Hi there -- I ran the script manually and added the exclude-dir argument for the directories in question and also for the /dev directory, and this time there was no loss of network connectivity. I'll keep and eye on things, but I think that solved the problem. Thanks for the help.
-----Original Message----- From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users-boun...@lists.clamav.net] On Behalf Of Nathan Brink Sent: Friday, January 09, 2009 9:21 AM To: ClamAV users ML Subject: Re: [Clamav-users] opensuse11.1 loses network connection duringa cronjob that utilizes freshclam and clamscan Kaplan, Andrew H. wrote: > Hi there -- > > I reconfigured the network cards on the server in question so that one is > disabled, and > the other is set to autonegotiate. Additionally, I updated the BIOS for the > motherboard > and the NIC on the server. Even with these new configurations, the problem where > the > server lost its connection to the network still occurred. > > I manually ran the script that is the scheduled cron job, and I was able to > track when > the network connection was lost. The disconnect occurred about five minutes into > the > anti-virus scan. > > Attached to this e-mail is the script I did not see the script attached: maybe clamav's ML software filtered it out? > that is run as well as the output summary > text file. > I glanced at the output and it indicated that ClamAV was traversing through /sys and trying to read some of the sysfs files. I think that writing to some of those files will cause the kernel to perform certain actions. This may depend on which options you have enabled in your kernel. Possibly, reading a certain file may somehow cause a device to be disabled or reset. There is the remotest chance that it may cause the kernel to perform some action which would cause you to lose network activity. I don't know much about the kernel, but I don't think this is supposed to happen. However, it would be a good idea to tell clamav not to read kernel-based virtual filesystems such as /proc and /sys. I think that adding "--exclude /proc --exclude /sys" to the arguments passed to clamscan or clamdscan will prevent clam trying to scan these directories. But I can't guarantee that having clam not read these files will fix the network-disconnecting problem. > Just as a recap, the server in question is running openSuSE 11.1 which was > updated from > the openSuSE 10.3 version. The version of ClamAV is the 0.94.2 release that was > compiled > and installed from source. > > One thought came to mind: Would the removal of the source version of ClamAV and > then having > it replaced by the one that comes bundled with openSuSE be a solution to this > issue? > > > > _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail. _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
