Hanno Hecker escribió:
Maybe it's related to this:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471643
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=467298
(or any other freshclam locking db dir related bugs)
Our clamd just shut down tonight, after the restart all was fine. Maybe
it's ok, because we use the svn version.
Hanno
Thanks for the pointer, but I don't think it's the problem.
Clamav log has no errors for the day that those clients started.
If it was clamd / freshclam, it would be those processes consuming the
CPU, and in this case it was qpsmtpd processes consuming the CPU time.
It looks like a plugin trying to do output in a loop. Due to the
"binary" look of the writes (the part of the clamav protocol that
clamdscan uses is plain text), I would attribute it to the TLS plugin,
but looking at code, I don't see any place that this plugin would behave
that way in any circumstance.
Come to think of it... we are using Log4Perl with Log::Dispatch::Syslog,
that in turn uses Sys::Syslog. Do you know if Sys::Syslog retries any
operation forever? (thinking that the writes look binary, I don't know
if this would be attributable to the sys::syslog).
I will be monitoring the servers to see if this issue happens again (has
happened to two connections in two or three months...). The next time
(If there is a next time, I'll try to study them better before killing
them).
Jose Luis Martinez
[EMAIL PROTECTED]
