From owner-freebsd-questions@FreeBSD.ORG Mon Mar 2 00:36:36 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0B632106566C for ; Mon, 2 Mar 2009 00:36:36 +0000 (UTC) (envelope-from wmoran@potentialtech.com) Received: from mail.potentialtech.com (internet.potentialtech.com [66.167.251.6]) by mx1.freebsd.org (Postfix) with ESMTP id CE1F28FC1A for ; Mon, 2 Mar 2009 00:36:35 +0000 (UTC) (envelope-from wmoran@potentialtech.com) Received: from working (pool-72-95-226-5.pitbpa.ftas.verizon.net [72.95.226.5]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.potentialtech.com (Postfix) with ESMTPSA id 7FAE5EBC0A; Sun, 1 Mar 2009 19:36:34 -0500 (EST) Date: Sun, 1 Mar 2009 19:36:33 -0500 From: Bill Moran To: "Ming Tang" Message-Id: <20090301193633.c9ed3807.wmoran@potentialtech.com> In-Reply-To: References: <20090227145716.9e3bdc3c.wmoran@potentialtech.com> X-Mailer: Sylpheed 2.5.0 (GTK+ 2.12.11; i386-portbld-freebsd7.0) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: ClamAV execusion died without error messages X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Mar 2009 00:36:36 -0000 "Ming Tang" wrote: > > Bill, > > Thank you for the response. > > I tried and did not figure out where is the problem. I am attaching the > command line prompts and clamd.log and freshclam.log content here. > > ns1# > ns1# ./clamav-clamd.sh status > clamav_clamd is not running. > ns1# ./clamav-clamd.sh start > Starting clamav_clamd. > LibClamAV Warning: ************************************************** > LibClamAV Warning: *** The virus database is older than 7 days! *** > LibClamAV Warning: *** Please update it as soon as possible. *** > LibClamAV Warning: ************************************************** > ns1# ./clamav-clamd.sh status > clamav_clamd is not running. > ns1# > > ns1# cat clamd.log > +++ Started at Sat Feb 28 10:43:36 2009 > clamd daemon 0.94.1 (OS: freebsd5.4, ARCH: i386, CPU: i386) > Running as user clamav (UID 1#, GID 1#) > Log file size limited to 1048576 bytes. > Reading databases from /var/db/clamav > Not loading PUA signatures. > Loaded 455125 signatures. > LOCAL: Removing stale socket file /var/run/clamav/clamd.sock > LOCAL: Unix socket file /var/run/clamav/clamd.sock > LOCAL: Setting connection queue length to 15 > Limits: Global size limit set to 104857600 bytes. > Limits: File size limit set to 26214400 bytes. > Limits: Recursion level limit set to 16. > Limits: Files limit set to 10000. > Archive support enabled. > Algorithmic detection enabled. > Portable Executable support enabled. > ELF support enabled. > Mail files support enabled. > OLE2 support enabled. > PDF support enabled. > HTML support enabled. > Self checking every 1800 seconds. > > ...... > > ns1# > ns1# ./clamav-freshclam.sh status > clamav_freshclam is not running. > ns1# ./clamav-freshclam.sh start > Starting clamav_freshclam. > ns1# ./clamav-freshclam.sh status > clamav_freshclam is not running. > ns1# > > ns1# cat freshclam1.log > -------------------------------------- > freshclam daemon 0.94.1 (OS: freebsd5.4, ARCH: i386, CPU: i386) That's certainly strange. Try starting the processes manually instead of using the rc scripts, and see if they exit with an error of some sort. Also, I seem to remember having difficult with permissions under some circumstances, where the processes couldn't write to directories they needed -- check that both clamd and freshclam are running as the same user/group. See if you're getting core files anywhere (check /var/log/messages for coredump messages). Audit your config files and make sure nothing is out of sorts. Sorry I can't give you any more specific information, but I've not seen the problem you're having. -- Bill Moran http://www.potentialtech.com