Hello Renaud,
Renaud Allard <renaud@???> (Mo 07 Apr 2008 10:15:37 CEST):
> Hello,
>
> Heiko Schlittermann wrote:
> > Hello,
> >
> > I know, it is slightly offtopic, but on this list I expect some response
> > to confirm my suspicion:
> >
> > Last night, around 23:30 the freshclam daemon tried unsuccessfully to
> > connect to a number of webservers. These attempts probably took a long
> > time. During (?) this time the clamav-daemon (the scanner itself) died
> > (around 0:30).
> >
> > I experienced this behaviour on a number of machines last night.
> >
> > Is there anybody else who had the same problem?
>
> I have already had this kind of behavior from clamd many times.
> Generally, the daemon crashes because it tries to reload a corrupted sig
> database (unfinished download).
I do not think it's because of corrupted database. It's because of
locked database directory (according to the log of clamav):
Sun Apr 6 22:30:03 2008 -> SelfCheck: Database status OK.
Sun Apr 6 22:42:44 2008 -> stream 1513: HTML.Phishing.Pay-200 FOUND
Received signal: wake up
ClamAV update process started at Sun Apr 6 23:26:39 2008
main.inc is up to date (version: 46, sigs: 231834, f-level: 26, builder: sven)
nonblock_connect: connect timing out (30 secs)
Can't connect to port 80 of host db.local.clamav.net (IP: 62.26.160.3)
...
# next timestamped freshclam entry is at 3:48
Sun Apr 6 23:30:20 2008 -> SelfCheck: Database status OK.
Mon Apr 7 00:31:10 2008 -> SelfCheck: Database modification detected. Forcing reload.
Mon Apr 7 00:31:10 2008 -> Reading databases from /var/lib/clamav
Mon Apr 7 00:33:20 2008 -> ERROR: reload db failed: Unable to lock database directory (try 1)
Mon Apr 7 00:35:30 2008 -> ERROR: reload db failed: Unable to lock database directory (try 2)
Mon Apr 7 00:37:40 2008 -> ERROR: reload db failed: Unable to lock database directory (try 3)
Mon Apr 7 00:37:40 2008 -> ERROR: reload db failed: Unable to lock database directory
Mon Apr 7 00:37:40 2008 -> Terminating because of a fatal error.
Mon Apr 7 00:37:40 2008 -> Socket file removed.
Mon Apr 7 00:37:40 2008 -> Pid file removed.
Mon Apr 7 00:37:40 2008 -> --- Stopped at Mon Apr 7 00:37:40 2008
> The latest version of clamav (0.93RC) which is unfortunately still in RC
> has another database management and has not crashed this way yet.
--
Heiko
