Re: [exim] exim and clamd on fc5

Asbjørn Aarrestad wrote:

*snip*

>
> clamd created the socket, with a user in the exim group, and the socket
> has rw for the group.
> clamd and exim points to the same socket.
>

OK.

>
> As far as I understand, clamd is called in the "local_scan" part, but
> when runnig with -d+deliver, I get the following:
> calling local_scan(); timeout=300
> local_scan() returned 0 NULL
>
>
> any ideas?
>
>

Well - that debug AFAIK doesn't submit a 'known infected' message to be scanned,
so a null return may be OK. Not my area of expertise.

Anyway - that isn't how I would test.

Instead;

1) Check 'top' or 'ps' to see if clamd has *continued to run* after being
started. You may find something in ~/log/messages, ~/log/maillog (or
wherever...) that shows it started up, then died for lack of, for example, privs
to write its logs, read its DB, chdir, etc.

2) Once you are sure it is staying alive, try turning up your logging verbosity
and send in a known-bad message message. Look at wherever clamd is logging as
well as in Exim's logs.

The most common problem we had when we first started using Exim with clamd was
that of clamd not having rightd to all the resources it needed to stay on its feet.

Second most common was when we used to start Exim before clamd and SA were
available. Mere nuisance, fixed by sequencing the startups.

The most common error now is the once-in-a-while message wherein we need to
update the clamd rev level, but that is never fatal.

HTH,

Bill