Trog wrote:
> On Fri, 2004-02-20 at 12:50, Mike Brodbelt wrote:
>>to a specific piece of mail. The thread timeout on clamd is set to 300
>>seconds, so I presume the offending mail would have arrived at around
>>11:07:31. There are 4 possible candidate messages that were timestamped
>>at 11:07:30, all of which were spam or bounces. I have copies of the
>>queue and data files for all these messages, and can happily provide
>>copies if that would help.
>>
>
>
> Could you scan the messages with clamscan (not clamdscan) from the same
> install, using --mbox as necessary and see if anything bad happens.
# clamscan --mbox *
dfi1K59agV002875: OK
dfi1K5KDgV004396: OK
dfi1K5VagW005467: OK
dfi1K6VPgV012463: OK
qfi1K59agV002875: OK
qfi1K5KDgV004396: OK
qfi1K5VagW005467: OK
qfi1K6VPgV012463: OK
----------- SCAN SUMMARY -----------
Known viruses: 20744
Scanned directories: 0
Scanned files: 8
Infected files: 0
Data scanned: 0.00 MB
I/O buffer size: 131072 bytes
Time: 0.661 sec (0 m 0 s)
Seems all happy.
I do have one thing to add though - when I visited the server console
earlier I had a load of output from ClamAV on screen. Unfortunately, I
had typed the login name by the time I saw this, and mingetty blanked
the screen and the scrollback buffer before I could transcribe them, so
I got only a brief look. However, there was one message that struck me
as unusual. I don't remember the exact text, but it was something like
"Assertion failed, <some code> at line 2135". I'm assuming the output
came from clamav-milter, not from clamd, but if that's correct, the
section in question would be:-
2129 clamfi_close(SMFICTX *ctx)
2130 {
2131 #ifdef CL_DEBUG
2132 struct privdata *privdata = (struct privdata
*)smfi_getpriv(ctx);
2133
2134 cli_dbgmsg("clamfi_close");
2135 assert(privdata == NULL);
2136 #endif
2137
2138 if(logVerbose)
2139 syslog(LOG_DEBUG, "clamfi_close");
2140
2141 return SMFIS_CONTINUE;
2142 }
The code fragment on screen could have been an expanded form of that.
HTH,
Mike.
P.S. If you still want the message files, just let me know.
-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
