Re: (Update) RE: [Clamav-users] clamav dying & accept() errors in syslog
On Fri, 2005-05-06 at 08:57 -0500, Phillip Salzman wrote: > These are pretty heavily loaded machines. They each handle about 2M > msgs/day, but at the same time they're pretty beefy with lots of > resources (which aren't appearing to be used very much.) > > Would someone have any suggestions on tuning clamav for such a load? I > was using it with clamd and doing clamav-milter --external, but am not > now. Any suggestions would be very much appreciated. I don't know what version of sendmail you are using, but I think someone else suggested it was a problem with 8.12 that wasn't in 8.11 I suggest you try going back to using --external and clamd. -trog signature.asc Description: This is a digitally signed message part ___ http://lurker.clamav.net/list/clamav-users.html
(Update) RE: [Clamav-users] clamav dying & accept() errors in syslog
> -Original Message- > From: [EMAIL PROTECTED] [mailto:clamav-users- > [EMAIL PROTECTED] On Behalf Of Phillip Salzman > Sent: Wednesday, May 04, 2005 11:03 AM > To: ClamAV users ML > Subject: RE: [Clamav-users] clamav dying & accept() errors in syslog > > It could be, but the -STABLE we're running is from over a year after the > "fix." > > Thanks, > > Phillip Salzman > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Trog > Sent: Wednesday, May 04, 2005 10:57 AM > To: ClamAV users ML > Subject: Re: [Clamav-users] clamav dying & accept() errors in syslog > > On Wed, 2005-05-04 at 16:48 +0100, Nigel Horne wrote: > > On Wednesday 04 May 2005 16:40, Phillip Salzman wrote: > > > > > > -- > > > May 4 13:39:03 lora clamav-milter: ClamAv: accept() returned > invalid > > > socket (Result too large), try again > > > May 4 13:39:28 lora last message repeated 9 times > > > -- > > > > > > I'm currently using clamav 0.84e on FreeBSD 4.9-stable. They are on > > > Dell hardware. > > > > > I believe that's a FreeBSB bug: > > http://www.rhyolite.com/pipermail/dcc/2003/001409.html > > -trog Just as an update incase anyone else is having issues, I've upgraded the machines that were failing to FreeBSD 5.4-STABLE (via installing 5.4-rc4 and rebuilt the source tree from CVS (yesterday's source tree).) The errors are still in place, and the newer machine that I brought up which was originally working, is also having the problem now. = May 6 13:29:23 jor-l clamav-milter: ClamAv: accept() returned invalid = socket (Result too large), try again The other machine that was originally fine is also getting the above message, in addition to a sig11. So far the sig11 has not appeared on the jor-l machine (but it was before the 5.4-S upgrade.) = May 6 13:44:07 zod kernel: pid 93239 (clamav-milter), uid 106: exited on = signal 11 These are pretty heavily loaded machines. They each handle about 2M msgs/day, but at the same time they're pretty beefy with lots of resources (which aren't appearing to be used very much.) Would someone have any suggestions on tuning clamav for such a load? I was using it with clamd and doing clamav-milter --external, but am not now. Any suggestions would be very much appreciated. In order to survive (and not every customer calling) I had to set a 10s timeout for the milter to talk to the socket. This sadly means we're missing viruses, but it allows the SMTP server to keep responding... Thanks for anything that anyone can provide, Phillip Salzman ___ http://lurker.clamav.net/list/clamav-users.html
RE: [Clamav-users] clamav dying & accept() errors in syslog
should I note that I just realized this is happening every 5 minutes (give or take a few seconds) ? May 4 15:35:00 lora clamav-milter: ClamAv: accept() returned invalid socket (Result too large), try again May 4 15:39:51 lora clamav-milter: ClamAv: accept() returned invalid socket (Result too large), try again May 4 15:54:39 lora clamav-milter: ClamAv: accept() returned invalid socket (Result too large), try again May 4 15:59:35 lora clamav-milter: ClamAv: accept() returned invalid socket (Result too large), try again May 4 16:04:01 lora clamav-milter: ClamAv: accept() returned invalid socket (Result too large), try again May 4 16:04:20 lora clamav-milter: ClamAv: accept() returned invalid socket (Result too large), try again May 4 16:04:57 lora clamav-milter: ClamAv: accept() returned invalid socket (Result too large), try again May 4 16:09:55 lora clamav-milter: ClamAv: accept() returned invalid socket (Result too large), try again May 4 16:14:01 lora clamav-milter: ClamAv: accept() returned invalid socket (Result too large), try again May 4 16:19:37 lora clamav-milter: ClamAv: accept() returned invalid socket (Result too large), try again -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Phillip Salzman Sent: Wednesday, May 04, 2005 11:03 AM To: ClamAV users ML Subject: RE: [Clamav-users] clamav dying & accept() errors in syslog It could be, but the -STABLE we're running is from over a year after the "fix." Thanks, Phillip Salzman -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Trog Sent: Wednesday, May 04, 2005 10:57 AM To: ClamAV users ML Subject: Re: [Clamav-users] clamav dying & accept() errors in syslog On Wed, 2005-05-04 at 16:48 +0100, Nigel Horne wrote: > On Wednesday 04 May 2005 16:40, Phillip Salzman wrote: > > > > -- > > May 4 13:39:03 lora clamav-milter: ClamAv: accept() returned invalid > > socket (Result too large), try again > > May 4 13:39:28 lora last message repeated 9 times > > -- > > > > I'm currently using clamav 0.84e on FreeBSD 4.9-stable. They are on > > Dell hardware. > > I believe that's a FreeBSB bug: http://www.rhyolite.com/pipermail/dcc/2003/001409.html -trog ___ http://lurker.clamav.net/list/clamav-users.html ___ http://lurker.clamav.net/list/clamav-users.html
RE: [Clamav-users] clamav dying & accept() errors in syslog
It could be, but the -STABLE we're running is from over a year after the "fix." Thanks, Phillip Salzman -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Trog Sent: Wednesday, May 04, 2005 10:57 AM To: ClamAV users ML Subject: Re: [Clamav-users] clamav dying & accept() errors in syslog On Wed, 2005-05-04 at 16:48 +0100, Nigel Horne wrote: > On Wednesday 04 May 2005 16:40, Phillip Salzman wrote: > > > > -- > > May 4 13:39:03 lora clamav-milter: ClamAv: accept() returned invalid > > socket (Result too large), try again > > May 4 13:39:28 lora last message repeated 9 times > > -- > > > > I'm currently using clamav 0.84e on FreeBSD 4.9-stable. They are on > > Dell hardware. > > I believe that's a FreeBSB bug: http://www.rhyolite.com/pipermail/dcc/2003/001409.html -trog ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamav dying & accept() errors in syslog
On Wed, 2005-05-04 at 16:48 +0100, Nigel Horne wrote: > On Wednesday 04 May 2005 16:40, Phillip Salzman wrote: > > > > -- > > May 4 13:39:03 lora clamav-milter: ClamAv: accept() returned invalid > > socket (Result too large), try again > > May 4 13:39:28 lora last message repeated 9 times > > -- > > > > I'm currently using clamav 0.84e on FreeBSD 4.9-stable. They are on > > Dell hardware. > > I believe that's a FreeBSB bug: http://www.rhyolite.com/pipermail/dcc/2003/001409.html -trog signature.asc Description: This is a digitally signed message part ___ http://lurker.clamav.net/list/clamav-users.html
RE: [Clamav-users] clamav dying & accept() errors in syslog
Nigel, I didn't see a response other than your first on IRC, my client was maybe messing up too or lag? Apologizes, again... Anyway - I'm currently using Sendmail 8.12.11. The flags to clamav-milter are: --dont-scan-on-error --external --postmaster-only --local --outgoing --max-children=5 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nigel Horne Sent: Wednesday, May 04, 2005 10:49 AM To: ClamAV users ML Subject: Re: [Clamav-users] clamav dying & accept() errors in syslog On Wednesday 04 May 2005 16:40, Phillip Salzman wrote: > Hello, > > I just put clamav (and clamav-milter) into production on two fairly > large Sendmail servers. Before doing this, I tested it on a box and > didn't have any problems. > > It seems that I'm having a couple possibly unrelated issues. First of > all, I have seen several clamav-milter processes eating up as much CPU > as possibly and not finishing. Secondly, I've found these errors in > /var/log/messages: > > -- > May 4 13:39:03 lora clamav-milter: ClamAv: accept() returned invalid > socket (Result too large), try again > May 4 13:39:28 lora last message repeated 9 times > -- > > I'm currently using clamav 0.84e on FreeBSD 4.9-stable. They are on > Dell hardware. > > Does anyone know where I should look? I haven't found anything about > this and have come up with very few hits in Google. As I said on #clamav, I only have access to FreeBSD5 so I can't reproduce the problem. What are your startup arguments to clamav-milter? The accept() call is from within the libmilter library, not clamav-milter, what version of sendmail do you have? > Thanks, > > Phillip Salzman -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-users.html ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamav dying & accept() errors in syslog
On Wednesday 04 May 2005 16:40, Phillip Salzman wrote: > Hello, > > I just put clamav (and clamav-milter) into production on two fairly > large Sendmail servers. Before doing this, I tested it on a box and > didn't have any problems. > > It seems that I'm having a couple possibly unrelated issues. First of > all, I have seen several clamav-milter processes eating up as much CPU > as possibly and not finishing. Secondly, I've found these errors in > /var/log/messages: > > -- > May 4 13:39:03 lora clamav-milter: ClamAv: accept() returned invalid > socket (Result too large), try again > May 4 13:39:28 lora last message repeated 9 times > -- > > I'm currently using clamav 0.84e on FreeBSD 4.9-stable. They are on > Dell hardware. > > Does anyone know where I should look? I haven't found anything about > this and have come up with very few hits in Google. As I said on #clamav, I only have access to FreeBSD5 so I can't reproduce the problem. What are your startup arguments to clamav-milter? The accept() call is from within the libmilter library, not clamav-milter, what version of sendmail do you have? > Thanks, > > Phillip Salzman -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-users.html
[Clamav-users] clamav dying & accept() errors in syslog
Hello, I just put clamav (and clamav-milter) into production on two fairly large Sendmail servers. Before doing this, I tested it on a box and didn't have any problems. It seems that I'm having a couple possibly unrelated issues. First of all, I have seen several clamav-milter processes eating up as much CPU as possibly and not finishing. Secondly, I've found these errors in /var/log/messages: -- May 4 13:39:03 lora clamav-milter: ClamAv: accept() returned invalid socket (Result too large), try again May 4 13:39:28 lora last message repeated 9 times -- I'm currently using clamav 0.84e on FreeBSD 4.9-stable. They are on Dell hardware. Does anyone know where I should look? I haven't found anything about this and have come up with very few hits in Google. Thanks, Phillip Salzman ___ http://lurker.clamav.net/list/clamav-users.html
