Messages in log unseen before.

[Ugo Bellavance]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Ken Goods wrote:
> Steen, Glenn wrote:
> 
> <snip>
>  
> 
>>>I upgraded clamav to 0.85.1 last Wednesday and I still get these
>>>messages: 
>>>
>>>Jun 14 08:25:09 gw-mail MailScanner[5408]: Commercial scanner clamav
>>>timed out! Jun 14 08:25:09 gw-mail MailScanner[5408]: Virus
>>>Scanning: Denial Of Service attack detected! 
>>>
>>>I don't remember ever seeing these before and I couldn't find
>>>anything with a google or ClamAV site/archive search.
>>>
>>>Can anyone give me a clue as to what these are and whether I should
>>>be concerned, or are these messages not even generated by
>>>MailScanner? (in which case I'll post to the clamav list)
>>>
>>>Thanks
>>>Ken
>>>
>>
>>Is it for every message, or for some? If you run the clamav-wrapper,
>>does
>>it take an inordinate time to finish?
>>
>>-- Glenn
> 
> 
> Doesn't seem to be hitting on every message. Seems to happen every 7-9
> minutes. 
> 
> This output is from: grep timed maillog
> 
> Jun 15 03:55:38 gw-mail MailScanner[21501]: Commercial scanner clamav timed
> out!
> Jun 15 04:02:49 gw-mail MailScanner[21860]: Commercial scanner clamav timed
> out!
> Jun 15 04:11:14 gw-mail MailScanner[21951]: Commercial scanner clamav timed
> out!
> Jun 15 04:18:57 gw-mail MailScanner[21757]: Commercial scanner clamav timed
> out!
> Jun 15 04:27:11 gw-mail MailScanner[22314]: Commercial scanner clamav timed
> out!
> Jun 15 04:34:09 gw-mail MailScanner[22713]: Commercial scanner clamav timed
> out!
> Jun 15 04:41:09 gw-mail MailScanner[22838]: Commercial scanner clamav timed
> out!
> Jun 15 04:48:38 gw-mail MailScanner[23053]: Commercial scanner clamav timed
> out!
> Jun 15 04:56:26 gw-mail MailScanner[21809]: Commercial scanner clamav timed
> out!
> Jun 15 05:03:40 gw-mail MailScanner[21383]: Commercial scanner clamav timed
> out!
> Jun 15 05:10:59 gw-mail MailScanner[22939]: Commercial scanner clamav timed
> out!
> Jun 15 05:18:03 gw-mail MailScanner[23391]: Commercial scanner clamav timed
> out!
> Jun 15 05:25:27 gw-mail MailScanner[23304]: Commercial scanner clamav timed
> out!
> Jun 15 05:32:43 gw-mail MailScanner[23476]: Commercial scanner clamav timed
> out!
> Jun 15 05:39:52 gw-mail MailScanner[23578]: Commercial scanner clamav timed
> out!
> Jun 15 05:46:53 gw-mail MailScanner[23618]: Commercial scanner clamav timed
> out!
> Jun 15 05:54:08 gw-mail MailScanner[23207]: Commercial scanner clamav timed
> out!
> Jun 15 06:01:39 gw-mail MailScanner[23690]: Commercial scanner clamav timed
> out!
> Jun 15 06:08:44 gw-mail MailScanner[23801]: Commercial scanner clamav timed
> out!
> Jun 15 06:15:43 gw-mail MailScanner[23509]: Commercial scanner clamav timed
> out!
> Jun 15 06:23:17 gw-mail MailScanner[23937]: Commercial scanner clamav timed
> out!
> Jun 15 06:30:40 gw-mail MailScanner[23100]: Commercial scanner clamav timed
> out!
> Jun 15 06:38:09 gw-mail MailScanner[24120]: Commercial scanner clamav timed
> out!
> Jun 15 06:46:33 gw-mail MailScanner[24053]: Commercial scanner clamav timed
> out!
> Jun 15 06:53:29 gw-mail MailScanner[24387]: Commercial scanner clamav timed
> out!
> Jun 15 07:00:43 gw-mail MailScanner[23734]: Commercial scanner clamav timed
> out!
> Jun 15 07:08:18 gw-mail MailScanner[24253]: Commercial scanner clamav timed
> out!
> Jun 15 07:15:14 gw-mail MailScanner[24756]: Commercial scanner clamav timed
> out!
> Jun 15 07:23:25 gw-mail MailScanner[24509]: Commercial scanner clamav timed
> out!
> Jun 15 07:30:57 gw-mail MailScanner[24591]: Commercial scanner clamav timed
> out!
> Jun 15 07:38:09 gw-mail MailScanner[24948]: Commercial scanner clamav timed
> out!
> Jun 15 07:46:17 gw-mail MailScanner[25173]: Commercial scanner clamav timed
> out!
> Jun 15 07:53:19 gw-mail MailScanner[24895]: Commercial scanner clamav timed
> out!
> Jun 15 08:00:53 gw-mail MailScanner[25077]: Commercial scanner clamav timed
> out!
> Jun 15 08:08:33 gw-mail MailScanner[24322]: Commercial scanner clamav timed
> out!
> Jun 15 08:15:59 gw-mail MailScanner[25238]: Commercial scanner clamav timed
> out!
> Jun 15 08:23:18 gw-mail MailScanner[25485]: Commercial scanner clamav timed
> out!
> Jun 15 08:30:13 gw-mail MailScanner[25882]: Commercial scanner clamav timed
> out!
> Jun 15 08:37:57 gw-mail MailScanner[26077]: Commercial scanner clamav timed
> out!
> Jun 15 08:45:55 gw-mail MailScanner[26174]: Commercial scanner clamav timed
> out!
> Jun 15 08:53:41 gw-mail MailScanner[26398]: Commercial scanner clamav timed
> out!
> Jun 15 09:01:20 gw-mail MailScanner[25378]: Commercial scanner clamav timed
> out!
> Jun 15 09:09:39 gw-mail MailScanner[25703]: Commercial scanner clamav timed
> out!
> Jun 15 09:17:46 gw-mail MailScanner[26562]: Commercial scanner clamav timed
> out!
> Jun 15 09:25:20 gw-mail MailScanner[26732]: Commercial scanner clamav timed
> out!
> Jun 15 09:32:42 gw-mail MailScanner[26904]: Commercial scanner clamav timed
> out!
> Jun 15 09:40:15 gw-mail MailScanner[27267]: Commercial scanner clamav timed
> out!
> Jun 15 09:47:31 gw-mail MailScanner[27135]: Commercial scanner clamav timed
> out!
> Jun 15 09:55:47 gw-mail MailScanner[27448]: Commercial scanner clamav timed
> out!
> Jun 15 10:04:13 gw-mail MailScanner[25988]: Commercial scanner clamav timed
> out!
> 
> I can't imagine what would be happening during that timeframe. This all
> started a couple weeks ago and at the same time my load went from averaging
> .3 to 1-2. I did not make any changes to the system and it has been running
> well since the last MailScanner/Spamassassin/ClamAV upgrade a couple months
> ago.
> 
> MailScanner does use the clamav-wrapper but I can't tell how long clamscan
> is taking to complete. Is it more efficient to use the clamavmodule? If so
> I'll look into getting it configured and running.
> 
> Any insight would be appreciated much.

Have you upgraded MailScanner to the latest stable version as well?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!