Topic: Clam Antivirus 0.83 - KERNEL PANIC: CPU context corrupt

[SchulzStefan]

Hi there,

running an e-smith 6.0.1-01. A few days ago, I updated clamav with Swert-Knudsens (http://sme.swerts-knudsen.dk/index.html?frame=http%3A//sme.swerts-knudsen.dk/howtos/howto_29.htm) antivirus install script. Since that update I have a lot trouble. While running the clamscan command the machine hangs up.

The error message is

CPU 0: Machine Check Exception: 0...04
Bank 1: f20...115
Kernel panic: CPU context error

Does anybody have an idea to get this fixed?

Thank you in advance
Stefan

[SchulzStefan]

I downgraded clamav to 0.82. The problem still occurs. I didn't change anything at the hardware. Has anybody else this problem?

[SchulzStefan]

Hmm, seems things getting clearer. I started manually the clamscan for the server. And, as I have a lot of time starring on the screen I found out, that the system collapses while checking a file with a size of 96 MB. The CPU utilization (CPU Load) was nearly 100%. So, am I right with a) spending more memory for the machine, or b) setting a switch in the clamd.conf prohibiting scanning files exceeding the size of may be 10 MB?

Anybody suggestions or useful hints for me?

Thx in advance
Stefan

[SchulzStefan]

To whom it may concern...

To fix the above mentioned problem, I tried a few things. First I downgraded the clamav. Didn't work. The clamscan job still kills the server. Then I installed more RAM. Still the same problem. Clamscan greps 99% CPU-Usage and kills the server.

After all I made a complete new installation. Thank's to Duncan for backuppc! I installed from Jesper the Spamassassin and the clamav. Right now, the system is working without problems. TOP is reporting a CPU-usage of < 1%. I didn't start clamscan yet. I'm afraid, it's killing again my server - I'll do this today in the evening.

BUT - does anybody has some kind of experiences with clamscan in this problem? I would like to know the reason why clamscan is taking nearly 100% of the CPU and finally killing the machine.

I'll inform about the result of running clamscan tomorrow.

Stefan

[mbachmann]

I'm running the same version/environment and do not have any problems with 0.83 on a 1 Ghz/256MB Ram machine. But i only let Clam scan ibays once a week and in/outgoing mail.

[SchulzStefan]

Here's the result of my test: I tried scanning my ibays. Command: clamscan -r. Result: The server crashes after 11 minutes and a CPU utilization of nearly 100%.

SO WHAT??? This is not making sense. It's a clean installation, nothing specific. I didn't change anything at the defaults. Does this mean, clamav is only great for scanning e-mails?

Has anybody suggestions or a recommondation for an antivirus scanner, that works for the sme-server?

Thank's in advance
Stefan

[mdo]

Could there be a corrupted zip file (or other archive) which might cause this?
We have seen problems with RAV and BitDefender in the past with "corrupted" zips.

Can you enable a log file for clamscan to see how far it progressed or scan idividual ibays only to come closer to the directory where a bad file might be in?

Regards,
Michael

[SchulzStefan]

Hi Michael,

good hint - there are a lot of zip-files on the ibays. A few backup zip-files from our Office Software (Lexware) which have the ending .zip, but might be not a regular zip-file. I'll configure the clamscan not to unpack the zip's. I'll let you know about the result.

Regards
Stefan

[SchulzStefan]

Hmm, meanwhile I checked the idea out, not to scan zip-archives. The result is, the server dies. I checked another thing also - I downgraded back to clamav 0.81. The result is - the server dies.

I checked the clamav-forum (http://lurker.clamav.net/list/clamav-users.html), and there are a few threads about exactly that theme, that clamscan takes 100% of the CPU. There are also some placements about this problem in google (/google/linux/"clamscan cpu"). Nobody has a straight solution for this problem. So, in fact: How can I run a program scanning my ibays (or system) while killing a server???

Michael, could you post me your (in /etc) clamd.conf and your clamscan? As well as the conf's in /etc/e-smith/templates/etc?

I would really like to know, how to get this problem fixed! Is there anybody out there with a litte help?

Stefan

[SchulzStefan]

Jesper gave me a hint. The CPU fan was defect. Now everything is fine.

Sorry for the irritations.

Stefan