Hi, Debian 3.1, Alpha GNU/Linux 2.4.27-2, clamd daemon 0.88.2
I am using clamd with exim (exiscan) to scan emails. The other day the systems became un- responsive and would not accept input from the console. It was getting the error "fork: Resource temporarily unavailable (35)". The only reason I can find for this is the large number of defunct clamd processes. I restart clamd yesterday and I already have 622 ...... clamav 21062 10100 0 09:45 ? 00:00:00 [clamd] <defunct> clamav 21081 10100 0 09:45 ? 00:00:00 [clamd] <defunct> clamav 21209 10100 0 09:46 ? 00:00:00 [clamd] <defunct> clamav 21275 10100 0 09:47 ? 00:00:00 [clamd] <defunct> clamav 21444 10100 0 09:50 ? 00:00:00 [clamd] <defunct> clamav 21579 10100 0 09:52 ? 00:00:00 [clamd] <defunct> clamav 21714 10100 0 09:53 ? 00:00:00 [clamd] <defunct> clamav 21831 10100 0 09:55 ? 00:00:00 [clamd] <defunct> clamav 21913 10100 1 09:56 ? 00:00:03 [clamd] <defunct> clamav 22024 10100 0 09:57 ? 00:00:00 [clamd] <defunct> clamav 22113 10100 0 09:58 ? 00:00:00 [clamd] <defunct> The only potential cause for this that I can find is the ScanArchive directive in clamd.conf. I have tried to comment it out but when I re-start clamav the log shows "Archive support enabled" Is there something I can do to stop these zombie processes from growing (a part from re-starting clamd)? Is there some reason why the ScanArcive option is still enabled when I have asked not specified it? TIA. Dp. ========= clamav.log =========== +++ Started at Tue Jul 4 17:13:22 2006 > clamd daemon 0.88.2 (OS: linux > Log file size limit disabled. > Running as user clamav (UID 105, GID 102) > Reading databases from /var/lib/clamav > Protecting against 60847 viruses. > Unix socket file /var/run/clamav/clamd.ctl > Setting connection queue length to 15 > Archive: Archived file size limit set to 31457280 bytes. > Archive: Recursion level limit set to 5. > Archive: Files limit set to 1000. > Archive: Compression ratio limit set to 250. > Archive support enabled. > Archive: RAR support disabled. > Archive: Blocking archives that exceed limits. ============================ ======================== Clamd.conf ==== #Automatically Generated by clamav-base postinst #To reconfigure clamd run #dpkg-reconfigure clamav-base #Please read /usr/share/doc/clamav-base/README.Debian.gz for details LocalSocket /var/run/clamav/clamd.ctl FixStaleSocket User clamav AllowSupplementaryGroups ScanMail # ScanArchive ArchiveMaxRecursion 5 ArchiveMaxFiles 1000 ArchiveMaxFileSize 30M ArchiveMaxCompressionRatio 250 ReadTimeout 180 MaxThreads 12 MaxConnectionQueueLength 15 LogFile /var/log/clamav/clamav.log LogTime LogFileMaxSize 0 PidFile /var/run/clamav/clamd.pid DatabaseDirectory /var/lib/clamav SelfCheck 3600 ScanOLE2 ScanPE DetectBrokenExecutables ScanHTML ArchiveBlockMax ========================== Dermot Paikkos Network Administrator @ Science Photo Library Phone: 0207 432 1100 Fax: 0207 286 8668 _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
