ClamAV is NOT running but it is enabled.

NodeWorx General Discussion
1

This error has come up:

ClamAV is NOT running but it is enabled. In this state mail will be delayed until ClamAV is turned back on!

I tried “yum udate” but every package is up to date.

I still can’t start ClamAV :frowning:

2

Here’s my Clamav log.

Sun Jun 6 16:24:04 2010 -> Running as user clamav (UID 110, GID 106)

Sun Jun 6 16:24:04 2010 -> Log file size limit disabled.

Sun Jun 6 16:24:04 2010 -> Reading databases from /var/lib/clamav

Sun Jun 6 16:24:04 2010 -> Not loading PUA signatures.

Sun Jun 6 16:24:15 2010 -> Loaded 799243 signatures.

Sun Jun 6 16:24:16 2010 -> TCP: Bound to address 127.0.0.1 on port 3310

Sun Jun 6 16:24:16 2010 -> TCP: Setting connection queue length to 30

Sun Jun 6 16:24:16 2010 -> Limits: Global size limit set to 104857600 bytes.

Sun Jun 6 16:24:16 2010 -> Limits: File size limit set to 26214400 bytes.

Sun Jun 6 16:24:16 2010 -> Limits: Recursion level limit set to 16.

Sun Jun 6 16:24:16 2010 -> Limits: Files limit set to 10000.

Sun Jun 6 16:24:16 2010 -> Archive support enabled.

Sun Jun 6 16:24:16 2010 -> Algorithmic detection enabled.

Sun Jun 6 16:24:16 2010 -> Portable Executable support enabled.

Sun Jun 6 16:24:16 2010 -> ELF support enabled.

Sun Jun 6 16:24:16 2010 -> Mail files support enabled.

Sun Jun 6 16:24:16 2010 -> OLE2 support enabled.

Sun Jun 6 16:24:16 2010 -> PDF support enabled.

Sun Jun 6 16:24:16 2010 -> HTML support enabled.

Sun Jun 6 16:24:16 2010 -> Self checking every 600 seconds.

3

I am not sure what version of clamav I have installed.

In my control panel it says 95.2

On yum list the output is:

yum list clamav

Installed Packages
clamav.i386 0.93-100.rhe5x.iworx installed
clamav.i386 0.96-100.rhe5x.iworx installed

4

Clamav is running now, but I disabled “SMTP Virus Scanning”.

If I enable “SMTP Virus Scanning” clamav stops after a couple of minuters.

I think it has something to do with reloading the database. That is scheduled every 600 seconds but does not happen if “SMTP Virus Scanning” is disabled.

5

This issue still isn’t solved.
I tried again yesterday (because there was a Clam update) but after 9 hours ClamAV stopped running.

Here’s my log off the last hour it was running, I hope somebody can help me with this.

Fri Jun 25 05:00:21 2010 -> Self checking every 600 seconds.

Fri Jun 25 05:14:48 2010 -> No stats for Database check - forcing reload

Fri Jun 25 05:14:56 2010 -> Reading databases from /var/lib/clamav

Fri Jun 25 05:15:07 2010 -> Database correctly reloaded (802498 signatures)

Fri Jun 25 05:25:07 2010 -> SelfCheck: Database status OK.

Fri Jun 25 05:35:03 2010 -> +++ Started at Fri Jun 25 05:35:03 2010

Fri Jun 25 05:35:03 2010 -> clamd daemon 0.95.2 (OS: linux-gnu, ARCH: i386, CPU: i686)

Fri Jun 25 05:35:03 2010 -> Running as user clamav (UID 110, GID 106)

Fri Jun 25 05:35:03 2010 -> Log file size limit disabled.

Fri Jun 25 05:35:03 2010 -> Reading databases from /var/lib/clamav

Fri Jun 25 05:35:03 2010 -> Not loading PUA signatures.

Fri Jun 25 05:35:15 2010 -> Loaded 802498 signatures.

Fri Jun 25 05:35:16 2010 -> TCP: Bound to address 127.0.0.1 on port 3310

Fri Jun 25 05:35:16 2010 -> TCP: Setting connection queue length to 30

Fri Jun 25 05:35:16 2010 -> Limits: Global size limit set to 104857600 bytes.

Fri Jun 25 05:35:16 2010 -> Limits: File size limit set to 26214400 bytes.

Fri Jun 25 05:35:16 2010 -> Limits: Recursion level limit set to 16.

Fri Jun 25 05:35:16 2010 -> Limits: Files limit set to 10000.

Fri Jun 25 05:35:16 2010 -> Archive support enabled.

Fri Jun 25 05:35:16 2010 -> Algorithmic detection enabled.

Fri Jun 25 05:35:16 2010 -> Portable Executable support enabled.

Fri Jun 25 05:35:16 2010 -> ELF support enabled.

Fri Jun 25 05:35:16 2010 -> Mail files support enabled.

Fri Jun 25 05:35:16 2010 -> OLE2 support enabled.

Fri Jun 25 05:35:16 2010 -> PDF support enabled.

Fri Jun 25 05:35:16 2010 -> HTML support enabled.

Fri Jun 25 05:35:16 2010 -> Self checking every 600 seconds.

Fri Jun 25 05:50:06 2010 -> +++ Started at Fri Jun 25 05:50:06 2010

Fri Jun 25 05:50:06 2010 -> clamd daemon 0.95.2 (OS: linux-gnu, ARCH: i386, CPU: i686)

Fri Jun 25 05:50:06 2010 -> Running as user clamav (UID 110, GID 106)

Fri Jun 25 05:50:06 2010 -> Log file size limit disabled.

Fri Jun 25 05:50:06 2010 -> Reading databases from /var/lib/clamav

Fri Jun 25 05:50:06 2010 -> Not loading PUA signatures.

Fri Jun 25 05:50:19 2010 -> Loaded 802498 signatures.

Fri Jun 25 05:50:19 2010 -> TCP: Bound to address 127.0.0.1 on port 3310

Fri Jun 25 05:50:19 2010 -> TCP: Setting connection queue length to 30

Fri Jun 25 05:50:19 2010 -> Limits: Global size limit set to 104857600 bytes.

Fri Jun 25 05:50:19 2010 -> Limits: File size limit set to 26214400 bytes.

Fri Jun 25 05:50:19 2010 -> Limits: Recursion level limit set to 16.

Fri Jun 25 05:50:19 2010 -> Limits: Files limit set to 10000.

Fri Jun 25 05:50:19 2010 -> Archive support enabled.

Fri Jun 25 05:50:19 2010 -> Algorithmic detection enabled.

Fri Jun 25 05:50:19 2010 -> Portable Executable support enabled.

Fri Jun 25 05:50:19 2010 -> ELF support enabled.

Fri Jun 25 05:50:19 2010 -> Mail files support enabled.

Fri Jun 25 05:50:19 2010 -> OLE2 support enabled.

Fri Jun 25 05:50:19 2010 -> PDF support enabled.

Fri Jun 25 05:50:19 2010 -> HTML support enabled.

Fri Jun 25 05:50:19 2010 -> Self checking every 600 seconds.

Fri Jun 25 06:00:19 2010 -> No stats for Database check - forcing reload

Fri Jun 25 06:00:20 2010 -> Reading databases from /var/lib/clamav

Fri Jun 25 06:00:27 2010 -> Database correctly reloaded (802498 signatures)

Fri Jun 25 06:05:03 2010 -> +++ Started at Fri Jun 25 06:05:03 2010

Fri Jun 25 06:05:03 2010 -> clamd daemon 0.95.2 (OS: linux-gnu, ARCH: i386, CPU: i686)

Fri Jun 25 06:05:03 2010 -> Running as user clamav (UID 110, GID 106)

Fri Jun 25 06:05:03 2010 -> Log file size limit disabled.

Fri Jun 25 06:05:03 2010 -> Reading databases from /var/lib/clamav

Fri Jun 25 06:05:03 2010 -> Not loading PUA signatures.

Fri Jun 25 06:05:17 2010 -> Loaded 802498 signatures.

Fri Jun 25 06:05:17 2010 -> TCP: Bound to address 127.0.0.1 on port 3310

Fri Jun 25 06:05:17 2010 -> TCP: Setting connection queue length to 30

Fri Jun 25 06:05:17 2010 -> Limits: Global size limit set to 104857600 bytes.

Fri Jun 25 06:05:17 2010 -> Limits: File size limit set to 26214400 bytes.

Fri Jun 25 06:05:17 2010 -> Limits: Recursion level limit set to 16.

Fri Jun 25 06:05:17 2010 -> Limits: Files limit set to 10000.

Fri Jun 25 06:05:17 2010 -> Archive support enabled.

Fri Jun 25 06:05:17 2010 -> Algorithmic detection enabled.

Fri Jun 25 06:05:17 2010 -> Portable Executable support enabled.

Fri Jun 25 06:05:17 2010 -> ELF support enabled.

Fri Jun 25 06:05:17 2010 -> Mail files support enabled.

Fri Jun 25 06:05:17 2010 -> OLE2 support enabled.

Fri Jun 25 06:05:17 2010 -> PDF support enabled.

Fri Jun 25 06:05:17 2010 -> HTML support enabled.

Fri Jun 25 06:05:17 2010 -> Self checking every 600 seconds.

Fri Jun 25 06:15:17 2010 -> No stats for Database check - forcing reload

Fri Jun 25 06:15:17 2010 -> Reading databases from /var/lib/clamav

Fri Jun 25 06:15:27 2010 -> Database correctly reloaded (802498 signatures)

Fri Jun 25 06:25:27 2010 -> SelfCheck: Database status OK.

6

What does this say?

rpm -qa | grep clam

Paul

7

It says:

rpm -qa | grep clam

clamav-0.93-100.rhe5x.iworx
clamav-0.96-100.rhe5x.iworx

8

I am still trying to solve this problem.

Everything seems to be up to date, but I still cannot start “SMTP Virus Scanning”.

9

Hey Ziggy,
I dealt with this issue on one of my servers a month or two ago. In my case it seems that the virus definition files were corrupted. I re-downloaded them, restarted ClamAV, and everything started working.

If that doesn’t work, file a support ticket and I’ll take a look myself.

10

Thanks for your answer Jon!

On my server it started may 15, after an update.

I have no idea how to redownload the virus definition files. What would be the commands for Putty to do this?