On Fri, 18 Feb 2005, David Blank-Edelman wrote:
; On Feb 18, 2005, at 4:12 AM, Trog wrote:
;
; > This really looks like you're running out of some resource. That accept
; > () failure is from the clamd primary socket. We will need to find out
; > what the error is. Please try this patch:
;
; Hi Trog and Andy-
;
; Thanks for your responses. I've just patched my sources as instructed. I don't
; know the clamav code anywhere nearly as well as you folks do, so please take
; this with a grain of salt, but my intuition tells me patch won't illuminate
; the primary problem. Here's why:
The accept debug will at least tell us if you're running out of file
descriptors.. With TCP sockets, the default on Solaris is to leave them in
TIME_WAIT state for quite a while after the connection is closed down,
which can prevent the application from re-using the fd for a while. Can
you check a few things on your system ?
# ndd /dev/tcp tcp_time_wait_interval
The time that sockets are left in TIME_WAIT.. I've tuned it to 30 seconds
(30000) here although the RFC recommends no lower than 60 seconds, YMMV.
# pfiles `pgrep clamd` | grep rlimit
How many file descriptors are available to clamd
# netstat -an | grep 3310 | awk '{print $7}' | sort | uniq -c
How many clamd TCP sockets are in each state
Also any lines in the /etc/system file which contain 'rlim'
Andy
_______________________________________________
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
