clamd won't come up

[RickC]

Hi -

Having a problem this morning keeping clamd up -

From fatal:

ERROR Service Router(Service Router) 04.16.10 07:54:56
[OM 5181] Reply timed out or invalid - Mapper protocol problem.
Command sent: <none - expect greeting reply>
Reply received: 503 "ClamAV" cannot scan Scalix-owned file

Why would this occur all of a sudden, and how would I resolve it?

Thanks

Running 11.4.4. on RH4

[RickC]

Thanks, I found it - a malformed daily.ndb. removed it and ran freshclam and all is well.

[ls-al]

Admins using ClamAV for Router based Virus-Scanning:

Please have a look the the EOL announcement at http://www.clamav.net/eol-clamav-094/ !

[RickC]

Hi - thanks! Good to know, I missed that announcement.

I don't see an updated page for ClamAV upgrades on the wiki .... is this the last page?

http://www.scalix.com/wiki/index.php?title=HowTos/ScalixSecurity

Thanks

[blue72chip]

Hello,

the same error today

ERROR Service Router(Service Router) Fri Apr 16 03:13:03 2010
[OM 5181] Reply timed out or invalid - Mapper protocol problem.
Command sent: QUIT Please Close This Session
Reply received: Can't connect to clamd.
Pid of logging process: 25056


ERROR Service Router(Service Router) Fri Apr 16 03:13:03 2010
[OM 5183] A Mapper error has been detected.

cannot start - Service Router (Service Router Aborted)

[ls-al]

The EOL statement says that ClamAV versions older than 0.95 will stop working after 15. April 2010. The reason why the ClamAV decided to do that is mentioned there too.
If you run clamdscan manually you will see something like

Code: Select all

# /usr/bin/clamdscan --stdout /bin/bash; echo $?
connect(): No such file or directory
WARNING: Can't connect to clamd.
2

This exit code is causing the Service Router to stop, because the scanning engine does not work.
The recommended fix is to upgrade ClamAV. It depends on the OS and the chosen upstream source for ClamAV. For CentOS5 or RHEL5 installations using the RPMforge Repo (includes Dag Apt Repository, the usual source for ClamAV) a simple "yum update clamav" should do that.
If you are currently unable to update Clam AV you might consider to disable the AV-integration for the Service Router like this:

Code: Select all

# cd $(omrealpath "~/rules")
# mv ALL-ROUTES.VIR ALL-ROUTES.VIR.not
# omoff -w -d0 sr
Disabling 1 subsystem(s).
Service Router Stopped
# omon sr

[dougp23]

Wow, I wonder how many people (like me) are going to be blindsided by this one! I took Friday off and came in today with lots of complaints about email being down....All set now, thanks to this post! Maybe it ought to be a sticky, I don't know!

[dougp23]

Anyone (like me) that got pinched by this, here's an important thing to remember:

If Scalix cannot successfully talk with Clamd, all messages (I think outbound as well as inbound) will be moved to the corrupt message queue! You must manually resubmit the messages so they can be delivered:

omresub -q error

Your users will be so thankful. I have a little over 1,000 messages sitting in the queue, so to be able to say "none of your email was lost" and then resubmit and watch mailboxes fill up was very satisfying!!

[RickC]

Surprisingly (or not) I'm told Scalix no longer has updated docs for ClamAV ...