clamd dies at morning maintenance, Debian Woody (0.60-10, backported)

Sometimes, clamd dies during its morning maintenance. I've not found any rhyme or reason to this, however it's a pain for me as I use exim4 + exiscan, and this will stop delivering mail if it can't talk to its Virusscanner. My current workaround: A crontab(5) script that checks to see if the socket is writeable, and stops and starts clamd if not.

# cat /etc/cron.d/check-clamd
TESTFILE="/var/run/clamd.ctl"

* * * * * root [ -w $TESTFILE ] || \
        (/etc/init.d/clamav-daemon stop; \
        /etc/init.d/clamav-daemon start)

I know this isn't the prettiest, but I don't have time to track down why its dying just yet. -- DanielLawson

A similar script is available at http://mikecathey.com/code/clamdwatch/ and in the contrib/clamdwatch directory.

clamdscan can't read files (when run from Amavis or some other scanner)

Jun  9 10:21:02 firewall amavis[17934]: (17934-02) Clam Antivirus-clamd FAILED -
unknown status: /var/lib/amavis/amavis-msg-id/parts: Can't access the file ERROR

ClamAV runs as the clamav user (on Debian/Woody anyway), and when Amavis unpacks its email for scanning as the amavis user. Add clamav to the amavis group, and restart clamd.

Another way around this is to run clamd and amavis as the same user. Apparently this change needs to be made for Conectiva Linux.

This worked on Debian with Exim4-daemon-heavy and clamav:

• Find the user Exim runs as using exim -bP exim_user, in my case Debian_exim.
• Edit /etc/clamav/clamav.conf to change its user to Debian_exim.
• Allow Debian_exim access to ClamAV's files: adduser Debian_exim clamav
• Allow ClamAV to save its PID file: chmod g+w /var/run/clamav

CategoryMailNotes