Spamfilter not working after upgrade

Discussion in 'Installation/Configuration' started by Cris Kolkman, Oct 26, 2016.

  1. Cris Kolkman

    Cris Kolkman Member

    Hello,

    Yesterday I upgraded my php from 5.4 to 5.6 in order to be able to upgrade ISPConfig to version 3.1
    [[email protected] amavisd]# php -v
    PHP 5.6.26 (cli) (built: Sep 17 2016 09:53:52)
    Copyright (c) 1997-2016 The PHP Group
    Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
    [[email protected] amavisd]# cat /etc/*release
    CentOS Linux release 7.2.1511 (Core)
    NAME="CentOS Linux"
    VERSION="7 (Core)"
    ID="centos"
    ID_LIKE="rhel fedora"
    VERSION_ID="7"
    PRETTY_NAME="CentOS Linux 7 (Core)"
    ANSI_COLOR="0;31"
    CPE_NAME="cpe:/o:centos:centos:7"
    HOME_URL="https://www.centos.org/"
    BUG_REPORT_URL="https://bugs.centos.org/"

    CENTOS_MANTISBT_PROJECT="CentOS-7"
    CENTOS_MANTISBT_PROJECT_VERSION="7"
    REDHAT_SUPPORT_PRODUCT="centos"
    REDHAT_SUPPORT_PRODUCT_VERSION="7"

    CentOS Linux release 7.2.1511 (Core)
    CentOS Linux release 7.2.1511 (Core)

    All went well and website's are running as before.
    Only thing is that the spamfilter isn't working anymore.
    Clamav seems to be installed:
    [[email protected] amavisd]# yum info clamav
    Loaded plugins: fastestmirror, priorities, replace
    Loading mirror speeds from cached hostfile
    * base: ftp.tudelft.nl
    * epel: epel.mirror.nucleus.be
    * extras: mirror.nforce.com
    * updates: centos.mirror.triple-it.nl
    * webtatic: uk.repo.webtatic.com
    173 packages excluded due to repository priority protections
    Installed Packages
    Name : clamav
    Arch : x86_64
    Version : 0.99.2
    Release : 1.el7
    Size : 2.4 M
    Repo : installed
    From repo : epel
    Summary : End-user tools for the Clam Antivirus scanner
    URL : http://www.clamav.net
    License : GPLv2
    Description : Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this
    : software is the integration with mail servers (attachment scanning). The
    : package provides a flexible and scalable multi-threaded daemon, a command
    : line scanner, and a tool for automatic updating via Internet. The programs
    : are based on a shared library distributed with the Clam AntiVirus package,
    : which you can use with your own software. The virus database is based on
    : the virus database from OpenAntiVirus, but contains additional signatures
    : (including signatures for popular polymorphic viruses, too) and is KEPT UP
    : TO DATE.

    Clamd cannot be found:
    [[email protected] amavisd]# yum info clamd
    Loaded plugins: fastestmirror, priorities, replace
    Loading mirror speeds from cached hostfile
    * base: ftp.tudelft.nl
    * epel: epel.mirror.nucleus.be
    * extras: mirror.nforce.com
    * updates: centos.mirror.triple-it.nl
    * webtatic: uk.repo.webtatic.com
    173 packages excluded due to repository priority protections
    Error: No matching Packages to list

    When I try to start clamav:
    [[email protected] amavisd]# service clamav start
    Redirecting to /bin/systemctl start clamav.service
    Failed to start clamav.service: Unit clamav.service failed to load: No such file or directory.

    And in the maillog I see these errors:
    Oct 26 15:43:52 mailserver amavis[22233]: (22233-01) (!)connect to /var/run/clamd.amavisd/clamd.sock failed, attempt #1: Can't connect to a UNIX socket /var/run/clamd.amavisd/clamd.sock: No such file or directory
    Oct 26 15:43:53 mailserver amavis[22233]: (22233-01) (!)connect to /var/run/clamd.amavisd/clamd.sock failed, attempt #1: Can't connect to a UNIX socket /var/run/clamd.amavisd/clamd.sock: No such file or directory
    Oct 26 15:43:53 mailserver amavis[22233]: (22233-01) (!)ClamAV-clamd: All attempts (1) failed connecting to /var/run/clamd.amavisd/clamd.sock, retrying (2)
    Oct 26 15:43:57 mailserver postfix/smtpd[5799]: disconnect from spffrpar5.***.com[***]
    Oct 26 15:43:59 mailserver amavis[22233]: (22233-01) (!)connect to /var/run/clamd.amavisd/clamd.sock failed, attempt #1: Can't connect to a UNIX socket /var/run/clamd.amavisd/clamd.sock: No such file or directory
    Oct 26 15:43:59 mailserver amavis[22233]: (22233-01) (!)ClamAV-clamd av-scanner FAILED: run_av error: Too many retries to talk to /var/run/clamd.amavisd/clamd.sock (All attempts (1) failed connecting to /var/run/clamd.amavisd/clamd.sock) at (eval 98) line 613.\n
    Oct 26 15:43:59 mailserver amavis[22233]: (22233-01) (!)WARN: all primary virus scanners failed, considering backups
    Oct 26 15:44:23 mailserver amavis[22233]: (22233-01) (!)ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan KILLED, signal 9 (0009) at (eval 98) line 905.
    Oct 26 15:44:23 mailserver amavis[22233]: (22233-01) (!!)AV: ALL VIRUS SCANNERS FAILED
    Oct 26 15:44:28 mailserver postfix/smtpd[6469]: connect from unknown[127.0.0.1]
    Oct 26 15:44:28 mailserver postfix/smtpd[6469]: BF0AE5D6234: client=unknown[127.0.0.1]
    Oct 26 15:44:28 mailserver postfix/cleanup[5814]: BF0AE5D6234: message-id=<[email protected].***.com>
    Oct 26 15:44:28 mailserver amavis[22233]: (22233-01) Passed UNCHECKED {RelayedTaggedInbound}

    Before the upgrade the spamfilter was working fine.
    What could be the problem?
     
  2. Cris Kolkman

    Cris Kolkman Member

    I now also installed clamav-server and clamav-server-systemd and the following now also appears in the maillog:
    Oct 26 16:16:14 mailserver clamd[28575]: Received 0 file descriptor(s) from systemd.
    Oct 26 16:16:14 mailserver clamd[28575]: clamd daemon 0.99.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
    Oct 26 16:16:14 mailserver clamd[28575]: Running as user amavis (UID 994, GID 992)
    Oct 26 16:16:14 mailserver clamd[28575]: Log file size limited to 1048576 bytes.
    Oct 26 16:16:14 mailserver clamd[28575]: Reading databases from /var/lib/clamav
    Oct 26 16:16:14 mailserver clamd[28575]: Not loading PUA signatures.
    Oct 26 16:16:14 mailserver clamd[28575]: Bytecode: Security mode set to "TrustSigned".

    But still I get the ***UNCHECKED*** mails and the same errors in maillog:
    Oct 26 16:15:44 mailserver amavis[23427]: (23427-01) (!)connect to /var/run/clamd.amavisd/clamd.sock failed, attempt #1: Can't connect to a UNIX socket /var/run/clamd.amavisd/clamd.sock: Connection refused
    Oct 26 16:15:45 mailserver amavis[23427]: (23427-01) (!)connect to /var/run/clamd.amavisd/clamd.sock failed, attempt #1: Can't connect to a UNIX socket /var/run/clamd.amavisd/clamd.sock: Connection refused
    Oct 26 16:15:45 mailserver amavis[23427]: (23427-01) (!)ClamAV-clamd: All attempts (1) failed connecting to /var/run/clamd.amavisd/clamd.sock, retrying (2)
    Oct 26 16:15:48 mailserver postfix/smtpd[27806]: disconnect from SPFDEFRA1.***.com[***]
    Oct 26 16:15:51 mailserver amavis[23427]: (23427-01) (!)connect to /var/run/clamd.amavisd/clamd.sock failed, attempt #1: Can't connect to a UNIX socket /var/run/clamd.amavisd/clamd.sock: Connection refused
    Oct 26 16:15:51 mailserver amavis[23427]: (23427-01) (!)ClamAV-clamd av-scanner FAILED: run_av error: Too many retries to talk to /var/run/clamd.amavisd/clamd.sock (All attempts (1) failed connecting to /var/run/clamd.amavisd/clamd.sock) at (eval 98) line 613.\n
    Oct 26 16:15:51 mailserver amavis[23427]: (23427-01) (!)WARN: all primary virus scanners failed, considering backups
     
  3. Cris Kolkman

    Cris Kolkman Member

    Hmmm now also getting these errors:

    Oct 26 16:53:22 mailserver amavis[2581]: (02581-02) (!)ClamAV-clamd av-scanner FAILED: Undefined subroutine &Amavis::Conf::ask_deamon called at (eval 98) line 985.
    Oct 26 16:53:22 mailserver amavis[2581]: (02581-02) (!)WARN: all primary virus scanners failed, considering backups
    Oct 26 16:53:38 mailserver amavis[2581]: (02581-02) (!)run_av (ClamAV-clamscan) FAILED - unexpected exit 2, output="LibClamAV Error: mpool_malloc(): Can't allocate memory (262144 bytes).\nLibClamAV Error: hm_addhash_bin: failed to grow hash array to 3185 entries\nLibClamAV Error: cli_loadhash: Malformed hash string at line 686008\nLibClamAV Error: cli_loadhash: Problem parsing database at line 686008\nLibClamAV Error: Can't load main.mdb: Can't allocate memory\nLibClamAV Error: cli_tgzload: Can't load main.mdb\nLibClamAV Error: Can't load /var/lib/clamav/main.cvd: Malformed database\nLibClamAV Error: cli_loaddbdir(): error loading database /var/lib/clamav/main.cvd\nERROR: Malformed database"
    Oct 26 16:53:38 mailserver amavis[2581]: (02581-02) (!)ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan unexpected exit 2, output="LibClamAV Error: mpool_malloc(): Can't allocate memory (262144 bytes).\nLibClamAV Error: hm_addhash_bin: failed to grow hash array to 3185 entries\nLibClamAV Error: cli_loadhash: Malformed hash string at line 686008\nLibClamAV Error: cli_loadhash: Problem parsing database at line 686008\nLibClamAV Error: Can't load main.mdb: Can't allocate memory\nLibClamAV Error: cli_tgzload: Can't load main.mdb\nLibClamAV Error: Can't load /var/lib/clamav/main.cvd: Malformed database\nLibClamAV Error: cli_loaddbdir(): error loading database /var/lib/clamav/main.cvd\nERROR: Malformed database" at (eval 98) line 905.
    Oct 26 16:53:38 mailserver amavis[2581]: (02581-02) (!!)AV: ALL VIRUS SCANNERS FAILED
     
  4. beryl

    beryl New Member

    Same here, just noticed it.
    # service clamav start
    Failed to start clamav.service: Unit clamav.service failed to load: No such file or directory.
     
  5. Jesse Norell

    Jesse Norell Active Member

    sounds like you're out of memory on your server.
     
  6. Cris Kolkman

    Cris Kolkman Member

    Yes I added more memory on the server and problem seems to be fixed now.
     

Share This Page