Re: [Clamav-users] Re: clamd on Solaris ceases functioning after a while

2005-02-18 Thread Fajar A. Nugraha
David Blank-Edelman wrote: Hmm, that's an interesting thought, though I'm running exiscan-acl-4.34-21.patch which reportedly fixed that problem. 4.34? That's old. If I remember correctly, I had some problem with that version as well. Use (at least) exim 4.41. That's what I use here, and it runs

Re: [Clamav-users] How to use clamd?

2005-02-18 Thread Brian Morrison
On Thu, 17 Feb 2005 16:31:03 -0500 in [EMAIL PROTECTED] "Brian Bebeau" <[EMAIL PROTECTED]> wrote: > >> I just had this problem the other day on a new AMD64 box. > >> Check the directory where libgmp is installed. I found it had > >> the library and a libgmp.so.3 symlink to it, but I needed to > >>

Re: [Clamav-users] Re: clamd on Solaris ceases functioning after a while

2005-02-18 Thread David Blank-Edelman
On Feb 18, 2005, at 3:04 AM, Fajar A. Nugraha wrote: 4.34? That's old. If I remember correctly, I had some problem with that version as well. Use (at least) exim 4.41. That's what I use here, and it runs fine. Both Solaris 8 and 9. Yes, the version of exim is a little behind (they rev'd through t

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread Trog
On Thu, 2005-02-17 at 23:52 -0500, David Blank-Edelman wrote: > Hi- >Thanks for such a great program and all of the work being put into > it. We're having a nasty problem with clamd 0.8x (even with 0.83 which > we just installed yesterday). After running for a while, it will decide > to just

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread Andy Fiddaman
On Thu, 17 Feb 2005, David Blank-Edelman wrote: ; Hi- ; Thanks for such a great program and all of the work being put into it. We're ; having a nasty problem with clamd 0.8x (even with 0.83 which we just installed ; yesterday). After running for a while, it will decide to just stop functioning ;

[Clamav-users] EICAR signature update: second attempt

2005-02-18 Thread Tomasz Kojm
The signature will be updated on Monday (to better meet the official specification). All clamdwatch users should upgrade to the latest version as soon as possible to avoid problems similar to those from 2004. -- oo. Tomasz Kojm <[EMAIL PROTECTED]> (\/)\. http:

Re: [Clamav-users] False Positives on .doc files?

2005-02-18 Thread Lesli St. Clair
-- > This is very likely File::Scan. Yes indeed. That was the problem. MimeDefang will use File::Scan if it's there. Thanks for the help. ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread Alberto da Silva
On Fri, 18 Feb 2005 09:12:45 +, Trog <[EMAIL PROTECTED]> wrote: > This really looks like you're running out of some resource. That accept > () failure is from the clamd primary socket. We will need to find out > what the error is. Please try this patch: > ... We had a similar problem - Solar

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread Igor Brezac
On Fri, 18 Feb 2005, David Blank-Edelman wrote: From: Igor Brezac <[EMAIL PROTECTED]>: How much memory does your clamd process consume when it stops running? Hi Igor- I haven't checked (the machine it is running on has plenty of memory and swap), but I will check next time this happens. Would y

Re: [Clamav-users] How to use clamd?

2005-02-18 Thread D.J.
> If the lib is in /usr/local/lib and /usr/local/lib is in the > shlib_dirs option in /etc/rc.conf or /etc/rc.conf.local, it should > pick up on it. > The shlib_dirs option in /etc/rc.conf is currently empty. I tried putting /usr/local/lib in there: shlib_dirs="/usr/local/lib /usr/lib" With no

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread Igor Brezac
On Fri, 18 Feb 2005, James Lick wrote: Igor Brezac wrote: On Thu, 17 Feb 2005, David Blank-Edelman wrote: Solaris 9, gcc built, Solaris 9 stock zlib (1.1.4) I'm running clamd 0.83 on Solaris 9 compiled with gcc 3.4.2 and zlib 1.2.2. The older zlib releases have been known to cause clamd to crash,

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread David Blank-Edelman
On Feb 18, 2005, at 4:12 AM, Trog wrote: This really looks like you're running out of some resource. That accept () failure is from the clamd primary socket. We will need to find out what the error is. Please try this patch: Hi Trog and Andy- Thanks for your responses. I've just patched my sources

Re: [Clamav-users] Re: clamav on gateway + sniffer to intercept mail attachments

2005-02-18 Thread vaida bogdan
A solution I was going to implement was mailsnarf on GW1 but it does snat and mailsnarf still logs mails with the source ip of GW1. Any ideeas on how to overcome this ? (I think a comparison between "logged ip headers'" time and "virii found @ MAIL SERVER" time improper.) iptables snat rule: SNAT

Re: [Clamav-users] False Positives on .doc files?

2005-02-18 Thread Jason Englander
On Fri, 18 Feb 2005, Lesli St. Clair wrote: Yes indeed. That was the problem. MimeDefang will use File::Scan if it's there. I don't know about CanIt, but in MIMEDefang you can set your filter to only discard when the virus scanner reports back that it is a virus (ignoring when it's "suspicious")

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread Andy Fiddaman
On Fri, 18 Feb 2005, David Blank-Edelman wrote: ; On Feb 18, 2005, at 4:12 AM, Trog wrote: ; ; > This really looks like you're running out of some resource. That accept ; > () failure is from the clamd primary socket. We will need to find out ; > what the error is. Please try this patch: ; ; Hi Tr

Re: [Clamav-users] How to use clamd?

2005-02-18 Thread D.J.
> I don't recall what version of OpenBSD you're running... But when > ClamAV was updated, it took me just a few minutes to apply the > patches from the -CURRENT port to a pristine 0.83 source tree, and > build from scratch. That was on both 3.5 and 3.6-STABLE. > > Benny Figured I should write t

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread David Blank-Edelman
On Feb 18, 2005, at 2:49 PM, Andy Fiddaman wrote: The accept debug will at least tell us if you're running out of file descriptors.. Roger. # ndd /dev/tcp tcp_time_wait_interval 6 # pfiles `pgrep clamd` | grep rlimit Current rlimit: 256 file descriptors Current rlimit: 256 file descriptors

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread Jose Marcio Martins da Cruz
Hmmm. David Blank-Edelman wrote: On Feb 18, 2005, at 2:49 PM, Andy Fiddaman wrote: The accept debug will at least tell us if you're running out of file descriptors.. Roger. ... # pfiles `pgrep clamd` | grep rlimit Current rlimit: 256 file descriptors Current rlimit: 256 file descriptors und

Re: [Clamav-users] EICAR signature update: second attempt

2005-02-18 Thread Damian Menscher
On Fri, 18 Feb 2005, Tomasz Kojm wrote: The signature will be updated on Monday (to better meet the official specification). All clamdwatch users should upgrade to the latest version as soon as possible to avoid problems similar to those from 2004. Latest version of clamav, or clamdwatch? Why is th

[Clamav-users] Re: clamav on gateway + sniffer to intercept mail attachments

2005-02-18 Thread René Berber
vaida bogdan wrote: A solution I was going to implement was mailsnarf on GW1 but it does snat and mailsnarf still logs mails with the source ip of GW1. Any ideeas on how to overcome this ? (I think a comparison between "logged ip headers'" time and "virii found @ MAIL SERVER" time improper.) iptabl

Re: [Clamav-users] EICAR signature update: second attempt

2005-02-18 Thread Des Keane
On Fri, 18 Feb 2005 15:45:54 -0600 (CST), Damian Menscher <[EMAIL PROTECTED]> wrote: > Latest version of clamav, or clamdwatch? Latest version of clamdwatch (0.7.1, as distributed with clamav 0.83). > Why is the most recent version required (I'm assuming some new > functionality is required, but

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread Andy Fiddaman
On Fri, 18 Feb 2005, David Blank-Edelman wrote: ; ; Thanks for taking the time to look into this with me. You could try the attached patch, which makes clamd increase its file descriptor limit to the OS's maximum or the maximum safe value if you're using select(). A.diff -r -u clamav-devel/clamd

Re: [Clamav-users] EICAR signature update: second attempt

2005-02-18 Thread Tomasz Kojm
On Fri, 18 Feb 2005 15:45:54 -0600 (CST) Damian Menscher <[EMAIL PROTECTED]> wrote: > On Fri, 18 Feb 2005, Tomasz Kojm wrote: > > > The signature will be updated on Monday (to better meet the official > > specification). All clamdwatch users should upgrade to the latest > > version as soon as pos

[Clamav-users]

2005-02-18 Thread Instituto de Ingenieria Unix
I have problems in my server mail, especially is the antivirus, I have suse enterprise 9,0 with postfix+amavisd-new+clamav. Clamav me this not stopping the post office with virus, that have an attached file of format zip which has one password, to that it must this? Is question of configurat

[Clamav-users] attached file of format zip

2005-02-18 Thread Instituto de Ingenieria Unix
I have problems in my server mail, especially is the antivirus, I have suse enterprise 9,0 with postfix+amavisd-new+clamav. Clamav me this not stopping the post office with virus, that have an attached file of format zip which has one password, to that it must this? Is question of configuration

Re: [Clamav-users]

2005-02-18 Thread Tomasz Kojm
On Fri, 18 Feb 2005 19:21:01 -0600 Instituto de Ingenieria Unix <[EMAIL PROTECTED]> wrote: > I have problems in my server mail, especially is the antivirus, I > have suse enterprise 9,0 with postfix+amavisd-new+clamav. > > Clamav me this not stopping the post office with virus, that have an

[Clamav-users] Sysetm boot error:Starting clamd: execvp: No such file or directory

2005-02-18 Thread shams rahman
hi, i installed the clamav-0.83.tar.gz,and configrued it for local socket,then installed the clamd and clamav-milter from /clamav-0.83//contrib/init/RedHat to the /etc/init.d,then i changed to the directory /etc/init.d and run the commmand "clamd start" ,clamd started successfuly without any err

Re: [Clamav-users] attached file of format zip

2005-02-18 Thread Tomasz Kojm
On Fri, 18 Feb 2005 19:22:50 -0600 Instituto de Ingenieria Unix <[EMAIL PROTECTED]> wrote: > I have problems in my server mail, especially is the antivirus, I > have suse enterprise 9,0 with postfix+amavisd-new+clamav. > > Clamav me this not stopping the post office with virus, that have an > at

[Clamav-users] Re: Sysetm boot error:Starting clamd: execvp: No such file or directory

2005-02-18 Thread René Berber
shams rahman wrote: i installed the clamav-0.83.tar.gz,and configrued it for local socket,then installed the clamd and clamav-milter from /clamav-0.83//contrib/init/RedHat to the /etc/init.d,then i changed to the directory /etc/init.d and run the commmand "clamd start" ,clamd started successful

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread James Lick
Igor Brezac wrote: On Fri, 18 Feb 2005, James Lick wrote: My clamd is at 12mb process size currently. I haven't noticed memory bloat in recent versions. This is the starting clamd memory footprint. How many messages are you scanning? 0.80 ran fine, I noticed the problem since 0.81... It proc

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread Igor Brezac
On Sat, 19 Feb 2005, James Lick wrote: Igor Brezac wrote: On Fri, 18 Feb 2005, James Lick wrote: My clamd is at 12mb process size currently. I haven't noticed memory bloat in recent versions. This is the starting clamd memory footprint. How many messages are you scanning? 0.80 ran fine, I not

RE: [Clamav-users] Re: Sysetm boot error:Starting clamd: execvp: Nosuch file or

2005-02-18 Thread shams rahman
hi, thanks for reply,i changed to the directory /etc/init.d and run the ./clamd start and get the same error: Starting clamd: execvp: No such file or directory this is the chkconfig --list clamd output: clamd 0:off 1:off 2:on3:on4:on5:on6:off and the clamd is installe

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread Dennis Peterson
James Lick said: > Igor Brezac wrote: > >> On Fri, 18 Feb 2005, James Lick wrote: >> >>> >>> My clamd is at 12mb process size currently. I haven't noticed memory >>> bloat in recent versions. >>> >> >> This is the starting clamd memory footprint. How many messages are >> you scanning? 0.80 ran f

[Clamav-users] Re: Sysetm boot error:Starting clamd: execvp: Nosuch file or

2005-02-18 Thread René Berber
shams rahman wrote: hi, thanks for reply,i changed to the directory /etc/init.d and run the ./clamd start and get the same error: Starting clamd: execvp: No such file or directory this is the chkconfig --list clamd output: clamd 0:off 1:off 2:on3:on4:on5:on6:off and t

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread James Lick
Igor Brezac wrote: This is how .80 ran for me. The recent service pack may have done this. What is your os version, uname -v? SunOS tcp.com 5.9 Generic_112233-11 sun4u sparc SUNW,Ultra-2 Solaris -- James Lick -- éåæ -- [EMAIL PROTECTED] -- http://jameslick.com/ __

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread Igor Brezac
On Sat, 19 Feb 2005, James Lick wrote: Igor Brezac wrote: This is how .80 ran for me. The recent service pack may have done this. What is your os version, uname -v? SunOS tcp.com 5.9 Generic_112233-11 sun4u sparc SUNW,Ultra-2 Solaris I am at Generic_117171-15, which is a lot newer and I am affra

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-02-18 Thread Dennis Peterson
Igor Brezac said: > > On Sat, 19 Feb 2005, James Lick wrote: >> > > I am at Generic_117171-15, which is a lot newer and I am affraid the > latest patch is giving me problems. ;( > > -- > Igor I'm using the same version with no problem. It works fine. Here are my clamav build directives - it has w