Difference between revisions of "ClamAV Cron Error"
From Roaring Penguin
| Line 4: | Line 4: | ||
Stopping ClamAV daemon: clamd Waiting . . . . . . . . | Stopping ClamAV daemon: clamd Waiting . . . . . . . . | ||
Starting ClamAV daemon: clamd . | Starting ClamAV daemon: clamd . | ||
| − | === | + | ===Background and Cause=== |
There's a once-a-minute process that connects to the ClamAV process to see | There's a once-a-minute process that connects to the ClamAV process to see | ||
if it's running nicely, and if it doesn't respond in what CanIt thinks is | if it's running nicely, and if it doesn't respond in what CanIt thinks is | ||
| Line 16: | Line 16: | ||
#The load on the machine is just such that it's too slow to respond. | #The load on the machine is just such that it's too slow to respond. | ||
| + | ===Remedy=== | ||
The real telling issue is how frequently are they happening. | The real telling issue is how frequently are they happening. | ||
Revision as of 13:52, 2 July 2014
Cron <root@KingKong> test -x /usr/share/canit/scripts/watch-clamd && /usr/share/canit/scripts/watch-clamd (failed)
Symptom
ClamAV daemon not responding... restarting. Stopping ClamAV daemon: clamd Waiting . . . . . . . . Starting ClamAV daemon: clamd .
Background and Cause
There's a once-a-minute process that connects to the ClamAV process to see if it's running nicely, and if it doesn't respond in what CanIt thinks is a reasonable amount of time, it re-starts it, and you get the messages you've seen.
The cause of that can be any one of several things:
- A really large file is being scanned, slowing ClamAV down.
- A "broken" file being scanned actually clobbers the ClamAV process.
- The load on the machine is just such that it's too slow to respond.
Remedy
The real telling issue is how frequently are they happening.
- If it is infrequent it could be any of the above and is likely difficult to troubleshoot. Probably can be ignored.
- If they happen in clusters or particular times of the day, maybe associated with server backup, we would suspect 3). You might want to think about a hardware upgrade.
- If they are happening all the time we would suspect 3) and you should do some performance troubleshooting to see what element - CPU, memory, disk - needs upgrading.
