ClamAV Cron Error

From Roaring Penguin
Jump to: navigation, search

Symptom

  Cron <root@KingKong> test -x /usr/share/canit/scripts/watch-clamd && /usr/share/canit/scripts/watch-clamd (failed)
  ClamAV daemon not responding... restarting.
  Stopping ClamAV daemon: clamd Waiting .  .  .  .  .  .  . .
  Starting ClamAV daemon: clamd .

Background and Cause

There's a once-a-minute process that connects to the ClamAV process to see if it's running nicely, and if it doesn't respond in what CanIt thinks is a reasonable amount of time, it re-starts it, and you get the messages you've seen.

The cause of that can be any one of several things:

  1. A really large file is being scanned, slowing ClamAV down.
  2. A "broken" file being scanned actually clobbers the ClamAV process.
  3. The load on the machine is just such that it's too slow to respond.

Remedy

The real telling issue is how frequently are they happening.

  • If it is infrequent it could be any of the above and is likely difficult to troubleshoot. Probably can be ignored.
  • If they happen in clusters or particular times of the day, maybe associated with regular system activity, such as, server backup. We would suspect 3). You might want to think about a hardware upgrade.
  • If they are happening all the time we would suspect 3) and you should do some performance troubleshooting to see what element - CPU, memory, disk - needs upgrading.