Topic: AMAVIS + CalmAV problems

[elorenz]

Hi,
I recently installed Amavis + ClamAV according to Knudsens scripts on SME 6.0 and it worked fine for 4 hours. Then I started seen this message in the amavis-ng.log:
Feb  7 08:15:12 smesrvr amavis[30085]: AMAVIS::AV::CLAMD: Cannot connect to /var/lib/clamav/clamd.sock.
Feb  7 08:15:12 smesrvr amavis[30085]: Error while scanning for viruses with AMAVIS::AV::CLAMD:
Feb  7 08:15:12 smesrvr amavis[30085]: AMAVIS::MTA::Qmail: Freezing message

What can be wrong with clamd.sock that amavis can't connect?

[MasterSleepy]

Hi,

Is your clamav service still running??
Seems that he is stopped.
Maybe you reboot the server?? And the service was not on automatic starting??

Regards,

[Graeme Fleming]

Hi

I have seen this with clam 0.65 but not with clam 0.60

This error is caused by the Clam shutdown procedure not deleting the clamd.sock file.  After an update Clam is cycled (stopped/started) and when it starts it tries to create a new clamd.sock, if the old one is there it can't do it.  The old (stale) socket can't be re-used so you will find clamd exits with an error and all email will be classified as problem email.

I am still trying to find a solution for 0.65

[Graeme Fleming]

Ok, after discussion with Damien Curtain it would seem that the problem lies in a setting in the clamav.conf file.

In 0.60 the option FixStaleSocket is uncommented and therfore functional.  It would seem that it is either commented out in the 0.65 install or broken.

I have yet to test this myself but will do so ASAP.  Can everyone else test this and confirm/deny the above.  Tests as a clean install and upgrade would be good.  Check the clamd log file for the delete clamd.sock entry for confirmation.

HTH

[mbachmann]

I've installed via the script and will check.

Finished. It says:

AMAVIS::AV::CLAMD: Cannot connect to /var/lib/clamav/clamd.sock.
Feb 11 13:05:58 nautilus1 amavis[2303]: Error while scanning for viruses with AMAVIS::AV::CLAMD:
Feb 11 13:05:58 nautilus1 amavis[2303]: AMAVIS::MTA::Qmail: Freezing message
Feb 11 13:05:58 nautilus1 amavis[2303]: Quarantining infected message to /var/spool/amavis-ng/problems/402a1aa6-08ff

It has caught a message, wich is only plain text and placed it in the "problems" directory.

clam.log
(before reboot)
Wed Feb 11 13:02:45 2004 -> Socket file removed.
Wed Feb 11 13:02:45 2004 -> Pid file removed.

after reboot the two lines are missing.

[smeghead]

try a service clamd stop folowed byservice clamd start and then check the log.  It should show the clamd.sock file being deleted - try sending a test email; if there is still a problem all email will end up in the problems folder.

[mbachmann]

I've disabled and re-enabled Amavis via delprop/setprop using Swert Knudsens advice, the restarted the service.

Logfile reads now:

Wed Feb 11 16:56:16 2004 -> WARNING: Socket file /var/lib/clamav/clamd.sock exists. Unclean shutdown? Removing...
Wed Feb 11 16:56:16 2004 -> Unix socket file /var/lib/clamav/clamd.sock

Testmail o.k. Thx, smeghead.

[smeghead]

.. can you provide more detail on the delprop/setprop stuff for the benefit of the rest of us ...

I presume you are refering to:

http://sme.swerts-knudsen.dk/howtos/howto_22.htm

and the manual activation/disabling process on this page?

[mbachmann]

Yes, i've exactly done what Jesper has written. Clam AV is now working, but i fear on next reboot i have to repeat it again.

[smeghead]

I have now extensively tested this on my new server and am happy to report the current script and the files it downloads are fine.

If you have to make some changes to the config of clam or amavis then remember don't edit the /etc/amavis-ng/amavis.conf file but actually edit the template file /etc/e-smith/templates/etc/amavis-ng/amavis.conf/conf and then issue a /sbin/e-smith/expand-template /etc/amavis-ng/amavis.conf; similar construct for the clamav.conf file.

HTH