Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > ISPConfig 2 > General

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Thread Tools Display Modes
Old 25th April 2008, 09:38
Norman Norman is offline
HowtoForge Supporter
Join Date: May 2006
Posts: 242
Thanks: 0
Thanked 18 Times in 14 Posts
Default Weird issue with clamav and ISPConfig 2.2.23

Ok. So I upgraded to the latest version of ISPConfig.
This had the effect that customers with tiny quotas and antivirus scan activated risk getting their diskspace full.

First of all. The first problem report was when I got bounces when I sent mail to a customer.

This is the mail system at host somesystem.xh.se.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                   The mail system

<big124_username@somesystem.xh.se> (expanded from <username@custdomain.ext>):
    can't create user output file. Command output: /bin/cat: write error: Disk
    quota exceeded procmail: Program failure (1) of
    "/home/admispconfig/ispconfig/tools/clamav/bin/clamassassin" procmail:
    Rescue of unfiltered data succeeded [760] warn: bayes: bayes db version 0
    is not able to be used, aborting! at
    line 196. [760] warn: bayes: bayes db version 0 is not able to be used,
    aborting! at
    line 196. procmail: Quota exceeded while writing
I checked the user and had his quota increased. Just to find out that it rapidly filled his quota space on disk.
With a quota of 100MB he was using 99MB but only 14MB was used under his /var/www/web124 directory .

A quick find / -name big124_username turned up a lot of clamav directories under /tmp

Turns out that when his initial quotaspace was small the clamav directory filled his quota on disk since clamav writes as the user of the recipient.

(Potential DoS - just send lots of big mails to be scanned)

The CLAMAV process fills his quotaspace and procmail is unable to deliver the files. So it just builds up more and more files under /tmp for clamav.

Any solution to this issue other than increasing quota of users where they dont risk getting filled up on clamav directories of antivirus scans?

I've manually removed clamav directories out of /tmp

Another problem is that postfix reports with a non quota full message and doesnt give correct smtp codes for quota full since it's later on in the pipeline of delivery.
Reply With Quote
Sponsored Links
Old 25th April 2008, 11:12
till till is offline
Super Moderator
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 36,995
Thanks: 840
Thanked 5,650 Times in 4,460 Posts

Thats a bug in ClamAV since 0.90. Instead of using the central token database clamav downlodas a new copy of the datbase and forgets to delete his temp files from time to time when the quota is not large enough.

The solution is to use clamd instead of clamscan:

Till Brehm
Get ISPConfig support and the ISPConfig 3 manual from ispconfig.org.
Reply With Quote


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
ISPConfig 2.2.23 released till General 4 30th April 2008 13:47
ISPConfig 2.3.2-dev released till General 9 4th June 2007 11:46
IspConfig and clamav lrider Installation/Configuration 1 7th November 2006 12:30
Spamassissin ClamAV with ISPConfig update?? Mounir Installation/Configuration 2 3rd August 2006 00:23
How to config spamassassin and clamAV in ISPconfig? tom Installation/Configuration 16 25th May 2006 06:24

All times are GMT +2. The time now is 16:30.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.