Re: [Clamav-users] clamd segfaulting as of about thursday
On Mon, May 02, 2005 at 04:19:53PM -0500, Jeremy Kitchen wrote: >I'm having lots of customers call up saying their clamd is segfaulting.. >installations that have been around for many months (0.80) and all of a >sudden, later in the week last week.. everyone's been having problems with >clamd segfaulting. Updating to clamav 0.84 seems to have done the trick, but >I don't remember seeing any segfault issues on either the -users or -devel >lists that had been resolved > >I'm assuming it's some sort of email that is going around right now (either >spam or virus) that is causing it to happen, however I cannot pinpoint the >actual email :( > I had this problems as well: Sun May 1 04:37:56 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:39:28 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:42:06 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:43:43 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:45:24 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:50:43 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:52:16 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:53:49 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:56:55 2005 -> Segmentation fault :-( Bye.. I addition, this morning my mail server (exim 4.34) started refusing mail due to too many open connections. Incoming smtp transactions could not get past the data phase. An upgrade to the latest clamav fixed the problem. In speaking with another sysadmin about this issue, he said that he experienced the same problem last friday. Anybody else experience similar problems? ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
Pete Hicks wrote: On Mon, May 02, 2005 at 04:19:53PM -0500, Jeremy Kitchen wrote: I'm having lots of customers call up saying their clamd is segfaulting.. installations that have been around for many months (0.80) and all of a sudden, later in the week last week.. everyone's been having problems with clamd segfaulting. Updating to clamav 0.84 seems to have done the trick, but I don't remember seeing any segfault issues on either the -users or -devel lists that had been resolved I'm assuming it's some sort of email that is going around right now (either spam or virus) that is causing it to happen, however I cannot pinpoint the actual email :( I had this problems as well: Sun May 1 04:37:56 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:39:28 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:42:06 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:43:43 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:45:24 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:50:43 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:52:16 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:53:49 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:56:55 2005 -> Segmentation fault :-( Bye.. I addition, this morning my mail server (exim 4.34) started refusing mail due to too many open connections. Incoming smtp transactions could not get past the data phase. An upgrade to the latest clamav fixed the problem. In speaking with another sysadmin about this issue, he said that he experienced the same problem last friday. Anybody else experience similar problems? Hi, Yup, a time to time client called me in a panic on Friday. Same problem, once I upgraded clamav for him the problem was solved. Regards, Rick ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
Upgrading didn't seem to help me, though maybe it slowed down the crash rate - I just had another crash about an hour ago. I'm getting slammed at postmaster each time it crashes. This was in the logs from the latest crash: May 2 14:22:24 smtp clamav-milter[153]: ClamAv: setsockopt() failed (Invalid argument) Nothing leading up to it and nothing immediately after it out of the ordinary, other than a 5 minute break before the crash where nothing got logged (mildly unusual, but not completely unprecedented). ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rick Macdougall wrote: | | | Pete Hicks wrote: | |> On Mon, May 02, 2005 at 04:19:53PM -0500, Jeremy Kitchen wrote: |> |>> I'm having lots of customers call up saying their clamd is |>> segfaulting.. installations that have been around for many |>> months (0.80) and all of a sudden, later in the week last |>> week.. everyone's been having problems with clamd segfaulting. |>> Updating to clamav 0.84 seems to have done the trick, but I |>> don't remember seeing any segfault issues on either the -users |>> or -devel lists that had been resolved |>> |>> I'm assuming it's some sort of email that is going around right |>> now (either spam or virus) that is causing it to happen, |>> however I cannot pinpoint the actual email :( |>> |> |> |> |> I had this problems as well: |> |> Sun May 1 04:37:56 2005 -> Segmentation fault :-( Bye.. Sun May |> 1 04:39:28 2005 -> Segmentation fault :-( Bye.. Sun May 1 |> 04:42:06 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:43:43 |> 2005 -> Segmentation fault :-( Bye.. Sun May 1 04:45:24 2005 -> |> Segmentation fault :-( Bye.. Sun May 1 04:50:43 2005 -> |> Segmentation fault :-( Bye.. Sun May 1 04:52:16 2005 -> |> Segmentation fault :-( Bye.. Sun May 1 04:53:49 2005 -> |> Segmentation fault :-( Bye.. Sun May 1 04:56:55 2005 -> |> Segmentation fault :-( Bye.. |> |> I addition, this morning my mail server (exim 4.34) started |> refusing mail due to too many open connections. Incoming smtp |> transactions could not get past the data phase. An upgrade to the |> latest clamav fixed the problem. In speaking with another |> sysadmin about this issue, he said that he experienced the same |> problem last friday. |> |> Anybody else experience similar problems? | | | Hi, | | Yup, a time to time client called me in a panic on Friday. Same | problem, once I upgraded clamav for him the problem was solved. | | Regards, | | Rick ___ | http://lurker.clamav.net/list/clamav-users.html Hello Everyone, ~I wanted to add what I hope will be some insight to this issue. I run Qmail - ClamAV - SpamAssassin - Qmail-Scanner on 3 servers here for the company, and all of them had been experiencing the same issues as mentioned above. It would seem that when clamdscan tried to scan certain messages that it would hang the process and then send it straight into a "Segmentation fault" state. At that point 'Clamav' would start more child processes to address the new scans needed for more mail. At one point I had approx. 1267 clamdscan processes on one of my servers - not good. I was running version 0.80 for the longest time. I then did some more digging and turned on all 'debug' options and what ever else extra logging facilities I could and found something interesting. ~It would seem that a certain SPAM message that had "Content-Type: ;text/plain;" in the header information would break ClamAV and cause it to "Seg Fault". I decided to try it out by telnet'ing to port 25 on the server and including that line of 'content type' in the message header and sure enough - it killed ClamAV. I then made the decision to upgrade to ClamAV-0.84. What do you know - it worked. Doing the same tests again showed the message being scanned and sent to my INBOX. No more crashes or seg faults. I'm now a happy Admin again. Now I just need to wait for all of the queue'd up mail to finish delivering and we should be good. ~In any case, that is my experiences from this weekend - so much for seeing "Hitchhikers Guide to The Galaxy"; but duty called. Hope this helps. Keep up the good work everyone, and fight the good fight. ~Martin -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.1 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFCdqfqUhCzR6oK+EgRAleHAJ9WBkPL2ZzjWbXAwIk0Hs237zbJKQCfWzRC qeAc9XXvbK0EK7SHq5Z+BG4= =y9ID -END PGP SIGNATURE- ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
On Monday 02 May 2005 23:08, Pete 'Wolfy' Hanson wrote: > Upgrading didn't seem to help me, though maybe it slowed down the > crash rate - I just had another crash about an hour ago. I'm getting > slammed at postmaster each time it crashes. This was in the logs from > the latest crash: > > May 2 14:22:24 smtp clamav-milter[153]: ClamAv: setsockopt() failed > (Invalid argument) > > Nothing leading up to it and nothing immediately after it out of the > ordinary, other than a 5 minute break before the crash where nothing > got logged (mildly unusual, but not completely unprecedented). If that message appears, clamav-milter will fail to start, so it's not surprising nothing was logged... Review if you need the "-B" flag, and if not then don't use it. If you do use the -B flag and this message appears, then check the NIC you are telling it to use is correct. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
On Mon, 2005-05-02 at 16:19 -0500, Jeremy Kitchen wrote: > I'm having lots of customers call up saying their clamd is segfaulting.. > installations that have been around for many months (0.80) and all of a > sudden, later in the week last week.. everyone's been having problems with > clamd segfaulting. Updating to clamav 0.84 seems to have done the trick, but > I don't remember seeing any segfault issues on either the -users or -devel > lists that had been resolved > > I'm assuming it's some sort of email that is going around right now (either > spam or virus) that is causing it to happen, however I cannot pinpoint the > actual email :( > > Was there a bug that might be causing this that was fixed since 0.80 was > released? Several. We don't release software updates for our own amusement. A responsible system admin should always look to upgrade to the current stable version as soon as possible after it is released. People who say that their policy doesn't allow it are just making excuses. Write a new policy. Explain to your boss that he is increasing the risk of infection by having an outdated policy, and then write the same to his boss. Set up a test system appropriate for your environment to perform assurance testing. Apart from missing potential crash fixes, you are also missing detection of some viruses by not upgrading: W32.Magistr.A and B W32.Parite.A B C and D some JPEG exploits some email Worms that use non-standard encoding schemes to by-pass filters -trog signature.asc Description: This is a digitally signed message part ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
Trog wrote: Several. We don't release software updates for our own amusement. A responsible system admin should always look to upgrade to the current stable version as soon as possible after it is released. The responsible admin will evaluate the pros and cons of _any_ software release and choose what is best for his/her environment. The difficultly with any project in development, including ClamAV, is that "current" and "stable" do not always coincide. Clam v0.80 has been the most stable version to this point, and I, preferring stability over functionality, am running 0.80. If running a stable clamav means letting a few viruses through, then so be it. Now that we have reports of spam crashing v0.80, it is time for me to test v0.84. -Mike ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
On Tue, 2005-05-03 at 08:23 -0400, Mike Lambert wrote: > The responsible admin will evaluate the pros and cons of _any_ software > release and choose what is best for his/her environment. The difficultly > with any project in development, including ClamAV, is that "current" and > "stable" do not always coincide. Clam v0.80 has been the most stable > version to this point, and I, preferring stability over functionality, > am running 0.80. If running a stable clamav means letting a few viruses > through, then so be it. Which is why I said, in the bit you snipped, new releases should be tested on a test system that reflects your personal environment - and, by extension, any problems reported back to the developers. The problem with running old versions is that they are not supported, so when you do run into a problem like the one that started this thread, you are on your own, and you'll be told to upgrade to the latest version. > > Now that we have reports of spam crashing v0.80, it is time for me to > test v0.84. How can you say 0.80 is the most stable, when you haven't tested 0.84? Did you test anything after 0.80? -trog signature.asc Description: This is a digitally signed message part ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
On Tuesday 03 May 2005 13:23, Mike Lambert wrote: > Now that we have reports of spam crashing v0.80, it is time for me to > test v0.84. Your use the the word "now" makes it sound like this is something new only recently discovered. You seem to be ignoring the fact that this was known about, and fixed, some time ago. > -Mike -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
On Tue, 03 May 2005 08:23:38 -0400 Mike Lambert <[EMAIL PROTECTED]> wrote: > Now that we have reports of spam crashing v0.80, it is time for me to > test v0.84. If I was your boss, I'd fire you. Admins who wait with an update until a software (especially a mission critical one responsible for e-mail delivery) starts crashing are not worth any money. -- oo. Tomasz Kojm <[EMAIL PROTECTED]> (\/)\. http://www.ClamAV.net/gpg/tkojm.gpg \..._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Tue May 3 14:44:09 CEST 2005 pgpX3czUrByd5.pgp Description: PGP signature ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
Nigel Horne wrote: On Tuesday 03 May 2005 13:23, Mike Lambert wrote: Now that we have reports of spam crashing v0.80, it is time for me to test v0.84. Your use the the word "now" makes it sound like this is something new only recently discovered. Nope, just new to me. I read today's posts as though the problem was something new. My mistake. You seem to be ignoring the fact that this was known about, and fixed, some time ago. I did not know. I appologize for wasting your time. -Mike ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
Trog wrote: On Tue, 2005-05-03 at 08:23 -0400, Mike Lambert wrote: The responsible admin will evaluate the pros and cons of _any_ software release and choose what is best for his/her environment. The difficultly with any project in development, including ClamAV, is that "current" and "stable" do not always coincide. Clam v0.80 has been the most stable version to this point, and I, preferring stability over functionality, am running 0.80. If running a stable clamav means letting a few viruses through, then so be it. Which is why I said, in the bit you snipped, new releases should be tested on a test system that reflects your personal environment - and, by extension, any problems reported back to the developers. Ok. The problem with running old versions is that they are not supported, so when you do run into a problem like the one that started this thread, you are on your own, and you'll be told to upgrade to the latest version. This I undertsand. Now that we have reports of spam crashing v0.80, it is time for me to test v0.84. How can you say 0.80 is the most stable, when you haven't tested 0.84? I meant the most stable before 0.84. Sorry for the confusion. -Mike ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
On Tue, 3 May 2005, Mike Lambert wrote: > I meant the most stable before 0.84. Sorry for the confusion. If you had stability problem on 0.81, 0.82, and 0.83 -- did you post them ? Sorry if I missed it, but I don't recall seeing anything posted about stability problems on those version. Our own upgrades here between those versions had not problems at all. == Chris Candreva -- [EMAIL PROTECTED] -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/ ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
Tomasz Kojm wrote: On Tue, 03 May 2005 08:23:38 -0400 Mike Lambert <[EMAIL PROTECTED]> wrote: Now that we have reports of spam crashing v0.80, it is time for me to test v0.84. If I was your boss, I'd fire you. Admins who wait with an update until a software (especially a mission critical one responsible for e-mail delivery) starts crashing are not worth any money. Ok, so now that I have managed to anger three members of the development team (and lose my job), I can see that I have no business posting to this list. I apologize for wasting everyone's time. Thank you for making ClamAV. -Mike ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
On Tuesday 03 May 2005 08:23 am, Christopher X. Candreva wrote: > On Tue, 3 May 2005, Mike Lambert wrote: > > I meant the most stable before 0.84. Sorry for the confusion. > > If you had stability problem on 0.81, 0.82, and 0.83 -- did you post them ? > Sorry if I missed it, but I don't recall seeing anything posted about > stability problems on those version. I saw a couple of threads about MIME parsing time jumping exponentially and a lot of our customers have pretty high volume systems and this would have caused some serious problems. 0.84 was a very welcome sight, I can assure you :) http://lurker.clamav.net/message/20050216.123538.5a838448.en.html -Jeremy -- Jeremy Kitchen ++ Systems Administrator ++ Inter7 Internet Technologies, Inc. [EMAIL PROTECTED] ++ inter7.com ++ 866.528.3530 ++ 815.776.9465 int'l kitchen @ #qmail #gentoo on EFnet IRC ++ scriptkitchen.com/qmail GnuPG Key ID: 481BF7E2 ++ jabber:[EMAIL PROTECTED] pgpdu7yzhIj64.pgp Description: PGP signature ___ http://lurker.clamav.net/list/clamav-users.html
RE: [Clamav-users] clamd segfaulting as of about thursday
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Tomasz Kojm > Sent: dinsdag 3 mei 2005 14:51 > To: ClamAV users ML > Subject: Re: [Clamav-users] clamd segfaulting as of about thursday > > On Tue, 03 May 2005 08:23:38 -0400 > Mike Lambert <[EMAIL PROTECTED]> wrote: > > > Now that we have reports of spam crashing v0.80, it is time > > for me to test v0.84. > > If I was your boss, I'd fire you. Admins who wait with an update until > a software (especially a mission critical one responsible for e-mail > delivery) starts crashing are not worth any money. That seems a bit harsh. Mike makes a good general point about choosing pro stability. I myself tend to wait things out a day or two. Recently, for instance, qpopper moved from 4.0.5 to 4.0.6 to 4.0.7, all in a few days, with the proverbial "Oops! we forgot something!" Naturally, clamav is not qpopper, but still, it is quite sensible, imho, to wait a day or two before upgrading major stuff, to avoid these oopses. Having said that, I just upgraded my 0.83 installation to 0.84 (after reports on this list over the last few days were favorable). And it was a breeze. Took a grand total of less than 5 minutes. ;) In that regard, of course, there is really no valid excuse to still be running 0.80, methinks. - Mark System Administrator Asarian-host.org --- "If you were supposed to understand it, we wouldn't call it code." - FedEx ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
>>>Now that we have reports of spam crashing v0.80, it is time >>>for me to test v0.84. >> >>If I was your boss, I'd fire you. Admins who wait with an update until >>a software (especially a mission critical one responsible for e-mail >>delivery) starts crashing are not worth any money. > > > That seems a bit harsh. Mike makes a good general point about choosing > pro stability. I myself tend to wait things out a day or two. Recently, > for instance, qpopper moved from 4.0.5 to 4.0.6 to 4.0.7, all in a few > days, with the proverbial "Oops! we forgot something!" Naturally, clamav > is not qpopper, but still, it is quite sensible, imho, to wait a day or > two before upgrading major stuff, to avoid these oopses. > > - Mark > > System Administrator Asarian-host.org the truth surely lies somewhere in between. although it may be very important (esp. for clamav) to be up-to-date, no admin would ever introduce new software (even a new minor version) into a production environment without thorough testing before doing so. and guess what? even a not-so-thorough testbed will require some time to provide results. just my Pi cents... ;) -- Timo Schoeler | http://macfinity.net/~tis | [EMAIL PROTECTED] //macfinity -- finest IT services | http://macfinity.net Key fingerprint = F844 51BE C22C F6BD 1196 90B2 EF68 C851 6E12 2D8A There are 10 types of people in the world. Those who understand binary and those who don't. ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
On 5/2/05, Nigel Horne <[EMAIL PROTECTED]> wrote: > On Monday 02 May 2005 23:08, Pete 'Wolfy' Hanson wrote: > > slammed at postmaster each time it crashes. This was in the logs from > > the latest crash: > > > > May 2 14:22:24 smtp clamav-milter[153]: ClamAv: setsockopt() failed > > (Invalid argument) > > > If that message appears, clamav-milter will fail to start, so it's not > surprising nothing was logged... > > Review if you need the "-B" flag, and if not then don't use it. If > you do use the -B flag and this message appears, then check the NIC > you are telling it to use is correct. I am not explicity using the -B flag, nor do I believe that I need it. The error is occurring in clamav-milter (I should have been more explicit) using this in sendmail.mc INPUT_MAIL_FILTER(`clmilter', `S=local:/var/clamav/clamav-milter.sock, F=A, T=E:25m; R:90s; S:45s; C:30m') The milter runs for some period of time - the most recent instance was about 18 hours - and then it stops responding soon after an update to the database. Here's the most recent logging: May 3 12:17:00 smtp freshclam[20408]: Daemon started. May 3 12:17:00 smtp freshclam[20408]: ClamAV update process started at Tue May 3 12:17:00 2005 May 3 12:17:00 smtp freshclam[20408]: main.cvd is up to date (version: 31, sigs: 33079, f-level: 4, builder: tkojm) May 3 12:17:02 smtp freshclam[20408]: daily.cvd updated (version: 866, sigs: 1070, f-level: 4, builder: arnaud) May 3 12:17:02 smtp freshclam[20408]: Database updated (34149 signatures) from database.clamav.net (IP: 129.64.99.170) May 3 12:17:02 smtp freshclam[20408]: ERROR: Clamd was NOT notified: Can't connect to clamd through /var/clamav/clamd.sock May 3 12:17:09 smtp clamav-milter[8067]: j43JG2OX019910: /tmp/clamav-c7c0b2a04378f618/msg.ZrCyWp: Worm.Sober.P Intercepted virus from <[EMAIL PROTECTED]> to <[EMAIL PROTECTED]> <[EMAIL PROTECTED]> May 3 12:19:03 smtp clamav-milter[8067]: ClamAv: setsockopt() failed (Invalid argument) May 3 12:19:03 smtp last message repeated 23 times Somehow or other, that -B flag is being set when clamav-milter restarts following the reload. -- Pete Hanson http://www.well.com/user/wolfy http://www.fotolog.net/wolfy ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
> Somehow or other, that -B flag is being set when clamav-milter > restarts following the reload. FWIW, the problem is happening on both Solaris 2.8 and 2.6 systems (on the 2.8 system, there are no logged error messages - the milter simply stops responding, and everything needs to be restarted). Both systems are running sendmail 8.13.0 -- Pete Hanson http://www.well.com/user/wolfy http://www.fotolog.net/wolfy ___ http://lurker.clamav.net/list/clamav-users.html
Re: [Clamav-users] clamd segfaulting as of about thursday
Mark wrote: > > If I was your boss, I'd fire you. Admins who wait with an update until > > a software (especially a mission critical one responsible for e-mail > > delivery) starts crashing are not worth any money. > That seems a bit harsh. Actually, I was thinking that Tomasz ought to stop being subtle, and tell us what he really thinks :) > but still, it is quite sensible, imho, to wait a day or two before > upgrading major stuff, to avoid these oopses. Correct. Several release versions, however, is a tad more than a day or two, methinks. Matt ___ http://lurker.clamav.net/list/clamav-users.html
