On 2009-08-17 15:15, Federico Giovannini wrote:
Hi all,
I'm new in this mailing-list and also as clamav-user so sorry for my
elementary questions.
> With my configuration gentoo, postfix ( 2.2.11-r1), amavisd-new
(2.5.2) and ClamAV 0.95.2 sometimes when my mailserver receives emails
with attachments, clamd stops working and also clamscan dies as
indicated in the following amavis logs:
Aug 17 03:42:59 scilla.sestante.net /usr/sbin/amavisd[10531]:
(10531-12) (!!)TROUBLE in check_mail: virus_scan FAILED: virus_scan: ALL
VIRUS SCANNERS FAILED: ClamAV-clamd av-scanner FAILED: CODE(0x8011a434)
Too many retries to talk to /var/amavis/clamd.sock (Can't connect to
UNIX socket /var/amavis/clamd.sock: Connection refused) at (eval 67)
line 310. at (eval 67) line 511.; ClamAV-clamscan av-scanner FAILED:
/usr/bin/clamscan DIED on signal 11 (000b) at (eval 67) line 511.
>
The focus here should be on why clamd is croaking. Amavis can't talk to
the dead or unborn.
Determine which attachments are causing the trouble. Could be a
mailbomb. Use a MIME unpacking tool (eg. ripmime) if necessary to
extract the parts, and clamdscan each part, looking for the culprit.
Amavis will leaves evidence in its tmp directories, so have a look at
your log for PRESERVING EVIDENCE in your logs. Look for other amavis
log lines around the log line shown above with pid 10531.
--
Mike
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
