Koozali.org: home of the SME Server

Obsolete Releases => SME Server 9.x => Topic started by: mophilly on January 26, 2018, 10:46:48 AM

Title: [Solved] Clamscan warning "Can't open files... too many open files"
Post by: mophilly on January 26, 2018, 10:46:48 AM

A fully updated 9.2 install sent an email with the warnings.

Code: [Select]

WARNING: Can't open file /home/e-smith/files/ibays/... : Too many open files
The ClamAV and db versions are 0.99.2/24256/Thu Jan 25 17:21:53 2018. Scan daily, quarantine enabled.

Coincidentally, this same error message was generated by an "almost retired" SME 8 system at the same time, give or take a few minutes.

What is the recommended action?

Title: Re: Clamscan warning "Can't open files... too many open files"
Post by: bunkobugsy on January 26, 2018, 11:30:55 AM

Even worse, mail delivery is in DOS with 452 until clamd is restarted.
Running 0.99.2/24257/Fri Jan 26 11:24:57 2018 on 9.2 x64.
Could it be something related to db version?

Title: Re: Clamscan warning "Can't open files... too many open files"
Post by: michelandre on January 26, 2018, 02:11:42 PM

Hi all,

Same problem, this morning I have around 2900 lines of "Too many open files". First time ever.

Since last OK scan, nothing changed, nothing new on 9.2.

Michel-André

Title: Re: Clamscan warning "Can't open files... too many open files"
Post by: diplo on January 26, 2018, 04:17:41 PM

Just registered, already on the bug site but not on the forums.

Thought I'd register to get any updates as nothing in the bugs :) I've disabled on our sites for now, I've checked the clamav bugzilla too and nothing there either.

Will create a bug report there later if I don't hear anything else I guess ?

Title: Re: Clamscan warning "Can't open files... too many open files"
Post by: Jean-Philippe Pialasse on January 26, 2018, 04:21:17 PM

Quote from: diplo on January 26, 2018, 04:17:41 PM

Just registered, already on the bug site but not on the forums.

Thought I'd register to get any updates as nothing in the bugs :) I've disabled on our sites for now, I've checked the clamav bugzilla too and nothing there either.

Will create a bug report there later if I don't hear anything else I guess ?

This seems like upstream bug, so yes you should open one bug on clamav, and please report it there. Seeing at the last thread in this forum there are at least 3 manifestation maybe related to same issue:

- too many files openned
- email queue stop because of clamav
- encoding of email is wrong

Title: Re: Clamscan warning "Can't open files... too many open files"
Post by: bunkobugsy on January 26, 2018, 07:07:08 PM

I think it was a vulnerability, 0.99.3 is released, waiting for the update.

http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html

Title: Re: Clamscan warning "Can't open files... too many open files"
Post by: bunkobugsy on January 27, 2018, 11:05:15 AM

https://bugs.contribs.org/show_bug.cgi?id=10499

Title: Re: Clamscan warning "Can't open files... too many open files"
Post by: michelandre on January 27, 2018, 11:35:35 AM

Hi all,

Didn't do nothing on the server and this morning, the scan went perfect!

Yesterday

Code: [Select]

----------- SCAN SUMMARY -----------
Known viruses: 6396044
Engine version: 0.99.2
Scanned directories: 657
Scanned files: 1273
Infected files: 0
Total errors: 6102
Data scanned: 271.97 MB
Data read: 687.46 MB (ratio 0.40:1)
Time: 47.661 sec (0 m 47 s)
Today

Code: [Select]

----------- SCAN SUMMARY -----------
Known viruses: 6397114
Engine version: 0.99.2
Scanned directories: 16647
Scanned files: 100047
Infected files: 0
Data scanned: 13145.36 MB
Data read: 9927.69 MB (ratio 1.32:1)
Time: 5141.720 sec (85 m 41 s)
Michel-André

Title: Re: Clamscan warning "Can't open files... too many open files"
Post by: Daniel B. on January 27, 2018, 11:57:37 AM

For those who have been affected by this problem, see http://blog.clamav.net/2018/01/update-on-recent-file-descriptors-issue.html
The issue was in a signature update, which triggered a bug in ClamAV. It has nothing to do with th security fixes in 0.99.3

I'm working ATM in updating ClamAV to 0.99.3 nonetheless.

Cheers,
Daniel

Title: Re: Clamscan warning "Can't open files... too many open files"
Post by: georgios on January 27, 2018, 07:55:37 PM

Quote from: Daniel B. on January 27, 2018, 11:57:37 AM

For those who have been affected by this problem, see http://blog.clamav.net/2018/01/update-on-recent-file-descriptors-issue.html
The issue was in a signature update, which triggered a bug in ClamAV. It has nothing to do with th security fixes in 0.99.3

I'm working ATM in updating ClamAV to 0.99.3 nonetheless.

Cheers,
Daniel

Thanks for the update Daniel, everything under control now !