ClamAV constantly failing

[Jerry Benton]

Check your “PID File” setting in MailScanner.conf. If it is something like this : /var/run/MailScanner/MailScanner.pid change it to this: /var/run/MailScanner.pid and reboot. 

Using the directory in /var/run can cause problems if the directory cannot be created. Thus, every hour when MailScanner checks to see if the MailScanner process is running, it will not find the PID from the PID file for MailScanner (because it cannot be created) and it will start another MailScanner process. This continues until you use all of your memory and clamd cannot run. 


-
Jerry Benton
www.mailborder.com



> On Apr 12, 2016, at 12:00 AM, Jason Voorhees <jvoorhees1 at gmail.com> wrote:
> 
> By the way, I forgot to mention that when MailScanner is unable to
> analyze a message with ClamAV, it keeps attempting many times but each
> time is logged once and again in SQL by using the "Always Looked Up
> Last = &MailwatchLogging". At the end, one message that was attempted
> to be delivered 100 times is shown 100 times in my Mailwatch Web GUI
> under "Recent messages" tab.
> 
> Is there a way to not allow MailScanner to log this message once and again?
> 
> Thx
> 
> On Mon, Apr 11, 2016 at 10:14 PM, Jason Voorhees <jvoorhees1 at gmail.com> wrote:
>> Hello guys:
>> 
>> I'm running CentOS 7 x86_64 with MailScanner 4.85.2-3 and clamav
>> 0.99.1 from EPEL. These are my clamav packages installed:
>> 
>> clamav-data-0.99.1-1.el7.noarch
>> clamav-server-systemd-0.99.1-1.el7.noarch
>> clamav-unofficial-sigs-3.7.2-1.el7.noarch
>> clamav-server-0.99.1-1.el7.x86_64
>> clamav-0.99.1-1.el7.x86_64
>> clamav-lib-0.99.1-1.el7.x86_64
>> clamav-scanner-0.99.1-1.el7.noarch
>> clamav-scanner-systemd-0.99.1-1.el7.noarch
>> clamav-filesystem-0.99.1-1.el7.noarch
>> clamav-update-0.99.1-1.el7.x86_64
>> 
>> What I'm experiencing is that several times a day clamd is failing.
>> There are several errors like:
>> 
>> 1. MailScanner cannot find clamd's socket even if it exists in
>> /var/run/clamd.scan/clamd.sock -> I have to stop clamd, remove the
>> socket file and start clamd again.
>> 
>> 2. MailScanner says clamd isn't running like this " Clamd::ERROR::
>> COULD NOT CONNECT TO CLAMD, RECOMMEND RESTARTING DAEMON" -> I have to
>> restart clamd or do some other troubleshooting.
>> 
>> 
>> 3. Clamd detects a failed or corrupted database file (i.e. main.cvd)
>> -> I have remove such db file, restart clamd and/or run freshclam.
>> 
>> I think there might be a bug in ClamAV because the same thing occurs
>> seldom in other similar installation from different customers.
>> 
>> Ok, I know this is not a ClamAV mailing list, but I wonder if there's
>> a way to tell MailScanner to not depend on ClamD if this isn't
>> running. Because, what's currently happening is that when one of these
>> clamd errors occur, MailScanner can't process messages correctly and
>> my mail queue starts to grow until I manually solve this.
>> 
>> 
>> I wonder if it's possible to tell MailScanner that must skip Antivirus
>> checking if AV isn't running but allows messages to be delivered
>> anyway instead of be holded in the queue.
>> 
>> 
>> Do you get my point? I hope someone can help me with some ideas.
>> 
>> 
>> Thanks in advance.
> 
> 
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/listinfo/mailscanner
>