Difference between revisions of "ClamAV Cron Error"
From Roaring Penguin
| Line 21: | Line 21: | ||
*If it is infrequent it could be any of the above and is likely difficult to troubleshoot. Probably can be ignored. | *If it is infrequent it could be any of the above and is likely difficult to troubleshoot. Probably can be ignored. | ||
| − | *If they happen in clusters or particular times of the day, maybe associated with server backup | + | *If they happen in clusters or particular times of the day, maybe associated with regular system activity, such as, server backup. We would suspect 3). You might want to think about a hardware upgrade. |
*If they are happening all the time we would suspect 3) and you should do some [[Performance Troubleshooting |performance troubleshooting]] to see what element - CPU, memory, disk - needs upgrading. | *If they are happening all the time we would suspect 3) and you should do some [[Performance Troubleshooting |performance troubleshooting]] to see what element - CPU, memory, disk - needs upgrading. | ||
<div style="float:right; clear:both; margin-right:0.5em">[[Support Wiki | [Home]]]</div> | <div style="float:right; clear:both; margin-right:0.5em">[[Support Wiki | [Home]]]</div> | ||
[[category:All]][[category:Antivirus]][[category:Troubleshooting]][[category:Errors]] | [[category:All]][[category:Antivirus]][[category:Troubleshooting]][[category:Errors]] | ||
Latest revision as of 14:04, 2 July 2014
Symptom
Cron <root@KingKong> test -x /usr/share/canit/scripts/watch-clamd && /usr/share/canit/scripts/watch-clamd (failed) ClamAV daemon not responding... restarting. Stopping ClamAV daemon: clamd Waiting . . . . . . . . Starting ClamAV daemon: clamd .
Background and Cause
There's a once-a-minute process that connects to the ClamAV process to see if it's running nicely, and if it doesn't respond in what CanIt thinks is a reasonable amount of time, it re-starts it, and you get the messages you've seen.
The cause of that can be any one of several things:
- A really large file is being scanned, slowing ClamAV down.
- A "broken" file being scanned actually clobbers the ClamAV process.
- The load on the machine is just such that it's too slow to respond.
Remedy
The real telling issue is how frequently are they happening.
- If it is infrequent it could be any of the above and is likely difficult to troubleshoot. Probably can be ignored.
- If they happen in clusters or particular times of the day, maybe associated with regular system activity, such as, server backup. We would suspect 3). You might want to think about a hardware upgrade.
- If they are happening all the time we would suspect 3) and you should do some performance troubleshooting to see what element - CPU, memory, disk - needs upgrading.
