I've had two situations recently (probably related) that have caused me to wonder if clamav and (the demonized) freshclam were watched in the same way the mailbox daemon is. When the mailbox service stops responding, ZCS helpfully restarts it and lets me know this has happened.

In the case of clamav, we first had a situation where all of our incoming mail stopped being delivered (it all thankfully queued) with messages like this:

Code:
(host 127.0.0.1[127.0.0.1] said: 451 4.5.0 Error in processing, id=02751-02-7, virus_scan FAILED: 
virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamd av-scanner FAILED: CODE(0x8173dc8) 
Too many retries to talk to 127.0.0.1:3310 (Can't connect to INET socket 127.0.0.1:3310: Connection refused) at (eval 75) line 310. at (eval 75) line 511. (in reply to end of DATA command))
and

Code:
2008-09-22 02:43:59 deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0
 Error in processing, id=29875-04-2, virus_scan FAILED: 
virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamd av-scanner 
FAILED: CODE(0x8173dc8) Too many retries to talk to 127.0.0.1:3310 (Can't connect to INET sock
In the case of freshclam, we had log messages like this:

Code:
WARNING: Clamd was NOT notified: Can't connect to clamd on 127.0.0.1:3310
At some point freshclam died entirely and our signatures were not updated for several days.

So my question is: are clamav/freshclam watched using the same mechanism as processes like zmmailboxd? If not, can they be? I can add my own, out-of-band log/service watching mechanism but I'd prefer to have the product self-recover in this failure mode as well.

Thanks!
-- dNb