<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 9.00.8112.16563"></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=885480222-26082014><FONT color=#0000ff
size=2 face=Arial>If the clamd daemon is local to the mailscanner machine I
would recommend switching to a unix socket instead of tcp. Set it in your
clamd.conf and then mirror the path and filename in the MailScanner.config such
as</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=885480222-26082014><FONT color=#0000ff
size=2 face=Arial>Clamd Socket = /tmp/clamd</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=885480222-26082014><FONT color=#0000ff
size=2 face=Arial></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=885480222-26082014><FONT color=#0000ff
size=2 face=Arial>Also I attached a small perl script that will check clamd and
make sure it's both up and running and capable of responding (the
PING/PONG)</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=885480222-26082014><FONT color=#0000ff
size=2 face=Arial>anything you can use to monitor program result codes can use
this as it returns 0 for OK and 1 for any issues, you can also have it log to
mail|info if you want to use a log file analizer and just call it from cron ever
min or so, there is very, very little overhead</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=885480222-26082014><FONT color=#0000ff
size=2 face=Arial></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=885480222-26082014><FONT color=#0000ff
size=2 face=Arial>Rick Cooper</FONT></SPAN></DIV><BR>
<DIV dir=ltr lang=en-us class=OutlookMessageHeader align=left>
<HR tabIndex=-1>
<FONT size=2 face=Tahoma><B>From:</B> mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] <B>On Behalf Of </B>Paul
Welsh<BR><B>Sent:</B> Tuesday, August 26, 2014 4:57 PM<BR><B>To:</B> MailScanner
discussion<BR><B>Subject:</B> Clamd error messages since last
week<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV dir=ltr>
<DIV class=gmail_extra>Running MailScanner 4.84.5 on CentOS 6.5
with ClamAV 0.98.3/19312/Tue Aug 26 15:54:25 2014.</DIV>
<DIV class=gmail_extra><BR></DIV>
<DIV class=gmail_extra>Starting Aug 22 15:30 I started getting these type
of messages in maillog:</DIV>
<DIV class=gmail_extra>MailScanner[6035]: Clamd::ERROR:: COULD NOT CONNECT TO
CLAMD, RECOMMEND RESTARTING DAEMON :: .<BR></DIV>
<DIV class=gmail_extra><BR></DIV>
<DIV class=gmail_extra>Seeing this kind of thing in maillog:</DIV>
<DIV class=gmail_extra>
<DIV class=gmail_extra>Aug 26 18:59:18 mail MailScanner[16465]: New Batch:
Scanning 1 messages, 15192 bytes</DIV>
<DIV class=gmail_extra>Aug 26 18:59:19 mail MailScanner[16465]: Virus and
Content Scanning: Starting</DIV>
<DIV class=gmail_extra>Aug 26 18:59:19 mail MailScanner[16465]: Clamd::ERROR::
COULD NOT CONNECT TO CLAMD, RECOMMEND RESTARTING DAEMON :: .</DIV>
<DIV class=gmail_extra>Aug 26 18:59:19 mail MailScanner[16465]: Virus Scanning:
Clamd found 1 infections</DIV>
<DIV class=gmail_extra>Aug 26 18:59:20 mail MailScanner[16465]: Virus Scanning:
Found 1 viruses</DIV>
<DIV class=gmail_extra>Aug 26 18:59:20 mail MailScanner[16465]: Spam Checks:
Starting</DIV>
<DIV><BR></DIV>
<DIV>The "found 1 infections" is a false alarm.</DIV>
<DIV><BR></DIV>
<DIV>Not happening all the time but when the server is busier, eg, few or no
errors over the weekend.</DIV>
<DIV><BR></DIV>
<DIV>I'm checking the maillog hourly and restarting it with:</DIV>
<DIV>/etc/init.d/clamd start<BR></DIV>
<DIV><BR></DIV>
<DIV>Anyone else come across this problem?</DIV>
<DIV><BR></DIV>
<DIV>Some settings from clamd.conf:</DIV>
<DIV>
<DIV>LocalSocket /var/run/clamav/clamd.sock</DIV>
<DIV>FixStaleSocket yes</DIV>
<DIV>TCPSocket 3310</DIV>
<DIV>MaxThreads 50</DIV></DIV>
<DIV><BR></DIV>
<DIV>Likewise from MailScanner.conf:</DIV>
<DIV>
<DIV>Clamd Port = 3310</DIV>
<DIV>Clamd Socket = /var/run/clamav/clamd.sock</DIV>
<DIV>Clamd Lock File = # /var/lock/subsys/clamd</DIV>
<DIV>Clamd Use Threads = yes</DIV></DIV>
<DIV><BR></DIV>
<DIV>Might the Use Threads setting be worth changing?</DIV>
<DIV><BR></DIV>
<DIV><BR></DIV>
<DIV><BR></DIV></DIV></DIV></BODY></HTML>