClamAV Error: cli_gentempfd: Can't create temporary file

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Michele Federici
Hi, I have in my centos 7 drwxr-x---   2 clamav root 6 26 gen 17.44 simscan and exec /usr/bin/softlimit -m 6400 \ The server configuration did not change and the anomaly start this morning. What versions do you

Re: [qmailtoaster] clamav KO - ERROR: accept() failed

2018-01-26 Thread Michele Federici
Hi, I have the same in temp #ls -ila [..]  202457136 drwx-- 2 clamav   clamav  6 26 gen 10.51 clamav-007dd5550d9cb969386d676f774cf578.tmp 2551809303 drwx-- 2 clamav   clamav  6 26 gen 12.04

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Remo Mattei
I recall to fix this with some permissions I am in Europe now will check ASAP and share my settings. Inviato da iPhone > Il giorno 26 gen 2018, alle ore 11:24, Michele Federici > ha scritto: > > Hi, > > I have a qmail server that today returns in the smtp log "mail

[qmailtoaster] 回覆︰ [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Henry
I also face this problem at centos 5, centos 6 centos 6:clamav-0.99.2-3.qt.el6.x86_64 centos 5:clamav-toaster-0.99.2-1.4.14 Remo Mattei 於 2018年01月27日 (週六) 12:33 AM 寫道﹕ I recall to fix this with some permissions I am in Europe now will check ASAP and share my

Re: [qmailtoaster] clamav KO - ERROR: accept() failed

2018-01-26 Thread Havrla
Remo: Good Temporarily ClamAV not close file descriptor: lsof | grep clamav | grep delete more more more clamd 160821 171659clamav 26u REG 253,0 2 672063 /tmp/clamav-6066a4d288b5c900926781c172bc116b.tmp (deleted) clamd 160821 171659clamav 27u

Re: [qmailtoaster] clamav KO - ERROR: accept() failed

2018-01-26 Thread Jeff Koch
Hi - I don't think this has anything to do with the problem - the ClamAV team at Cisco released a buggy set of definitions last night and they need patch that before ClamAV works properly again. Plus they need to fix the clamav code so that a buggy set of definitions will fall back to

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Havrla
Peter: detail my log: Jan 26 11:24:50 tonda clamd: LibClamAV Error: cli_gentempfd: Can't create temporary file /tmp/clamav-4cfa012223685613cbdd51ea20c64a9a.tmp/clamav-696c37f51f984623e21bb7af92cbbf08.tmp: Too many open files Havrla Dne 26.1.2018 v 16:47 Peter Peltonen napsal(a): First

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Eric Broch
Hi  Michele Is the directory /var/qmail/simscan full? How much space do you have? Check out this link on the mailing list for permissions issues some have had: https://www.mail-archive.com/search?q=SOLVED+-+qq+soft+reject+with+Centos+7=qmailtoaster-list%40qmailtoaster.com On 1/26/2018 8:47

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Michele Federici
Hi, I have more than 200 GB free. But i think is the current clamav signature problem. This post is similar http://lists.clamav.net/pipermail/clamav-users/2018-January/005658.html If i restart clamav works all fine. Thank

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Michele Federici
Hi, I confirm you: after 1 hour the problem caming back I prefer do not stop clamav. I've create a script who check every few minutes "/var/log/clamd/clamd.log" and if there is an errore it restart clamav thank you -- Michele Federici Il

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Sean Murphy
Well, I spoke too soon, soft reject messages started popping up on my CentOS 5 server.  I have disabled ClamAV and will continue to monitor. On 1/26/2018 11:00 AM, Eric Broch wrote: Ahhh! ClamAV again. On 1/26/2018 8:57 AM, Havrla wrote: Peter: detail my log: Jan 26 11:24:50 tonda clamd:

Re: [qmailtoaster] ERROR: accept() failed

2018-01-26 Thread Eric Broch
-rw-r--r-- 1 clamav clamav    766976 Dec  6 20:54 bytecode.cld -rw-r--r-- 1 clamav clamav 131212800 Jan 26 03:46 daily.cld -rw-r--r-- 1 clamav clamav 307499008 Jun  7  2017 main.cld -rw--- 1 clamav clamav  1716 Jan 26 09:46 mirrors.dat ClamAV update process started at Fri Jan 26 10:10:06

Re: [qmailtoaster] clamav KO - ERROR: accept() failed

2018-01-26 Thread Sean Murphy
Just tried the new version and simscan still throws up the soft reject error, so that did not, in fact, fix the problem. On 1/26/2018 1:08 PM, Michele Federici wrote: Hi, A new versione was released 24258 http://lists.clamav.net/pipermail/clamav-virusdb/2018-January/thread.html Other news

[qmailtoaster] Current simscan problems due to clamav issues

2018-01-26 Thread Johannes Weberhofer
Dear all! I have seen the same issues as you have seen today. Attackers send e-mails containing PDFs causing DoS problems. German readers might read https://www.heise.de/security/meldung/Jetzt-patchen-Angriffe-auf-Viren-Scanner-ClamAV-3951801.html Everyone should update to 0.99.3 asap. This

[qmailtoaster] Fwd: FW: [clamav-users] ClamAV® blog: Update on the recent File Descriptors issue in ClamAV

2018-01-26 Thread Eric Broch
eric here is the culprit -- one of my servers has high traffic, and this issue was prevalent for the past over an year. i have simscan disabled on this server for the past over 1 year. rajesh - Original Message - From: Joel Esler (jesler) [mailto:jes...@cisco.com] To:

Re: [qmailtoaster] ClamAV 0.99.3

2018-01-26 Thread Chris
I installed your 0.99.3 package on CentOS 7 a couple of hours ago, and I am no longer seeing a buildup of orphaned filehandles in my lsof output. YMMV -Chris On Fri, Jan 26, 2018 at 6:20 PM, Eric Broch wrote: > No. I'm going to have to patch it...ugh! > > Patch is

[qmailtoaster] 回覆︰ [qmailtoaster] ClamAV 0.99.3

2018-01-26 Thread Henry
Eric, I need for Centos 5 version ClamAV, pls help Eric Broch 於 2018年01月27日 (週六) 9:38 AM 寫道﹕ Hello list members, The ClamAV 0.99.3 RPMS/SRPMS for COS 6 (i386, x86_64) & 7 (x86_64) are available for download or you can use Yum with the

Re: [qmailtoaster] ClamAV 0.99.3

2018-01-26 Thread Eric Broch
The patched 0.99.3-2 version... The ClamAV 0.99.3 RPMS/SRPMS for COS 6 (i386, x86_64) & 7 (x86_64) are available for download or you can use Yum with the --enablerepo=qmt-testing option ftp://ftp.qmailtoaster.org/pub/repo/qmt/CentOS/7/testing/x86_64/clamav-0.99.3-2.qt.el7.x86_64.rpm

Re: [qmailtoaster] ClamAV 0.99.3

2018-01-26 Thread Eric Broch
Are many people STILL experiencing these problems even after the ClamAV DB fix? One could only hope 0.99.3 solves it, but... These are the issues it covers according to Johannes W.'s email to the list: - Update to security release 0.99.3 (bsc#1077732)   * CVE-2017-12376 (ClamAV Buffer

Re: [qmailtoaster] ClamAV 0.99.3

2018-01-26 Thread Eric Broch
No. I'm going to have to patch it...ugh! Patch is here: https://src.fedoraproject.org/rpms/clamav/blob/master/f/clamav-0.99.2-temp-cleanup.patch On 1/26/2018 6:44 PM, Jeff Koch wrote: Eric - does anyone know if this solves the problem?  Jeff On 1/26/2018 8:37 PM, Eric Broch wrote: Hello

[qmailtoaster] ClamAV 0.99.3

2018-01-26 Thread Eric Broch
Hello list members, The ClamAV 0.99.3 RPMS/SRPMS for COS 6 (i386, x86_64) & 7 (x86_64) are available for download or you can use Yum with the --enablerepo=qmt-testing option ftp://ftp.qmailtoaster.com/pub/repo/qmt/CentOS/7/testing/x86_64/clamav-0.99.3-1.qt.el7.x86_64.rpm

Re: [qmailtoaster] ClamAV 0.99.3

2018-01-26 Thread Jeff Koch
Eric - does anyone know if this solves the problem?  Jeff On 1/26/2018 8:37 PM, Eric Broch wrote: Hello list members, The ClamAV 0.99.3 RPMS/SRPMS for COS 6 (i386, x86_64) & 7 (x86_64) are available for download or you can use Yum with the --enablerepo=qmt-testing option

Re: [qmailtoaster] ClamAV 0.99.3

2018-01-26 Thread Eric Broch
And, Jeff This DOES fix the problem. On 1/27/2018 12:37 AM, Eric Broch wrote: The patched 0.99.3-2 version... The ClamAV 0.99.3 RPMS/SRPMS for COS 6 (i386, x86_64) & 7 (x86_64) are available for download or you can use Yum with the --enablerepo=qmt-testing option

Re: [qmailtoaster] ClamAV 0.99.3

2018-01-26 Thread Sean P. Murphy
This would explain why I was still seeing the soft reject errors even after the signature fix. So, build this fix from SRPM as we would any new version of Clam? Or is there a different procedure? -Sean > On Jan 26, 2018, at 9:20 PM, Eric Broch wrote: > > No. I'm