> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of peter > Sent: Monday, May 03, 2004 11:29 AM > To: [EMAIL PROTECTED] > Subject: [Clamav-users] Re: malformed pattern > > > Look at these lines bottom (/var/spool/qmailscan/qmail-queue.log). In > qmail-scanner-queue.pl is exactly what is in this log file > '--database=/usr/local/share/clamav'. And next line (--output of > clamscan was) showes that clamscan is looking somewhere else > '/var/spool/qmailscan/tmp/samko.domain.tld24234/clamav-ab54545/VIR > USES.DB' > . I really don't understand WHY. Btw I think, that clamscan does not > search for clamav.conf - this should do clamd/clamdscan only. But just > to be sure i already put these settings in clamav.conf.
You are correct, clamscan does not use clamav.conf. Im not sure where clamscan looks for *.cvd files by default, but if its anything like sigtool, it uses a hardcoded path specified at compile time. However specifiying --database=/usr/local/share/clamav should overwrite any default values. So basically i have no idea why it is still looking in /var/spool/qmailscan/tmp/samko.domain.tld24234/clamav-ab54545/VIRUSES.DB. What i was trying to suggest earlier was that you should remove these .DB files wherever they are. This wont prevent clamscan from looking for them, but it WILL prevent clamscan from using them. If the problem still persists after removing these .db files then this was not the actual problem. > > I don't understand why.... I tried check files/mbox as non-privileged > user or root via command line and it worked. And if I run it via > qmail-scanner I'm falling in this odd situation. > > Mon, 03 May 2004 16:59:25 CEST:17541: scanloop: starting scan of > directory "/var/spool/qmailscan/tmp/samko.domain.tld108359636548217541"... > Mon, 03 May 2004 16:59:25 CEST:17541: scanloop: > scanner=clamscan_scanner,plain_text_msg=0 > Mon, 03 May 2004 16:59:25 CEST:17541: clamscan: starting scan of > directory "/var/spool/qmailscan/tmp/samko.domain.tld108359636548217541"... > Mon, 03 May 2004 16:59:25 CEST:17541: run /usr/local/bin/clamscan -r -m > --disable-summary --database=/usr/local/share/clamav/ > /var/spool/qmailscan/tmp/samko.domain.tld108359636548217541 2>&1 > Mon, 03 May 2004 16:59:28 CEST:17541: --output of clamscan was: > LibClamAV Error: readdb(): Malformed pattern line 13771 (file > /var/spool/qmailscan/tmp/samko.domain.tld108359636548217541/clamav > -ab19271867b1b5cf/viruses.db). > LibClamAV Error: Incomplete block read. > LibClamAV Error: cli_cvdload(): Can't unpack CVD file. > ERROR: CVD extraction failure. > -- > Mon, 03 May 2004 16:59:28 CEST:17541: error_condition: > X-Qmail-Scanner-1.22: clamscan: corrupt or unknown ClamAV scanner error > or memory/resource/perms problem - exit status 50 If scanning manually works but you get the above error in your log then you may want to try raising your softlimit value in the qmail-smtpd run script. It may be failing to load the database because of insufficient memory allowed to the process. Jim ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
