Antivirus keeps restarting (ZCS Network ed 4.5.11)

[jcapel]

Hi,

Clamd keeps being restarted by the watchdog.

Excerpt from zmmtaconfig.log:

Mon Feb 18 10:54:03 2008  CONTROL ANTIVIRUS: /opt/zimbra/bin/zmclamdctl restart 
/opt/zimbra/bin/zmclamdctl status norewrite returned 0x100:Mon Feb 18 10:54:13 2008  Sleeping for 240.
/opt/zimbra/bin/zmclamdctl restart  returned 0000:Mon Feb 18 10:58:17 2008  Service imapproxy is not enabled.  Skipping perdition
Mon Feb 18 10:58:17 2008  Watchdog adding antivirus to restart list
Mon Feb 18 10:58:17 2008  Section antivirus did not change skipping
Mon Feb 18 10:58:17 2008  Section antispam did not change skipping
Mon Feb 18 10:58:17 2008  Section mta did not change skipping
Mon Feb 18 10:58:17 2008  Section sasl did not change skipping
Mon Feb 18 10:58:17 2008  Section webxml did not change skipping
Mon Feb 18 10:58:17 2008  Section mailbox did not change skipping
Mon Feb 18 10:58:17 2008  Section perdition did not change skipping
Mon Feb 18 10:58:17 2008  CONTROL ANTIVIRUS: /opt/zimbra/bin/zmclamdctl restart 
/opt/zimbra/bin/zmclamdctl status norewrite returned 0x100:Mon Feb 18 10:58:27 2008  Sleeping for 240.

I have tried the following:
- Increasing watchdog timer from 120s to 240s.
- Update ClamAV 0.92 to 0.92.1

Neither of these steps had the desired effect. The weird thing is ClamAV is running and does start within a reasonable amount of time. Amavis is processing the messages successfully. However, at some point the ClamAV pidfile magically disappears from /opt/zimbra/log. I think that's what causing watchdog to trigger the restart.

This is an annoying situation for me, as the zimbra init script will now return an error code. This is causing heartbeat or RHCS to abort any failover. (I could write a wrapper for this, but I'd much rather solve the ClamAV issue.)

Any pointers?

Thanks in advance!

[mmorse]

Welcome to the forums,

Not a perfect solution, but in the interim you could:
Backup the /opt/zimbra/bin/zmantivirusctl file
As the zimbra user create /opt/zimbra/log/clamd.pid.fake
Then as root, in /opt/zimbra/bin/zmantivirusctl right after the line:

/opt/zimbra/bin/$i start norewrite

Insert:

cp /opt/zimbra/log/clamd.pid.fake /opt/zimbra/log/clamd.pid

So that everytime clamav starts it creates the clamd.pid file from clamd.pid.fake
-Be sure to check for running processes anytime you stop zimbra (ps aux | grep zimbra).

When you have the time, some things to try:

1) zmcontrol stop and check the /tmp for any entries relevant to clamav that may need cleaning out.

2) I know you just updated clamav but to clear the defs anyway:

su - zimbra
  mkdir /tmp/clamdb
  mv /opt/zimbra/clamav/db/* /tmp/clamdb
  zmprov ms `zmhostname` +zimbraServiceEnabled antivirus
 /opt/zimbra/clamav/bin/freshclam --config-file=/opt/zimbra/conf/freshclam.conf 
 zmamavisctl stop 
zmamavisctl start

3) Make the jump to 5.0.2: 4.5.11 & 5.0.2 Released!

4) Besides your excerpt from zmmtaconfig.log, anything in clamd.log?

5) Start a support ticket so we can have a look