Clam Dumping

[Matthew Carpenter]

On Friday 30 May 2008, Bill Campbell wrote:
> On Fri, May 30, 2008, Matthew Carpenter wrote:
> >Hey all,
> >
> >I have one machine that just continually crashes ClamAV.  I'm running the
> >clamd daemon in conjunction with Amavis and Postfix for mail-filtering.
> >
> >All I get from amavis is messages that clamd is dead:
>
> I think you posted something on this recently, and I replied to
> that at the time.

I'm sorry Bill.  I've not been a very good netizen lately.

> We run the current version, clamav-0.93, on a fairly large number
> of systems, and I don't see any significant pattern of failures.
> We have scripts that run every fifteen minutes that check various
> services to see if they are running, and restart any that aren't.

I'm doing the same approach right now.

> Typically when clamav dies, it is at a period of maximum load,
> usually around midnight when our daily system maintenance starts
> which includes full security monitoring and intrustion detection
> which examines much of the system in detail.

ok, thanks for that info...

> I have seen problems with clamav built on Intel boxes getting an
> illegal instruction on AMD and vice versa.  This isn't normally a
> problem on our systems as we build packages from source on all
> boxes during software updates, but I have seen it when doing
> binary installs of packages on new systems.

hmmm.. so you think it may be in the packaging, not the source?

> It is also possible to start multiple copies of clamd, as it does
> not create a PID file until it has completed reading all of its
> database files, which can take several minutes.  Monitor programs
> that check for the existence of a PID file may well start extra
> clamd processes.  Fixing this in the clamd source has been on my
> to-do list for quite a while, but so far I haven't had an
> adequate supply of round tuits.

All I've got in my bag of spares are squares...
Thanks Bill,
Matt
-- 
Matthew Carpenter
mcarpenter at intelguardians.com
http://www.intelguardians.com

PGP Fingerprint: 
87EB 54A8 FB42 0A0E B8AE CDA7 FF99 2A64 E70F 4466
hkp://wwwkeys.pgp.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part.
Url : http://mailman.celestial.com/pipermail/linux-users/attachments/20080603/512ae9b2/attachment-0002.bin