Hi Salvatore,
On Fri, 2 Oct 2009 09:27:48 +0200
Salvatore Toribio <tori...@pusc.it> wrote:
> At 7:05 +0200 2-10-2009, li...@penpal4u.net wrote:
> >Hi Jason,
> >>> > When I
> >>> > upgraded to 2.06, I ended up with plenty of
> >>> >
> >>> > WARNING: lstat() failed on: ...
> >>> >
> >>> > in the clamd log file and viruses go through.
> >>> >
> >>>
> >>> ? Well that is weird. Qmail-Scanner is specifically designed to
> >>> tempfail if an AV returns a non-standard error code. Again - this
> >>> smells like a hardware problem - disk corruption springs to mind.
> >>
> >> Actually, it looks like I fixed it. There was an error message
> >> about /proc/swaps having an unexpected file format. I therefore
> >> updated the kernel and everything seems to be fine now. I assume
> >> there was a discrepancy between my kernel and my base system. The
> >> disks I had checked before and they were alright.
> >
> >I might have been a bit too quick on this one. There still seems to
> >be quite a bit wrong. While some files are getting detected and
> >deleted now, others still make it through with the error message I
> >mentioned before. On top of that my clamd segfaults every now and
> >then. However, I have found out that the segfaults I can also
> >trigger manually.
> >
> >My qmail-smtpd's log file is full of lines like
> >
> >@400000004ac58797177fa9c4 X-Qmail-Scanner-2.06st: Process 21800
> >closed, parent process died
> >
> >I presume that there is one such line for every single scan.
> >
> >I tried the EICAR tests and while eicar.com got detected and
> >deleted, the eicar_com.zip created the above error message and went
> >through. :(
> >
> >I'll post again one I've got to the bottom of this.
> >
> Have you checked your softlimit? Newer versions of clamd need more
> memory and more again if you are running a x86_64 cpu.
I didn't use softlimit but have now added it (I only migrated clamd to
daemontools when I had these problems). With a low softlimit (64MB), I
can trigger another segfault of the form
clamd[19114]: segfault at 0 ip b7fea29a sp bf9b4b70 error 6 in
libclamav.so.6.0.4[b7f58000+bd000]
With a higher softlimit (I tried up to -m 1024000000), I will still see
an
ERROR: pthread_create failed
in clamd's logs. :( So, I disabled softlimit again.
However, the ones I saw before looked like
clamd[14100]: segfault at 0 ip (null) sp b2cc0820 error 4
These segfaults seem rather erratic and I only get maybe a few dozens for a
24h period, I believe.
The problem of dying parent processes seems to be triggered by any scan
but not affect how qmail-scanner deals with viruses. They still seem to
get filtered.
Furthermore I see some lines like
@400000004ac70b64213e71d4 X-Qmail-Scanner-2.06st:[mail125455855278721767]
clamdscan: corrupt or unknown clamd scanner error or
memory/resource/perms problem - exit status 512/2
I'm not sure what happens with those emails. They might be stuck in a remote
queue. These errors seem rather sporadic, however.
Cheers,
Christian
------------------------------------------------------------------------------
Come build with us! The BlackBerry® Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9-12, 2009. Register now!
http://p.sf.net/sfu/devconf
_______________________________________________
Qmail-scanner-general mailing list
Qmail-scanner-general@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
