On 5 Jun 2009, at 22:08, Robert Schetterer wrote: > Dennis Peterson schrieb: >> Robert wrote: >> >>> Would this then cause clamdwatch to assume Clamd had crashed >>> and restart it accordingly ?? >>> >>> >>> If I'm way off base here, be merciful.... >> >> Change the logic so that clamdwatch alerts only after two or more >> failures to >> connect. There's lots of reasons why a single failure can trigger >> an alert. >> >> dp >> _______________________________________________ >> Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net >> http://www.clamav.net/support/ml > > you may use monit to restart clam, work here like charme > > http://mmonit.com/monit/ > http://susewiki.org/index.php?title=Monit > > i use something like this with monit > > /etc/monitrc > > # Clamavd: (virus scan daemon) > # ---------------------------- > check process clamavd with pidfile /var/lib/clamav/clamd.pid > start program = "/etc/init.d/clamd start" > stop program = "/etc/init.d/clamd stop" > # if failed unix /var/run/clamav/clamd.ctl then restart > if failed host localhost port 3310 then restart > group virus > depends clamavd_init > depends clamavd_bin > check file clamavd_init with path /etc/init.d/clamd > group virus > check file clamavd_bin with path /usr/sbin/clamd > group virus > > it also usefull with freshclam, postgrey, spamd, serveral milters > > monit can alert you via mail by doing actions, also does logging to > syslog as well as clam should do it, so there should be no problem > to notice about crashes > > > -- > Best Regards > > MfG Robert Schetterer >
Well after some 'simple' tests clamdwatch reports 'Clamd not responding to SCAN request' if it tries when Clamd is reloading. If it's timeout value is less than the clamd reload time then things happen. My clamdwatch command was configured so: "/usr/local/bin/clamdwatch.pl -q /var/lock/subsys/clamd && ( /usr/bin/ killall -9 clamd; rm -fr /var/run/clamav/clamd; /etc/init.d/clamd start 2>&1 )" with a default timeout of 15 secs. With a Clam db reload times of 30+ secs this surely explains why I got so many 'crashes'. clamdwatch logic change now in progress..... (You learn something everyday.) Robert. _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
