ClamAV-clamd av-scanner FAILED

mkiler · 05-22-2008, 08:30 AM

Hi
I have problem with my postfix on the gentoo linux. Server worked fine but two days ago something happened. Emails can not be delivered to recipients, but only when in /etc/amavisd.conf option bypass is comment:

Code:

#@bypass_virus_checks_maps = (1);  # uncomment to DISABLE anti-virus code
#@bypass_spam_checks_maps  = (1);  # uncomment to DISABLE anti-spam code

When is uncomment mails are delivered.

When bypass is comment and I do /etc/init.d/clamd start log from /var/log/messages is:

Code:

May 22 13:29:21 papa freshclam[2772]: Current working dir is /var/lib/clamav
May 22 13:29:21 papa freshclam[2773]: freshclam daemon 0.90.3 (OS: linux-gnu, ARCH: i386, CPU: i686)
May 22 13:29:21 papa freshclam[2773]: Max retries == 3
May 22 13:29:21 papa freshclam[2773]: ClamAV update process started at Thu May 22 13:29:21 2008
May 22 13:29:21 papa freshclam[2773]: Querying current.cvd.clamav.net
May 22 13:29:22 papa freshclam[2773]: TTL: 30
May 22 13:29:22 papa freshclam[2773]: Software version from DNS: 0.93
May 22 13:29:22 papa freshclam[2773]: Your ClamAV installation is OUTDATED!
May 22 13:29:22 papa freshclam[2773]: Local version: 0.90.3 Recommended version: 0.93
May 22 13:29:22 papa freshclam[2773]: DON'T PANIC! Read http://www.clamav.net/support/faq
May 22 13:29:22 papa freshclam[2773]: Waiting to lock database directory: /var/lib/clamav
May 22 13:29:27 papa freshclam[2773]: Waiting to lock database directory: /var/lib/clamav
May 22 13:29:32 papa freshclam[2773]: Waiting to lock database directory: /var/lib/clamav
May 22 13:29:37 papa freshclam[2773]: Waiting to lock database directory: /var/lib/clamav
May 22 13:29:42 papa freshclam[2773]: Waiting to lock database directory: /var/lib/clamav
May 22 13:29:46 papa pop3d: Connection, ip=[83.6.115.9]
May 22 13:29:46 papa pop3d: LOGIN, user=poltarzewski, ip=[83.6.115.9]
May 22 13:29:47 papa pop3d: LOGOUT, user=poltarzewski, ip=[83.6.115.9], top=0, retr=0, time=1
May 22 13:29:47 papa freshclam[2773]: Waiting to lock database directory: /var/lib/clamav
May 22 13:29:52 papa freshclam[2773]: main.cvd version from DNS: 46
May 22 13:29:52 papa freshclam[2773]: main.cvd is up to date (version: 46, sigs: 231834, f-level: 26, builder: sven)
May 22 13:29:52 papa freshclam[2773]: daily.cvd version from DNS: 7213
May 22 13:29:52 papa freshclam[2773]: daily.inc is up to date (version: 7213, sigs: 65401, f-level: 26, builder: ccordes)
May 22 13:29:52 papa freshclam[2773]: --------------------------------------

next step /etc/init.d/amavisd start log is:

Code:

May 22 13:32:08 papa amavis[2849]: (02849-01) (!!) ClamAV-clamd av-scanner FAILED: Too many retries to talk to /var/amavis/clamd (Can't connect to UNIX socket /var/amavis/clamd: Connection refused) at (eval 66) line 268.
May 22 13:32:08 papa amavis[2849]: (02849-01) (!!) WARN: all primary virus scanners failed, considering backups

What is wrong??

And when scanning in amavis is on and I try to send message log is:

Code:

May 22 14:00:52 papa postfix/smtpd[6395]: 8D1D3508326: client=aatd227.neoplus.adsl.tpnet.pl[83.5.241.227], sasl_method=PLAIN, sasl_username=mkiljanski
May 22 14:00:52 papa postfix/cleanup[6396]: 8D1D3508326: message-id=<48357380.6020001@example.pl>
May 22 14:00:52 papa postfix/qmgr[6382]: 8D1D3508326: from=<m.kiljanski@example.pl>, size=527, nrcpt=1 (queue active)
May 22 14:00:52 papa postfix/smtpd[6395]: disconnect from aatd227.neoplus.adsl.tpnet.pl[83.5.241.227]
May 22 14:00:52 papa postfix/pickup[6381]: C42F450833B: uid=1150 from=<m.kiljanski@example.pl>
May 22 14:00:52 papa postfix/cleanup[6472]: C42F450833B: message-id=<48357380.6020001@example.pl>
May 22 14:00:52 papa postfix/pipe[6397]: 8D1D3508326: to=<m.kiljanski@example.pl>, relay=dfilt, delay=0.4, delays=0.33/0/0/0.07, dsn=2.0.0, status=sent (delivered via dfilt service)
May 22 14:00:52 papa postfix/qmgr[6382]: 8D1D3508326: removed
May 22 14:00:52 papa postfix/qmgr[6382]: C42F450833B: from=<m.kiljanski@example.pl>, size=711, nrcpt=1 (queue active)

Apreciate your advice

bathory · 05-22-2008, 09:01 AM

According to the logs, your version is 0.90.3 and lastest version is 0.93

Quote:

May 22 13:29:22 papa freshclam[2773]: Your ClamAV installation is OUTDATED!
May 22 13:29:22 papa freshclam[2773]: Local version: 0.90.3 Recommended version: 0.93

Try to upgrade clamav and see if it works

mkiler · 05-22-2008, 12:45 PM

ok updated

Code:

papa ~ # emerge -s clamav
Searching...
[ Results for search key : clamav ]
[ Applications found : 5 ]

*  app-antivirus/clamav
      Latest version available: 0.93
      Latest version installed: 0.93
      Size of files: 15,756 kB
      Homepage:      http://www.clamav.net/
      Description:   Clam Anti-Virus Scanner
      License:       GPL-2

but when amavis starts

Code:

May 22 18:13:34 papa amavis[19319]: ANTI-VIRUS code      loaded
May 22 18:13:34 papa amavis[19319]: ANTI-SPAM code       loaded
May 22 18:13:34 papa amavis[19319]: ANTI-SPAM-SA code    loaded

log:

Code:

May 22 18:15:02 papa amavis[19333]: (19333-01) (!!) ClamAV-clamd av-scanner FAILED: Too many retries to talk to /var/amavis/clamd (Can't connect to UNIX socket /var/amavis/clamd: Connection refused) at (eval 66) line 268.
May 22 18:15:02 papa amavis[19333]: (19333-01) (!!) WARN: all primary virus scanners failed, considering backups

emails are delivered!

but this error, whats wrong?

bathory · 05-23-2008, 01:55 AM

Here are some things to check:
1 Make sure clamd is running and listens to socket /var/amavis/clamd:

Code:

netstat -anpl|grep clamd

2. Make sure that the user that runs clamd belongs to the amavisd group and you have

Code:

AllowSupplementaryGroups yes

in clamd.conf

Regards

mkiler · 05-23-2008, 04:42 AM

hi

Code:

netstat -anpl|grep clamd

returns nothing, but into log when I restart clamd

Code:

May 23 10:03:13 papa freshclam[3061]: Current working dir is /var/lib/clamav
May 23 10:03:13 papa freshclam[3062]: freshclam daemon 0.93 (OS: linux-gnu, ARCH: i386, CPU: i686)
May 23 10:03:13 papa freshclam[3062]: Max retries == 3
May 23 10:03:13 papa freshclam[3062]: ClamAV update process started at Fri May 23 10:03:13 2008
May 23 10:03:13 papa freshclam[3062]: Querying current.cvd.clamav.net
May 23 10:03:13 papa freshclam[3062]: TTL: 4
May 23 10:03:13 papa freshclam[3062]: Software version from DNS: 0.93
May 23 10:03:13 papa freshclam[3062]: main.cvd version from DNS: 46
May 23 10:03:13 papa freshclam[3062]: main.cvd is up to date (version: 46, sigs: 231834, f-level: 26, builder: sven)
May 23 10:03:13 papa freshclam[3062]: daily.cvd version from DNS: 7220
May 23 10:03:13 papa freshclam[3062]: daily.cld is up to date (version: 7220, sigs: 65308, f-level: 26, builder: ccordes)
May 23 10:03:13 papa freshclam[3062]: --------------------------------------

now I change /etc/init.d/clamd now file is:

Code:

#!/sbin/runscript
# Copyright 1999-2005 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/app-antivirus/clamav/files/clamd.rc,v 1.15 20                        07/04/13 20:56:34 ticho Exp $

opts="logfix"

depend() {
        use net
        provide antivirus
}

start() {
        local clamd_socket=`awk '$1 == "LocalSocket" { print $2 }' /etc/clamd.co                        nf`

        logfix

        if [ "${START_CLAMD}" = "yes" ]; then
                if [ -S "${clamd_socket:-/tmp/clamd}" ]; then
                        rm -f ${clamd_socket:-/tmp/clamd}
                fi
                ebegin "Starting clamd"

#start-stop-daemon --stop --quiet --pidfile /var/amavis/clamd.pid
                        start-stop-daemon --start --quiet \
                         --exec /usr/sbin/clamd
                eend $? "Failed to start clamd"
        fi

        if [ "${START_FRESHCLAM}" = "yes" ]; then
                ebegin "Starting freshclam"

                start-stop-daemon --start --quiet \
                        --exec /usr/bin/freshclam -- -d
                retcode=$?
                if [ ${retcode} = 1 ]; then
                        eend 0
                        einfo "Virus databases are already up to date."
                else
                        eend ${retcode} "Failed to start freshclam"
                fi
        fi
        if [ "${START_MILTER}" = "yes" ]; then
                if [ -S "${MILTER_SOCKET}" ]; then
                        rm -f ${MILTER_SOCKET}
                fi


                local milter_ext=no
                local milter_svr=no
                args=`getopt -q --options "es" --longoptions "external,server" -                        -  $MILTER_OPTS`
                for arg in $args; do

                        case "$arg" in

                        -e | --external)
                                milter_ext=yes;
                                shift;;

                        -s | --server)
                                milter_svr=yes;
                                shift;;

                        --)
                                shift;
                                break;;
                        esac
                done

                if [[ $milter_ext == yes && $milter_svr == no ]]; then
                        local clamd_socket_wait_count=0
                        local clamd_socket_wait_max=10
                        local clamd_socket_wait_result=-1
                        ebegin "Waiting for clamd to create ${clamd_socket}"
                        while (( clamd_socket_wait < clamd_socket_wait_max )); d                        o
                                if [ -S "${clamd_socket:-/tmp/clamd}" ]; then
                                        clamd_socket_wait_result=0
                                        break
                                else
                                        echo -n " ."
                                        let clamd_socket_wait++
                                        sleep 1
                                fi
                        done
                        echo
                        eend $clamd_socket_wait_result "Timeout waiting for ${cl                        amd_socket}"
                fi

                ebegin "Starting clamav-milter"
                start-stop-daemon --start --quiet \
                        --exec /usr/sbin/clamav-milter -- ${MILTER_OPTS} ${MILTE                        R_SOCKET}
                eend $? "Failed to start clamav-milter"
        fi
}

stop() {
        if [ "${START_CLAMD}" = "yes" ]; then
                ebegin "Stopping clamd"
                start-stop-daemon --stop --quiet --name clamd
                eend $? "Failed to stop clamd"
        fi
        if [ "${START_FRESHCLAM}" = "yes" ]; then
                ebegin "Stopping freshclam"
                start-stop-daemon --stop --quiet --name freshclam
                eend $? "Failed to stop freshclam"
        fi
        if [ "${START_MILTER}" = "yes" ]; then
                ebegin "Stopping clamav-milter"
                start-stop-daemon --stop --quiet --name clamav-milter
                eend $? "Failed to stop clamav-milter"
        fi
}

logfix() {
        if [ "${START_CLAMD}" = "yes" ]; then
                # fix clamd log permissions
                # (might be clobbered by logrotate or something)
                local logfile=`awk '$1 == "LogFile" { print $2 }' /etc/clamd.con                        f`
                local clamav_user=`awk '$1 == "User" { print $2 }' /etc/clamd.co                        nf`
                if [ -n "${logfile}" ] && [ -n "${clamav_user}" ]; then
                        if [ ! -f "${logfile}" ]; then
                                touch ${logfile}
                        fi
                        chown ${clamav_user} ${logfile}
                        chmod 640 ${logfile}
                fi
        fi

        if [ "${START_FRESHCLAM}" = "yes" ]; then
                # fix freshclam log permissions
                # (might be clobbered by logrotate or something)
                logfile=`awk '$1 == "UpdateLogFile" { print $2 }' /etc/freshclam                        .conf`
                local freshclam_user=`awk '$1 == "DatabaseOwner" { print $2 }' /                        etc/freshclam.conf`
                if [ -n "${logfile}" -a -n "${clamav_user}" ]; then
                        if [ ! -f "${logfile}" ]; then
                                touch ${logfile}
                        fi
                        chown ${freshclam_user} ${logfile}
                        chmod 640 ${logfile}
                fi
        fi
}

restart and now when I do

Code:

netstat -anpl|grep clamd

log is

Code:

unix  2      [ ACC ]     STREAM     LISTENING     601505 3402/clamd          /var/amavis/clamd

Previous error has disappear, but now sometimes in log I have

Code:

papa amavis[2913]: (02913-05) ClamAV-clamd: Can't send to socket /var/amavis/clamd: Transport endpoint is not connected, retrying (1)

Bathory thanks for your help

mkiler · 05-23-2008, 04:47 AM

and in /etc/clamd.conf I change line and now is

Code:

AllowSupplementaryGroups yes

bathory · 05-23-2008, 05:08 AM

I don't know what have you changed in clamd init script, but I suggest you to leave it as it was. By default it creates the socket in /tmp/clamd. Check clamd.conf for "LocalSocket" as this also has to be /tmp/clamd and comment TCPSocket since they cannot coexist
Now edit amavisd.conf, look after CONTSCAN for the location of the socket and change it (make a backup first). Then stop amavisd, restart clamd, make sure it listens on /tmp/clamd and then start amavisd again