EFA Monitor ALERT [SOLVED]
EFA Monitor ALERT [SOLVED]
Hi everybody,
Since a couple of week (not really sure for how long) we receive an "EFA Monitor ALERT" once or twice a day with says:
Service clamd down and restarted ( 2 attempts in past day, max attempts is 3 )
Please examine your EFA logs and resources to determine cause of failure.
I check all the logs I could find, but for as far as I can tell clamd is running normally.
Does anybody know which log to check to find more information about whats causing the error.
TIA
Regards,
Cor van den Berghe
Since a couple of week (not really sure for how long) we receive an "EFA Monitor ALERT" once or twice a day with says:
Service clamd down and restarted ( 2 attempts in past day, max attempts is 3 )
Please examine your EFA logs and resources to determine cause of failure.
I check all the logs I could find, but for as far as I can tell clamd is running normally.
Does anybody know which log to check to find more information about whats causing the error.
TIA
Regards,
Cor van den Berghe
- shawniverson
- Posts: 3650
- Joined: 13 Jan 2014 23:30
- Location: Indianapolis, Indiana USA
- Contact:
Re: EFA Monitor ALERT
This means that clamd is dying on your machine. Do you see anything in /var/log that may be helpful?
Re: EFA Monitor ALERT
I've checked the logs in /var/log/clamav/ and the messages log but I can't find anything that might explain whats going on. Any idea what to look for specifically in the logs?
Regards.
Cor.
Regards.
Cor.
- shawniverson
- Posts: 3650
- Joined: 13 Jan 2014 23:30
- Location: Indianapolis, Indiana USA
- Contact:
Re: EFA Monitor ALERT
If you see nothing in the logs (which can happen if a service is dying). How does your server stats. i.e. from top and friends, look like during a service crash? Are you less than 2GB of free memory, for instance?
Also, do you have a swap partition?
Also, do you have a swap partition?
Re: EFA Monitor ALERT
Sorry for my late reply.
At the moment of the alerts the processor load is close to 0, there is no excessive network traffic and there is 700 MB (approx) free memory.
I did notice that there is no swap partition available, do you think this might be the problem?
At the moment of the alerts the processor load is close to 0, there is no excessive network traffic and there is 700 MB (approx) free memory.
I did notice that there is no swap partition available, do you think this might be the problem?
Re: EFA Monitor ALERT
I just added 2 GB of memory bringing the total to 4GB, see if this helps.
Re: EFA Monitor ALERT
No luck, even with 4 GB of memory and after a reboot the alerts still show up.
I'm going to check the logs again, maybe I can find a clue this time.
I'm going to check the logs again, maybe I can find a clue this time.
Re: EFA Monitor ALERT
I give up, I can't find anything in the logflies which points to problems.
I guess I'll just wait and see what happens, I did notices that the alerts are less frequent, yesterday there were no alerts at all.
Thanks for the help.
I guess I'll just wait and see what happens, I did notices that the alerts are less frequent, yesterday there were no alerts at all.
Thanks for the help.
Re: EFA Monitor ALERT
If you cannot find anything in your logs I suggest you install a monitoring service to try and see if you can correlate the cause visually.
I suggest this free one: https://nixstats.com
that way if you have a problem, have a look at the graphs and see if any sudden anomaly catches your eye.
I've often found this helps, i.e. I experience an error I cannot track down via logs so I look at graphs and if there is a sudden spike be it CPU, RAM, inodes, network it will at least give you an idea of where exactly to look.
I suggest this free one: https://nixstats.com
that way if you have a problem, have a look at the graphs and see if any sudden anomaly catches your eye.
I've often found this helps, i.e. I experience an error I cannot track down via logs so I look at graphs and if there is a sudden spike be it CPU, RAM, inodes, network it will at least give you an idea of where exactly to look.
- shawniverson
- Posts: 3650
- Joined: 13 Jan 2014 23:30
- Location: Indianapolis, Indiana USA
- Contact:
Re: EFA Monitor ALERT
Bump to 8GB to humor me.
Re: EFA Monitor ALERT
Hi ovizii,ovizii wrote:If you cannot find anything in your logs I suggest you install a monitoring service to try and see if you can correlate the cause visually.
I suggest this free one: https://nixstats.com
that way if you have a problem, have a look at the graphs and see if any sudden anomaly catches your eye.
I've often found this helps, i.e. I experience an error I cannot track down via logs so I look at graphs and if there is a sudden spike be it CPU, RAM, inodes, network it will at least give you an idea of where exactly to look.
Thanks for your reply!
We use Zabbix and VMware vcenter for monitoring, on both there is nothing special to see at moment of the alerts, I checked them already.
Cor.
Re: EFA Monitor ALERT
Hi,shawniverson wrote:Bump to 8GB to humor me.
I've increased the memory to 8 GB.
I must add that the last alert was 5 days ago.
Cor.
Re: EFA Monitor ALERT
Since I increased the memory to 8 GB there has been just 1 alert, it looks like increasing the memory did the trick.
Re: EFA Monitor ALERT
Ok, the alerts are gone, thanks for the help.
Is there any way I can mark this thread as solved?
Is there any way I can mark this thread as solved?