EFA Monitor ALERT [SOLVED]

[cor9957]

Hi everybody,

Since a couple of week (not really sure for how long) we receive an "EFA Monitor ALERT" once or twice a day with says:

Service clamd down and restarted ( 2 attempts in past day, max attempts is 3 )
Please examine your EFA logs and resources to determine cause of failure.

I check all the logs I could find, but for as far as I can tell clamd is running normally.
Does anybody know which log to check to find more information about whats causing the error.

TIA

Regards,
Cor van den Berghe

[shawniverson]

This means that clamd is dying on your machine. Do you see anything in /var/log that may be helpful?

[cor9957]

I've checked the logs in /var/log/clamav/ and the messages log but I can't find anything that might explain whats going on. Any idea what to look for specifically in the logs?

Regards.
Cor.

[shawniverson]

If you see nothing in the logs (which can happen if a service is dying). How does your server stats. i.e. from top and friends, look like during a service crash? Are you less than 2GB of free memory, for instance?

Also, do you have a swap partition?

[cor9957]

Sorry for my late reply.

At the moment of the alerts the processor load is close to 0, there is no excessive network traffic and there is 700 MB (approx) free memory.
I did notice that there is no swap partition available, do you think this might be the problem?

[cor9957]

I just added 2 GB of memory bringing the total to 4GB, see if this helps.

[cor9957]

No luck, even with 4 GB of memory and after a reboot the alerts still show up.
I'm going to check the logs again, maybe I can find a clue this time.

[cor9957]

I give up, I can't find anything in the logflies which points to problems.
I guess I'll just wait and see what happens, I did notices that the alerts are less frequent, yesterday there were no alerts at all.
Thanks for the help.

[ovizii]

If you cannot find anything in your logs I suggest you install a monitoring service to try and see if you can correlate the cause visually.
I suggest this free one: https://nixstats.com

that way if you have a problem, have a look at the graphs and see if any sudden anomaly catches your eye.

I've often found this helps, i.e. I experience an error I cannot track down via logs so I look at graphs and if there is a sudden spike be it CPU, RAM, inodes, network it will at least give you an idea of where exactly to look.

[shawniverson]

Bump to 8GB to humor me.

[cor9957]

If you cannot find anything in your logs I suggest you install a monitoring service to try and see if you can correlate the cause visually.
I suggest this free one: https://nixstats.com

that way if you have a problem, have a look at the graphs and see if any sudden anomaly catches your eye.

I've often found this helps, i.e. I experience an error I cannot track down via logs so I look at graphs and if there is a sudden spike be it CPU, RAM, inodes, network it will at least give you an idea of where exactly to look.

Hi ovizii,

Thanks for your reply!
We use Zabbix and VMware vcenter for monitoring, on both there is nothing special to see at moment of the alerts, I checked them already.

Cor.

[cor9957]

Bump to 8GB to humor me.

Hi,

I've increased the memory to 8 GB.
I must add that the last alert was 5 days ago.

Cor.

[cor9957]

Since I increased the memory to 8 GB there has been just 1 alert, it looks like increasing the memory did the trick.

[cor9957]

Ok, the alerts are gone, thanks for the help.
Is there any way I can mark this thread as solved?