efa-project.org

after upgrading to Stable 4.0 EFA the Spamfilter stopped working and messages are piling up.

The start-up result is done.
Nov 12 13:57:02 EFAmailscanner CROND[14028]: (root) CMD (/usr/sbin/eFa-Monitor-cron >/dev/null 2>&1)
Nov 12 13:57:02 EFAmailscanner CROND[14029]: (root) CMD (/usr/sbin/checkreboot.sh)
Nov 12 13:57:30 EFAmailscanner MailScanner[14406]: Cannot find Socket (/var/run/clamd.socket/clamd.sock) Exiting!
Nov 12 13:57:30 EFAmailscanner MailScanner[4734]: Virus Scanning: No virus scanners worked, so message batch will be tried again
Nov 12 13:57:58 EFAmailscanner systemd[1]: clamd@scan.service start operation timed out. Terminating.
Nov 12 13:57:58 EFAmailscanner systemd[1]: Failed to start Generic clamav scanner daemon.
-- Subject: Unit clamd@scan.service has failed

is the something changed in permissions ?
found an article which stated that the issue is caused by
/run/clamd.scan 0710 clamscan virusgroup permission, I adjusted it to clamscan:clamscan but that did not work

Any sugestions?

Can you check the override file located here?
It should be set at 300. Try increasing it to 600 and report back please.

it's allready on 900

and cpu is going through the roof
clamscan 87.2 % /usr/sbin/clamd -c /etc/clamd.d/scan.conf

It will until signatures are loaded into memory.

How many CPUs do you have?

doggy101 wrote: ↑12 Nov 2019 16:10 it's allready on 900

Increase it to 1200 and report back. For some reason your machine is taking an extraordinary amount of time to load all the signatures.

Also check and make sure you have at least 2 CPUs and 8GB of memory.

changed to 2CPU and 8GB, struggling with root access to get the value of 900 adjusted,

cpu and memory boost did not solve the issue

Nov 12 19:22:23 EFAmailscanner MailScanner[5935]: Cannot find Socket (/var/run/clamd.socket/clamd.sock) Exiting!
Nov 12 19:22:23 EFAmailscanner MailScanner[3950]: Virus Scanning: No virus scanners worked, so message batch will be tried again
Nov 12 19:22:34 EFAmailscanner systemd[1]: clamd@scan.service start operation timed out. Terminating.
Nov 12 19:22:34 EFAmailscanner systemd[1]: Failed to start Generic clamav scanner daemon.
-- Subject: Unit clamd@scan.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/li ... temd-devel
--
-- Unit clamd@scan.service has failed.
--
-- The result is failed.
Nov 12 19:22:34 EFAmailscanner systemd[1]: Unit clamd@scan.service entered failed state.
Nov 12 19:22:34 EFAmailscanner systemd[1]: clamd@scan.service failed.

changing to 1200 did not solve the issue..

anything else to look for?

Nov 12 19:50:35 EFAmailscanner systemd[1]: clamd@scan.service start operation timed out. Terminating.
Nov 12 19:50:35 EFAmailscanner systemd[1]: Failed to start Generic clamav scanner daemon.
-- Subject: Unit clamd@scan.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/li ... temd-devel
--
-- Unit clamd@scan.service has failed.
--
-- The result is failed.
Nov 12 19:50:35 EFAmailscanner systemd[1]: Unit clamd@scan.service entered failed state.
Nov 12 19:50:35 EFAmailscanner systemd[1]: clamd@scan.service failed.

could this be something?
https://serverfault.com/questions/94852 ... ind-socket

doggy101 wrote: ↑12 Nov 2019 19:16 could this be something?
https://serverfault.com/questions/94852 ... ind-socket

No, systemd is terminating clamd due to timeout. So we can assume it is stalling. This is not a socket problem. You never reach socket initialization phase.

We can verify the socket as follows:

/etc/tmpfiles.d/clamd.socket.conf: /etc/clamd.d/scan.conf: ll -Z /var/run/ If the above checks out I want you to disable clamav-unofficial-sigs as follows:
Report back whether clamd starts after relieving it of the extra signatures...

On:
ll -Z /var/run

Code: Select all

drwxr-x---. clamscan mtagroup system_u:object_r:antivirus_var_run_t:s0 clamd.socket

I got:

[root@EFAmailscanner ~]# ll -Z /var/run
lrwxrwxrwx. root root system_u:object_r:var_run_t:s0 /var/run -> ../run

so it didn't check out

My bad, missed a slash

[root@EFAmailscanner ~]# ll -Z /var/run/
-rw-r--r--. root root system_u:object_r:auditd_var_run_t:s0 auditd.pid
drwxr-x---. chrony chrony system_u:object_r:chronyd_var_run_t:s0 chrony
drwx--x---. clamscan clamscan system_u:object_r:antivirus_var_run_t:s0 clamd.s can
drwxr-x---. clamscan mtagroup system_u:object_r:antivirus_var_run_t:s0 clamd.s ocket

thanks all is fine again

much appreciated ....