ClamAV execusion died without error messages

[Ming Tang]

I did not find any other error messages in log files. The following lines
appeared in the section for "kernel log messages" in daily email message for
Security Run Output.

> pid 840 (freshclam), uid 1#: exited on signal 11
> pid 875 (clamd), uid 1#: exited on signal 10

I am not sure what they mean exactly.

Thanks.


- Ming
 
-----Original Message-----
From: Bill Moran [mailto:wmoran at potentialtech.com] 
Sent: Sunday, March 01, 2009 6:37 PM
To: Ming Tang
Cc: freebsd-questions at freebsd.org
Subject: Re: ClamAV execusion died without error messages


"Ming Tang" <mtang17 at comcast.net> wrote:
>
> Bill,
> 
> Thank you for the response.
> 
> I tried and did not figure out where is the problem. I am attaching 
> the command line prompts and clamd.log and freshclam.log content here.
> 
> ns1#
> ns1# ./clamav-clamd.sh status
> clamav_clamd is not running.
> ns1# ./clamav-clamd.sh start
> Starting clamav_clamd.
> LibClamAV Warning: **************************************************
> LibClamAV Warning: ***  The virus database is older than 7 days!  ***
> LibClamAV Warning: ***   Please update it as soon as possible.    ***
> LibClamAV Warning: **************************************************
> ns1# ./clamav-clamd.sh status
> clamav_clamd is not running.
> ns1#
> 
> ns1# cat clamd.log
> +++ Started at Sat Feb 28 10:43:36 2009
> clamd daemon 0.94.1 (OS: freebsd5.4, ARCH: i386, CPU: i386) Running as 
> user clamav (UID 1#, GID 1#) Log file size limited to 1048576 bytes.
> Reading databases from /var/db/clamav
> Not loading PUA signatures.
> Loaded 455125 signatures.
> LOCAL: Removing stale socket file /var/run/clamav/clamd.sock
> LOCAL: Unix socket file /var/run/clamav/clamd.sock
> LOCAL: Setting connection queue length to 15
> Limits: Global size limit set to 104857600 bytes.
> Limits: File size limit set to 26214400 bytes.
> Limits: Recursion level limit set to 16.
> Limits: Files limit set to 10000.
> Archive support enabled.
> Algorithmic detection enabled.
> Portable Executable support enabled.
> ELF support enabled.
> Mail files support enabled.
> OLE2 support enabled.
> PDF support enabled.
> HTML support enabled.
> Self checking every 1800 seconds.
> 
> ......
> 
> ns1#
> ns1# ./clamav-freshclam.sh status
> clamav_freshclam is not running.
> ns1# ./clamav-freshclam.sh start
> Starting clamav_freshclam.
> ns1# ./clamav-freshclam.sh status
> clamav_freshclam is not running.
> ns1#
> 
> ns1# cat freshclam1.log
> --------------------------------------
> freshclam daemon 0.94.1 (OS: freebsd5.4, ARCH: i386, CPU: i386)

That's certainly strange.

Try starting the processes manually instead of using the rc scripts, and see
if they exit with an error of some sort.  Also, I seem to remember having
difficult with permissions under some circumstances, where the processes
couldn't write to directories they needed -- check that both clamd and
freshclam are running as the same user/group.  See if you're getting core
files anywhere (check /var/log/messages for coredump messages). Audit your
config files and make sure nothing is out of sorts.

Sorry I can't give you any more specific information, but I've not seen the
problem you're having.

-- 
Bill Moran
http://www.potentialtech.com