[SOLVED] antivirus not running?

[MeneM]

Dear zimbra

I've been having problems with antivirus on my server. The admin console claims it's not on and mails are not being delivered and are in "deferred" status.

I'm seeing these lines in the syslog about them:

 amavis[26200]: (26200-01) (!!)ClamAV-clamd av-scanner FAILED: Too many retries to talk to 127.0.0.1:3310 (Can't connect to INET socket 127.0.0.1:33
10: Connection refused) at (eval 45) line 269.

Even though clamd is running:

zimbra@server:/home/admin$ zmcontrol status
Host server.somewhere.nl
        antispam                Running
        antivirus               Stopped
                zmclamdctl is not running
        ldap                    Running
        logger                  Running
        mailbox                 Running
        mta                     Running
        snmp                    Running
        spell                   Running
zimbra@server:/home/admin$ ps ax | grep clamd
 7998 ?        Rs     0:38 /opt/zimbra/clamav/sbin/clamd --config-file /opt/zimbra/conf/clamd.conf
12029 pts/0    R+     0:00 grep clamd
zimbra@server:/home/admin$ zmclamdctl status
cat: /opt/zimbra/log/clamd.pid: No such file or directory
zimbra@server:/home/admin$

Amavis is also running:

ps ax | grep amavis
 4403 ?        Ss     0:01 amavisd (master)
 4459 ?        S      0:00 amavisd (ch1-avail)
 4460 ?        S      0:00 amavisd (ch1-avail)
 4461 ?        S      0:00 amavisd (ch1-avail)
 4462 ?        S      0:00 amavisd (virgin child)
 4463 ?        S      0:00 amavisd (virgin child)
 4521 ?        S      0:00 amavisd (virgin child)
 4522 ?        S      0:00 amavisd (virgin child)
 4523 ?        S      0:00 amavisd (virgin child)
 4667 ?        S      0:00 amavisd (virgin child)
 4668 ?        S      0:00 amavisd (virgin child)
13595 ?        S      0:00 smtp -n smtp-amavis -t unix -u -o smtp_data_done_timeout 1200 -o smtp_send_xforward_command yes -o disable_dns_lookups yes -o max_use 20
13727 pts/1    S+     0:00 grep amavis

I've reinstalled Zimbra (downloaded the lastest one: 4.5.6_1044) (Which I was already using).

Sometimes I do zmcontrol shutdown and zmcontrol startup a few times in a row and it may or may not start up.

I've rm'd the clamav db directories (after which, when this did not help, I did the upgrade of Zimbra again.) and altered the interval setting referenced elsewhere here on the forums. I have no idea what to try next.

Any idea's?

Thanks

[dijichi2]

Hi

Search for recent threads in this forum about the same problem. Solution is to either manually upgrade to newer version of clamav, or to increase the watchdog timeout for the current version.

[MeneM]

Originally Posted by dijichi2

Hi

Search for recent threads in this forum about the same problem. Solution is to either manually upgrade to newer version of clamav, or to increase the watchdog timeout for the current version.

Hi and thanks for the quick answer. I've have indeed increased the waiting time, the interval is now 180.

But waiting does not seem to be the problem, I'm thinking amavis is unable to contact clamav on the 3310 port.

Upgrading clamav seems to me like being overkill and something I should not do with zimbra. You know: "Customizations are overwritten with the next upgrade"

If clamav needs to upgraded in order for Zimbra to work, should Zimbra not simply release a new version / upgrade?

Anyway, it's been working for a while, but seemingly stopped working since a few day's now. All that is happening on this box is the nightly stop (zmcontrol shutdown) and start (zmcontrol startup) for the regular backup (using dirvish/rsync)

[MeneM]

Dear reader,

I may be jumping the gun here, as it seems a new version: 4.5.7 is beeing/has been created.

I'm also going through all the options already there, starting by updating the interval setting to 300.

(My server: Dual Core, 2.6Ghz, 2GB ram and 80 GB hard drive)

[dijichi2]

The problem is that for some reason the version of clamav in 4.5.6 (0.90.2 i think) has started taking much longer than it used to read its databases in. So long that the watchdog thinks it's failed and tries to restart it, hence you end up in a cycle. Increasing the watchdog timeout should give it long enough to start, if 180 isn't long enough, try 240, 320 etc.

Alternatively, I posted the exact configure/make command to install the new version of clamav from source. It's very quick, very easy and also gives you better antivirus protection. As you say it will be overwritten on the next zimbra upgrade which is fine, no problem.