Hi Steve, Thank you very much for your help.
I found the problem, it ended up being a typo in a script, run from cron, just like you said! Thanks, Rich -----Original Message----- From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users-boun...@lists.clamav.net] On Behalf Of Steven Morgan Sent: 20 May 2014 18:15 To: ClamAV users ML Subject: Re: [clamav-users] clamav-0.98.1 crashing I do not see anything wrong in that output. Anyway, clamd does not restart by itself. There was a user who reported something similar a few weeks ago and it turned out to be his crond setup: https://bugzilla.clamav.net/show_bug.cgi?id=10952 If that is of no help, we need more info in order to debug. I usually chase clamd bugs by setting "Forground yes" in clamd.conf and use gdb. Also "Debug yes" in clamd.conf may provide additional clues. Steve On Tue, May 20, 2014 at 12:29 PM, Richard Mealing <rich...@fastnet.co.uk>wrote: > Thank you Steve, > > I'm not sure if there is a problem but I would like to know why I see > my clamd stops then starts every 10 minutes. > > During this period, I see the following debug output and I wondering > what this means - > > fds_poll_recv: timeout after 600 seconds > > I thought it was something to do with the setting 'SelfCheck' but I > changed this to 3600 and I still see the program restart every 10 minutes. > > Debug output - > > Tue May 20 14:59:55 2014 -> Received POLLIN|POLLHUP on fd 4 Tue May 20 > 14:59:55 2014 -> Got new connection, FD 9 Tue May 20 14:59:55 2014 -> > Received POLLIN|POLLHUP on fd 5 Tue May 20 14:59:55 2014 -> > fds_poll_recv: timeout after 7 seconds Tue May 20 14:59:55 2014 -> > Received POLLIN|POLLHUP on fd 9 Tue May 20 14:59:55 2014 -> got > command PING (4, 6), argument: > Tue May 20 14:59:55 2014 -> Receive thread: closing conn (FD 9), group > finished Tue May 20 14:59:55 2014 -> Consumed entire command Tue May > 20 14:59:55 2014 -> Number of file descriptors polled: 1 fds Tue May > 20 14:59:55 2014 -> fds_poll_recv: timeout after 600 seconds Tue May > 20 14:59:55 2014 -> Received POLLIN|POLLHUP on fd 4 Tue May 20 > 14:59:55 2014 -> Got new connection, FD 9 Tue May 20 14:59:55 2014 -> > Received POLLIN|POLLHUP on fd 5 Tue May 20 14:59:55 2014 -> > fds_poll_recv: timeout after 7 seconds Tue May 20 14:59:55 2014 -> > Received POLLIN|POLLHUP on fd 9 Tue May 20 14:59:55 2014 -> got > command MULTISCAN /tmpfs/82078 (22, 10), > argument: /tmpfs/82078 > Tue May 20 14:59:55 2014 -> mode -> MODE_WAITREPLY Tue May 20 14:59:55 > 2014 -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:55 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:55 2014 -> Breaking command loop, mode > is no longer MODE_COMMAND Tue May 20 14:59:55 2014 -> Consumed entire > command Tue May 20 14:59:55 2014 -> Number of file descriptors polled: > 1 fds Tue May 20 14:59:55 2014 -> fds_poll_recv: timeout after 600 > seconds Tue May 20 14:59:55 2014 -> THRMGR: new group: 0x81941e5b0 Tue > May 20 14:59:55 2014 -> THRMGR: active jobs for 0x81941e5b0: 2 Tue May > 20 14:59:55 2014 -> THRMGR: active jobs for 0x81941e5b0: 3 Tue May 20 > 14:59:55 2014 -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:55 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:55 2014 -> THRMGR: queue (single) > crossed low threshold > -> signaling > Tue May 20 14:59:55 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:55 2014 -> THRMGR: active jobs for > 0x81941e5b0: 4 Tue May 20 14:59:55 2014 -> THRMGR: active jobs for > 0x81941e5b0: 5 Tue May 20 14:59:55 2014 -> THRMGR: queue (single) > crossed low threshold > -> signaling > Tue May 20 14:59:55 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:55 2014 -> THRMGR: queue (single) > crossed low threshold > -> signaling > Tue May 20 14:59:55 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:55 2014 -> Finished scanthread Tue May > 20 14:59:55 2014 -> THRMGR: group_finished: 0x81941e5b0, 5 Tue May 20 > 14:59:55 2014 -> THRMGR: active jobs for 0x81941e5b0: 4 Tue May 20 > 14:59:55 2014 -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:55 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:55 2014 -> Finished scanthread Tue May > 20 14:59:55 2014 -> THRMGR: group_finished: 0x81941e5b0, 4 Tue May 20 > 14:59:55 2014 -> THRMGR: active jobs for 0x81941e5b0: 3 Tue May 20 > 14:59:55 2014 -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:55 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:55 2014 -> > /tmpfs/82078/s4KDxmlg001866.message: > Sanesecurity.Jurlbl.7983.UNOFFICIAL FOUND Tue May 20 14:59:55 2014 -> > Finished scanthread Tue May 20 14:59:55 2014 -> THRMGR: > group_finished: 0x81941e5b0, 3 Tue May 20 14:59:55 2014 -> THRMGR: > active jobs for 0x81941e5b0: 2 Tue May 20 14:59:55 2014 -> THRMGR: > queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:55 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:55 2014 -> > /tmpfs/82078/s4KDxmlg001866.header: > Sanesecurity.Junk.40915.UNOFFICIAL FOUND Tue May 20 14:59:55 2014 -> > Finished scanthread Tue May 20 14:59:55 2014 -> THRMGR: > group_finished: 0x81941e5b0, 2 Tue May 20 14:59:55 2014 -> THRMGR: > active jobs for 0x81941e5b0: 1 Tue May 20 14:59:55 2014 -> THRMGR: > queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:55 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:55 2014 -> THRMGR: group finished > freeing 0x81941e5b0 Tue May 20 14:59:55 2014 -> Finished scanthread > Tue May 20 14:59:55 2014 -> Scanthread: connection shut down (FD 9) > Tue May 20 14:59:55 2014 -> THRMGR: queue (single) crossed low > threshold > -> signaling > Tue May 20 14:59:55 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:56 2014 -> Received POLLIN|POLLHUP on fd > 4 Tue May 20 14:59:56 2014 -> Got new connection, FD 9 Tue May 20 > 14:59:56 2014 -> Received POLLIN|POLLHUP on fd 5 Tue May 20 14:59:56 > 2014 -> fds_poll_recv: timeout after 7 seconds Tue May 20 14:59:56 > 2014 -> Received POLLIN|POLLHUP on fd 9 Tue May 20 14:59:56 2014 -> > got command PING (4, 6), argument: > Tue May 20 14:59:56 2014 -> Receive thread: closing conn (FD 9), group > finished Tue May 20 14:59:56 2014 -> Consumed entire command Tue May > 20 14:59:56 2014 -> Number of file descriptors polled: 1 fds Tue May > 20 14:59:56 2014 -> fds_poll_recv: timeout after 600 seconds Tue May > 20 14:59:56 2014 -> Received POLLIN|POLLHUP on fd 4 Tue May 20 > 14:59:56 2014 -> Got new connection, FD 9 Tue May 20 14:59:56 2014 -> > Received POLLIN|POLLHUP on fd 5 Tue May 20 14:59:56 2014 -> > fds_poll_recv: timeout after 7 seconds Tue May 20 14:59:56 2014 -> > Received POLLIN|POLLHUP on fd 9 Tue May 20 14:59:56 2014 -> got > command MULTISCAN /tmpfs/76394 (22, 10), > argument: /tmpfs/76394 > Tue May 20 14:59:56 2014 -> mode -> MODE_WAITREPLY Tue May 20 14:59:56 > 2014 -> Breaking command loop, mode is no longer MODE_COMMAND Tue May > 20 14:59:56 2014 -> Consumed entire command Tue May 20 14:59:56 2014 > -> Number of file descriptors polled: 1 fds Tue May 20 14:59:56 2014 > -> fds_poll_recv: timeout after 600 seconds Tue May 20 14:59:56 2014 > -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:56 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:56 2014 -> THRMGR: new group: > 0x8164c07c0 Tue May 20 14:59:56 2014 -> THRMGR: active jobs for > 0x8164c07c0: 2 Tue May 20 14:59:56 2014 -> THRMGR: active jobs for > 0x8164c07c0: 3 Tue May 20 14:59:56 2014 -> THRMGR: queue (single) > crossed low threshold > -> signaling > Tue May 20 14:59:56 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:56 2014 -> THRMGR: queue (single) > crossed low threshold > -> signaling > Tue May 20 14:59:56 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:56 2014 -> THRMGR: active jobs for > 0x8164c07c0: 4 Tue May 20 14:59:56 2014 -> THRMGR: active jobs for > 0x8164c07c0: 5 Tue May 20 14:59:56 2014 -> THRMGR: queue (single) > crossed low threshold > -> signaling > Tue May 20 14:59:56 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:56 2014 -> THRMGR: queue (single) > crossed low threshold > -> signaling > Tue May 20 14:59:56 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:56 2014 -> Finished scanthread Tue May > 20 14:59:56 2014 -> THRMGR: group_finished: 0x8164c07c0, 5 Tue May 20 > 14:59:56 2014 -> THRMGR: active jobs for 0x8164c07c0: 4 Tue May 20 > 14:59:56 2014 -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:56 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:56 2014 -> Finished scanthread Tue May > 20 14:59:56 2014 -> THRMGR: group_finished: 0x8164c07c0, 4 Tue May 20 > 14:59:56 2014 -> THRMGR: active jobs for 0x8164c07c0: 3 Tue May 20 > 14:59:56 2014 -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:56 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:56 2014 -> Finished scanthread Tue May > 20 14:59:56 2014 -> THRMGR: group_finished: 0x8164c07c0, 3 Tue May 20 > 14:59:56 2014 -> THRMGR: active jobs for 0x8164c07c0: 2 Tue May 20 > 14:59:56 2014 -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:56 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:56 2014 -> Finished scanthread Tue May > 20 14:59:56 2014 -> THRMGR: group_finished: 0x8164c07c0, 2 Tue May 20 > 14:59:56 2014 -> THRMGR: active jobs for 0x8164c07c0: 1 Tue May 20 > 14:59:56 2014 -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:56 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:56 2014 -> THRMGR: group finished > freeing 0x8164c07c0 Tue May 20 14:59:56 2014 -> Finished scanthread > Tue May 20 14:59:56 2014 -> Scanthread: connection shut down (FD 9) > Tue May 20 14:59:56 2014 -> THRMGR: queue (single) crossed low > threshold > -> signaling > Tue May 20 14:59:56 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:59 2014 -> Received POLLIN|POLLHUP on fd > 4 Tue May 20 14:59:59 2014 -> Got new connection, FD 9 Tue May 20 > 14:59:59 2014 -> Received POLLIN|POLLHUP on fd 5 Tue May 20 14:59:59 > 2014 -> fds_poll_recv: timeout after 7 seconds Tue May 20 14:59:59 > 2014 -> Received POLLIN|POLLHUP on fd 9 Tue May 20 14:59:59 2014 -> > got command PING (4, 6), argument: > Tue May 20 14:59:59 2014 -> Receive thread: closing conn (FD 9), group > finished Tue May 20 14:59:59 2014 -> Consumed entire command Tue May > 20 14:59:59 2014 -> Number of file descriptors polled: 1 fds Tue May > 20 14:59:59 2014 -> fds_poll_recv: timeout after 600 seconds Tue May > 20 14:59:59 2014 -> Received POLLIN|POLLHUP on fd 4 Tue May 20 > 14:59:59 2014 -> Got new connection, FD 9 Tue May 20 14:59:59 2014 -> > Received POLLIN|POLLHUP on fd 5 Tue May 20 14:59:59 2014 -> > fds_poll_recv: timeout after 7 seconds Tue May 20 14:59:59 2014 -> > Received POLLIN|POLLHUP on fd 9 Tue May 20 14:59:59 2014 -> got > command MULTISCAN /tmpfs/83306 (22, 10), > argument: /tmpfs/83306 > Tue May 20 14:59:59 2014 -> mode -> MODE_WAITREPLY Tue May 20 14:59:59 > 2014 -> Breaking command loop, mode is no longer MODE_COMMAND Tue May > 20 14:59:59 2014 -> Consumed entire command Tue May 20 14:59:59 2014 > -> Number of file descriptors polled: 1 fds Tue May 20 14:59:59 2014 > -> fds_poll_recv: timeout after 600 seconds Tue May 20 14:59:59 2014 > -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:59 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:59 2014 -> THRMGR: new group: > 0x8163b3a60 Tue May 20 14:59:59 2014 -> THRMGR: active jobs for > 0x8163b3a60: 2 Tue May 20 14:59:59 2014 -> THRMGR: active jobs for > 0x8163b3a60: 3 Tue May 20 14:59:59 2014 -> THRMGR: queue (single) > crossed low threshold > -> signaling > Tue May 20 14:59:59 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:59 2014 -> THRMGR: queue (single) > crossed low threshold > -> signaling > Tue May 20 14:59:59 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:59 2014 -> THRMGR: active jobs for > 0x8163b3a60: 4 Tue May 20 14:59:59 2014 -> THRMGR: active jobs for > 0x8163b3a60: 5 Tue May 20 14:59:59 2014 -> THRMGR: queue (single) > crossed low threshold > -> signaling > Tue May 20 14:59:59 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:59 2014 -> THRMGR: queue (single) > crossed low threshold > -> signaling > Tue May 20 14:59:59 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:59 2014 -> Finished scanthread Tue May > 20 14:59:59 2014 -> THRMGR: group_finished: 0x8163b3a60, 5 Tue May 20 > 14:59:59 2014 -> THRMGR: active jobs for 0x8163b3a60: 4 Tue May 20 > 14:59:59 2014 -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:59 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:59 2014 -> Finished scanthread Tue May > 20 14:59:59 2014 -> THRMGR: group_finished: 0x8163b3a60, 4 Tue May 20 > 14:59:59 2014 -> THRMGR: active jobs for 0x8163b3a60: 3 Tue May 20 > 14:59:59 2014 -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:59 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:59 2014 -> Finished scanthread Tue May > 20 14:59:59 2014 -> THRMGR: group_finished: 0x8163b3a60, 3 Tue May 20 > 14:59:59 2014 -> THRMGR: active jobs for 0x8163b3a60: 2 Tue May 20 > 14:59:59 2014 -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:59 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:59 2014 -> Finished scanthread Tue May > 20 14:59:59 2014 -> THRMGR: group_finished: 0x8163b3a60, 2 Tue May 20 > 14:59:59 2014 -> THRMGR: active jobs for 0x8163b3a60: 1 Tue May 20 > 14:59:59 2014 -> THRMGR: queue (single) crossed low threshold > -> signaling > Tue May 20 14:59:59 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling Tue May 20 14:59:59 2014 -> THRMGR: group finished > freeing 0x8163b3a60 Tue May 20 14:59:59 2014 -> Finished scanthread > Tue May 20 14:59:59 2014 -> Scanthread: connection shut down (FD 9) > Tue May 20 14:59:59 2014 -> THRMGR: queue (single) crossed low > threshold > -> signaling > Tue May 20 14:59:59 2014 -> THRMGR: queue (bulk) crossed low threshold > -> signaling > > Thanks, > Rich > > > -----Original Message----- > From: clamav-users-boun...@lists.clamav.net [mailto: > clamav-users-boun...@lists.clamav.net] On Behalf Of Steven Morgan > Sent: 20 May 2014 16:39 > To: ClamAV users ML > Subject: Re: [clamav-users] clamav-0.98.1 crashing > > Hi Rich, > > Any details will help for starters, such as a stack trace of the > crash, clamav version, OS version, processor architecture, clamav debug logs, > etc. > > Also, you could try the 0.98.4 release candidate, which is a bug fix > release. It is here: > > http://sourceforge.net/projects/clamav/files/RC/clamav-0.98.4-rc1/ > > If you find that it is a clamav problem, open a bugzilla ticket here: > > https://bugzilla.clamav.net/ > > Thanks, > Steve > > > > On Tue, May 20, 2014 at 6:31 AM, Richard Mealing > <rich...@fastnet.co.uk > >wrote: > > > Hi, > > > > I'm using clamd with mailscanner and it keeps crashing. What is the > > best way to debug this? > > > > > > Thanks, > > Rich > > _______________________________________________ > > Help us build a comprehensive ClamAV guide: > > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/support/ml > > > _______________________________________________ > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > http://www.clamav.net/support/ml > _______________________________________________ > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > http://www.clamav.net/support/ml > _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/support/ml _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/support/ml
