On 2009-03-04 19:28, Dennis Peterson wrote: > Török Edwin wrote: > >> On 2009-03-04 17:49, Jorge Valdes wrote: >> >>> Because I run clamd via daemontools, whenever clamd crashes, its brought >>> back to life within a few seconds and things hum along fine until the >>> next crash, which is in my case, very unpredictable since I have gone >>> days without a crash, and suddenly have 3-5 crashes per day. This >>> production server is running 0.94.2 and scans 70000-80000 msgs/day. >>> >>> >> Hi, >> >> Here is the bugreport tracking this issue: >> https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1370 >> >> So far we've been unable to reproduce the crash ourselves. As suggested >> in that bugreport, there are 2 things you can try to help us debug this >> issue: >> > > If the daemon crashes using third party signatures and there are no errors in > those signatures then we have no reason to believe it won't crash when using > only first-party signatures. Perhaps it's not the signatures or signature > files > at fault, but number of signatures and how they're stored in core that is > triggering a fault on some systems? > > This can be tested by having some adventurous affected user run with only > third > party signatures - if it is that which is at fault then clamd will continue > to > crash. Since this happens only while loading signatures it can be tested > off-line. >
As far as I understand the crash occurs when reloading the signatures (actually when freeing old signatures), but only if clamd had some load before (i.e. it doesn't crash just by reloading the signatures on a fresh clamd). That makes me think this has to do with some memory corruption from earlier, or is dependent on the timing of events. > I've not seen the problem and my configurations are: > > OS: Solaris 9 > Compiler: Studio 12 > Third party signatures: Sane Security (Hooahh!), MSRBL > > I no longer use securiteinfo signatures but had not problem with them. > > The only issue I see is that clamd CPU usage goes to 97%+ when loading a new > signature from freshclam. > That is normal. Best regards, --Edwin _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
