On 2024-04-25 13:38:51 [+0200], Michael Braun wrote: > Hi, Hi,
> I'm scanning incoming mails using clamav-daemon and clamav-milter. > From time to time, my mailserver stops working due to clamav-daemon locking > up. > > The clamav logs read: > > 6889 Apr 25 11:28:12 gate clamd[939931]: Thu Apr 25 11:28:11 2024 -> > !accept() failed: Too many open files > 1 Apr 25 11:32:11 gate systemd-journald[311]: Suppressed 490085 > messages from clamav-daemon.service > > (with many repetitions) > > 1 Apr 25 11:33:41 gate clamd[939931]: LibClamAV Error: > cl_engine_addref: engine == NULL > 1 Apr 25 11:33:41 gate clamd[939931]: Thu Apr 25 11:33:41 2024 -> > !cl_engine_addref() failed > 1 Apr 25 11:33:41 gate clamd[939931]: Thu Apr 25 11:33:41 2024 -> > !Command dispatch failed > > (with many repetitions) > > Workaround: systemctl restart clamav-daemon fixes the problem temporarely. My guess is that _something_ within clamd forgets to close a fd and then you hit the limit followed by the fallout later on. 0.103.10 isn't the latest version, it is 0.103.11 but judging from the changelog there isn't anything that changed. Now. You could look at /proc/$CLAMD_PID/fd/ and check what kind of fd is raising. I have here 10 fds in total, your limit should be at 1024 so you have an idea how danlging fd you should. That 10 depends on your setup in terms of IP listeners and/ or IP. On average it should remain constant except if it creates temporary files during scans or opens sockets for clients. The files are visible in /proc, sockets have just an inode number but `ss' will show you more details here. Once you identified those then I could start looking closer in the source once I know where to look. The other alternative you have is to update to Bookworm hoping that bug is gone. Sebastian
