clamav and the service router

[Giri]

Hello Team

Scalix worked fine (SAC, Webmail, mail delivery and so on)

I followed the tech-note to set up ClamAV and it seems that the AV-Engine is working, but the service router could not start anymore.
I had already a look into the forum threads and found a lot of similar problems but after trying a lot of the written hints and tricks without any success, I would like to ask the specialists.

I post the most important data.

- SUSE Linux 10.0 (64bit)
- 64Bit ClamAV -> downloaded RPM's from SUSE (V.0.88)
- Scalix 10.0 Community Edition

==============================================

miraculix:/var/opt/scalix/data # clamscan *
0000001/items.db: OK
<--- snip ---->
0000020/items.db: OK
----------- SCAN SUMMARY -----------
Known viruses: 42108
Engine version: 0.88
Scanned directories: 64
Scanned files: 184
Infected files: 0
Data scanned: 1.45 MB
Time: 1.320 sec (0 m 1 s)

==========================================

miraculix:/var/opt/scalix/data # omon -w router
Enabling 1 subsystem(s).
Service Router Aborted
miraculix:/var/opt/scalix/data #

==============================================

cat /etc/group:
<----- snip ------>
beagleindex:!:103:
scalix:!:104:vscan
vscan:!:105:scalix
nobody:x:65533:
nogroup:x:65534:nobody
<------- snip ------->

==============================================
cat var/opt/scalix/logs/fatal

ERROR Service Router(Service Router) Tue Mar 21 22:03:32 2006
[OM 5181] Reply timed out or invalid - Mapper protocol problem.
Command sent: QUIT Please Close This Session
Reply received: 220 Virus Scanning Client Ready
Pid of logging process: 6679


ERROR Service Router(Service Router) Tue Mar 21 22:03:32 2006
[OM 5183] A Mapper error has been detected.
Pid of logging process: 6679


SERIOUS ERROR Service Router(Service Router) Tue Mar 21 22:03:32 2006
[OM 5183] A Mapper error has been detected.
Pid of logging process: 6679

==============================================

miraculix:/var/opt/scalix/logs # dir /var/opt/scalix/rules
total 56
drwxrwx--- 2 scalix scalix 4096 Mar 21 21:51 .
drwxrwxr-x 50 vscan vscan 4096 Mar 21 21:24 ..
-rw-r--r-- 1 root root 334 Mar 7 20:28 ALL-ROUTES
-rw-r--r-- 1 root root 321 Mar 21 21:51 ALL-ROUTES.VIR
-rw-r--r-- 1 root root 233 Mar 18 23:57 ndninfo.txt
-r-xr-xr-x 1 root root 35644 Mar 21 17:55 omvscan.map
miraculix:/var/opt/scalix/logs #

==============================================

cat /var/opt/scalix/rules/ALL-ROUTES.VIR
VIRUS-UNCLEANED=1 ACTION=REJECT NDN-INFO=!ndninfo.txt
VIRUS-UNCLEANED=0 VIRUS-FOUND=1 ACTION=ALLOW NOTIFY="A Virus was found in your message. It was successfully cleaned and sent to the recipient. However we highly recommend that you install or update your virus protection software and scan your computer for viruses."

======================================

Also did this:
Go to /var/opt/scalix/sys/omvscan.cfg and set OMAV_LOGLEVEL=3. You should then restart the service router

this are the entries in/var/opt/scalix/logs/omvscan.log:

2006-03-21 22:33:00:PID=7426:############## /var/opt/scalix/tmp/omvscan_cfg.7426
2006-03-21 22:33:00:PID=7426:OMAV_LOGFILE=$(omrealpath '~/logs/omvscan.log')
2006-03-21 22:33:00:PID=7426:OMAV_LOGLEVEL=3
2006-03-21 22:33:00:PID=7426:CLAMAV_ENGINE=/usr/bin/clamdscan
2006-03-21 22:33:00:PID=7426:CLAMAV_SCAN_OPTIONS='--stdout'
2006-03-21 22:33:00:PID=7426:CLAMAV_CLEAN_OPTIONS='--stdout'
2006-03-21 22:33:00:PID=7426:CLAMAV_LOGPGX=$(omrealpath '~/tmp/clamav.log')
2006-03-21 22:33:00:PID=7426:CLAMAV_USE_LOCKING=no
2006-03-21 22:33:00:PID=7426:CLAMAV_LOCK_FILE=clamav.lock
2006-03-21 22:33:00:PID=7426:############## /var/opt/scalix/tmp/omvscan_cfg.7426
2006-03-21 22:33:00:PID=7426:/usr/bin/clamdscan --stdout /tmp/clamav_test.7426 > /var/opt/scalix/tmp/clamav.log.7426
2006-03-21 22:33:00:PID=7426:[Reply]:503 "ClamAV" is not running
2006-03-21 22:33:00:PID=7426:[Reply]:220 Virus Scanning Client Ready
2006-03-21 22:33:00:PID=7426:[Command Received]:QUIT Please Close This Session
2006-03-21 22:33:00:PID=7426:[Reply]:221 Virus Scanning Client Shutdown
miraculix:/var/opt/scalix/data #
miraculix:/var/opt/scalix/data #

=====================================================

Not sure what is wrong here...
Any hints ?

Thanks for support
Daniel

[ScalixSupport]

It looks like clamd isn't running.

Running clamscan does not prove this as it is self-contained.

You need to run clamdscan to talk to clamd.

Cheers

Dave

[Giri]

Hello Dave

You could be right:

I assume you mean this section in the doc:
You will also have to edit the /etc/init.d/clamd file and modify the start section so that the clamd daemon
starts with the added parameter “-c /etc/clamd.conf”. Verify that the “User” parameter in the clamd.conf file is set to the
same user that you added to the scalix group above.

To be honest, I didn't find the place to put in the parameter in the clamd.conf...
could you give me a tip with the current version of ClamAV where to put in the sentence ?

I notice as well a little strange thing:
If I try to run the deamon by typing "clamd" in the root console, then it seems that the process hangs. If I start clamd as a background service and check the /var/log/clamd, nothing is in there.
However, if I try a telnet to 127.0.0.1 3310, the application respons.
If I kill the clamd process and try again the telnet, an error appears - it seems that the daemon is running by starting manually.

miraculix:/var/log # clamd &
[1] 11885
miraculix:/var/log # telnet 127.0.0.1 3310
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Connection closed by foreign host.

miraculix:/var/log # ps -a
PID TTY TIME CMD
11885 pts/0 00:00:00 clamd
11892 pts/0 00:00:00 ps

miraculix:/var/log # kill -9 11885
[1]+ Killed clamd
miraculix:/var/log # telnet 127.0.0.1 3310
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused

(but starting the service router fails all the time...)

So the following questions pops up to me:
- How I need to configure the clamd that it is starting correct (and troubleshoot that)

Thanks for support
Daniel

[jch]

I think you need to start the ClamAV service, something like this:

Code: Select all

/etc/rc.d/clamd start

Assuming you've set everything up properly, the ClamAV service should start automatically on reboot.

jch

[Giri]

I found out the basic problem, it was the permission...
Strange, because I followed the config written in the doc to set up the groups correctly (I did it via Yast).
After a manual change in the /etc/group and /etc/passwd group (set scalix and vscan user to the same ID number) it works to start the service router.

However, I still have the problem to set up clamd as daemon to start automatically after reboot of the server.

The command: /etc/rc.d/clamd start
starts the daemon, but after reboot, it is not running anymore.

forgive a Linux Baby, but how I can configure that correctly to run as service ???

Cheers
Daniel

[Giri]

Hello Team

I solved the problem via Yast runlevel editor.

Thanks for your support !

Cheers
Daniel