Clamav Ping Timeout During Update

[Neal Morgan]

 Rick Cooper wrote: 
 > 
 > Julian Field wrote: 
 > > 
 > > Neal Morgan wrote:
 > > > Greetings:
 > > >
 > > > My Mailscanner has been reporting timeouts when clamav updates
its
 > > > database.  I see entries like this in syslog:
 > > >
 > > > 2008-03-03 08:41:10.000	Server-05	MailScanner[20773]:
 > > > Clamd::ERROR:: CLAM PING TIMED OUT! :: .
 > > >
 > > >
 > > > If I review the clamav log, it seems that the timeout always
occurs
 > > > within several seconds of the "database reloaded" entry:
 > > >
 > > > Mon Mar  3 08:30:21 2008 -> SelfCheck: Database 
 > > modification detected.
 > > > Forcing reload.
 > > > Mon Mar  3 08:30:21 2008 -> Reading databases from
/var/lib/clamav
 > > > Mon Mar  3 08:41:09 2008 -> Database correctly reloaded (223704
 > > > signatures)
 > > >   
 > > The ping timeout is set to 90 seconds. This should be way 
 > > more than is 
 > > needed for a database reload. You are welcome to try 
 > > increasing it, look 
 > > for the setting of the variable "PingTimeOut" in SweepViruses.pm.
 > > 
 > > >
 >
 >I would think MailScanner wouldn't even bother to monitor the database
files
 >if not using ClamAVModule as clamd handles reloading upon updates and
 >MailScanner shouldn't care because it's not going to load them anyway.
It
 >kind of makes me wonder if he is running both clamd and clamavmodule
 >
 >Rick
 >
 >

Thanks Julian and Rick for your responses.  I am running clamd, and when
I run the lint test MailScanner correctly finds it.  I am not
referencing clamavmodule.  (Lint confirms this as well).

I did have the "Monitors for ClamAV Updates" configured in
MailScanner.conf (upgrade_MailScanner_conf complained about them on my
last upgrade, so I updated the line to point to the proper locations).
Rick, per your suggestion, I have taken this setting out.

I am using Unix sockets.  To be sure MailScanner isn't trying TCP/IP, I
took the port number out leaving only the path to the socket.  One thing
that might be of interest, my clamd does create a socket and pid file,
but doesn't create a lock file (that I can find).  Could this have an
impact?

As far as other messages in the clamav.log file, the only other ones I
find are 1) self check, and 2) the occasional "file not found."  Those
seem to correspond with MailScanner reporting "not spam (too large)".

Anyway, I am still left with the behavior that I get the ping timeout
messages within 1 to 3 seconds of the time clamav.log reports "Database
correctly reloaded".  Weird.

I agree that 90 seconds is more than enough.  Changing this has no
effect on the problem.

If others running clamd aren't getting these
	"MailScanner[4899]: ClamD Timed Out During PING Check!" 
	and " MailScanner[3841]: Clamd::ERROR:: CLAM PING TIMED OUT! ::
." messages, then it must be something I have mis-configured.  ...I just
have no idea what that is.  

Any other suggestions?


Many thanks,

Neal Morgan