-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Rick Macdougall wrote:
| | | Pete Hicks wrote: | |> On Mon, May 02, 2005 at 04:19:53PM -0500, Jeremy Kitchen wrote: |> |>> I'm having lots of customers call up saying their clamd is |>> segfaulting.. installations that have been around for many |>> months (0.80) and all of a sudden, later in the week last |>> week.. everyone's been having problems with clamd segfaulting. |>> Updating to clamav 0.84 seems to have done the trick, but I |>> don't remember seeing any segfault issues on either the -users |>> or -devel lists that had been resolved.... |>> |>> I'm assuming it's some sort of email that is going around right |>> now (either spam or virus) that is causing it to happen, |>> however I cannot pinpoint the actual email :( |>> |> |> |> |> I had this problems as well: |> |> Sun May 1 04:37:56 2005 -> Segmentation fault :-( Bye.. Sun May |> 1 04:39:28 2005 -> Segmentation fault :-( Bye.. Sun May 1 |> 04:42:06 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:43:43 |> 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:45:24 2005 -> |> Segmentation fault :-( Bye.. Sun May 1 04:50:43 2005 -> |> Segmentation fault :-( Bye.. Sun May 1 04:52:16 2005 -> |> Segmentation fault :-( Bye.. Sun May 1 04:53:49 2005 -> |> Segmentation fault :-( Bye.. Sun May 1 04:56:55 2005 -> |> Segmentation fault :-( Bye.. |> |> I addition, this morning my mail server (exim 4.34) started |> refusing mail due to too many open connections. Incoming smtp |> transactions could not get past the data phase. An upgrade to the |> latest clamav fixed the problem. In speaking with another |> sysadmin about this issue, he said that he experienced the same |> problem last friday. |> |> Anybody else experience similar problems? | | | Hi, | | Yup, a time to time client called me in a panic on Friday. Same | problem, once I upgraded clamav for him the problem was solved. | | Regards, | | Rick _______________________________________________ | http://lurker.clamav.net/list/clamav-users.html
Hello Everyone,
~ I wanted to add what I hope will be some insight to this issue. I run Qmail - ClamAV - SpamAssassin - Qmail-Scanner on 3 servers here for the company, and all of them had been experiencing the same issues as mentioned above. It would seem that when clamdscan tried to scan certain messages that it would hang the process and then send it straight into a "Segmentation fault" state. At that point 'Clamav' would start more child processes to address the new scans needed for more mail. At one point I had approx. 1267 clamdscan processes on one of my servers - not good. I was running version 0.80 for the longest time. I then did some more digging and turned on all 'debug' options and what ever else extra logging facilities I could and found something interesting.
~ It would seem that a certain SPAM message that had "Content-Type: ;text/plain;" in the header information would break ClamAV and cause it to "Seg Fault". I decided to try it out by telnet'ing to port 25 on the server and including that line of 'content type' in the message header and sure enough - it killed ClamAV. I then made the decision to upgrade to ClamAV-0.84. What do you know - it worked. Doing the same tests again showed the message being scanned and sent to my INBOX. No more crashes or seg faults. I'm now a happy Admin again. Now I just need to wait for all of the queue'd up mail to finish delivering and we should be good.
~ In any case, that is my experiences from this weekend - so much for seeing "Hitchhikers Guide to The Galaxy"; but duty called. Hope this helps. Keep up the good work everyone, and fight the good fight.
~Martin
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFCdqfqUhCzR6oK+EgRAleHAJ9WBkPL2ZzjWbXAwIk0Hs237zbJKQCfWzRC qeAc9XXvbK0EK7SHq5Z+BG4= =y9ID -----END PGP SIGNATURE-----
_______________________________________________ http://lurker.clamav.net/list/clamav-users.html
