[SOLVED] Mail delivery halted - ClamAV problem(?)

[jdoller]

This morning my users noted that internal mail delivery had stopped.

Upon investigation I found the following in the Postfix mail queue:

"...virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamd av-scanner FAILED: Too many retries to talk to 127.0.0.1:3310 (Can't connect to INET socket 127.0.0.1:3310: Connection refused) at (eval 45) line 269. (in reply to end of DATA command))..."

I need our mails to start going out - it's monthend with all the stress that that brings.

Additionally, I'd like to completely disable all of Zimbra's internal spam and virus checking. But the fastest way to get my emails delivered would be appreciated.

Regards,

Jason

[cedric.galletti]

Hello,

I a have the same problem.

The restart "zmclamdctl stop" & "zmclamdctl start" is not the solution !

Regards,

Cedric

[jdoller]

What I eventually ended up doing was to dl the latest Clam, compile it, and use that instead. Mail has all been delivered, and I've replaced the Zimbra Clam with my new one.

Hope I haven't created more problems, and I would LOVE to know why is suddenly died like that.

Jason

[russgalleywood]

I would also like to know this ASAP!

Our Air Con fitting Guy knocked out the power to our Server room this morning!
It was 5 mins after this that I discovered that one of our UPS's was faulty!

This crashed the Zimbra server and on restart we are getting these messages on sending and receiving in the mailbox logs.

So how do I fix this quick please!?
I see the bit about re-compiling but I need to get this working straight away as I have sales staff moaning at me?

If re-compiling is easy enough I'll give it a go, otherwise is there a quick way of disabling this as we are on MessageLabs for all our Email filtering so can survive without it for a while?

Help much appreciated!
Russ

[jdoller]

If re-compiling is easy enough I'll give it a go, otherwise is there a quick way of disabling this as we are on MessageLabs for all our Email filtering so can survive without it for a while?

Help much appreciated!
Russ

Hi Russ

I wasn't able to figure out how to completely remove it, which makes a recompile your only real option. It isn't too difficult.

Jason

[jholder]

Looks like you're running 4.5.6

Please upgrade to 4.5.9, as that should fix the issue.

[russgalleywood]

Yep, that's what I did!

It worked!

Thanks Guys

[mmorse]

Working, not solved - I would LOVE to know why is suddenly died like that

BTW-If you we're curious as to why:
/forums/installation/11957-solved-clamd-pid-no-such-file.html#post61912
Bug 18312 - ClamAV: clamd corrupt db

Status of this thread:
russgalleywood -OK
jdoller -OK, but wondering why
cedric.galletti - unknown

[jholder]

Why:
Zimbra has watchdog processes that monitors most of the important services. In the event of a failure, it can restart them.

In the 4.5.6 build, we included a bad version of ClamAV. This version had a bad-lag in startup time. Because it takes so long to start up, the Zimbra watchdog thinks that ClamAV is down and attempts to restart it. . thus resulting in a loop.

[jdoller]

Looks like you're running 4.5.6

Please upgrade to 4.5.9, as that should fix the issue.

I did this morning, thanks for the info.

I actually thought I was running 4.5.8. I was running 4.5.5.

Thanks again,

Jason