Probleme mit Amavis & clamav

maject · May 2, 2010

Grosses Edit // siehe Post 17

Hallo,

ich vermute mal das ich vieles verschlimmbessert habe. Zur Zeit ist es so, dass ich Mails verschicken und empfangen kann. Allerdings läuft die Festplatte nach einigerzeit voll - in einigen Stunden etwa. Da ich überhaupt keine Ahnung mehr habe nach allen Howto's poste ich hier einige Logs, lange nur auszugweise. Wenn etwas zu wenig war, bitte einfach nochmal anschreiben!

Schuld am volllaufen sind diese Dateien:

Code:

./var/lib/amavis/tmp/amavis-20100502T050503-29854/parts/core.30050
./var/lib/amavis/tmp/amavis-20100502T080146-30072/parts/core.32014
./var/lib/amavis/tmp/amavis-20100502T031836-19578/parts/core.20375
./var/lib/amavis/tmp/amavis-20100502T025852-14177/parts/core.17430
...

Auszug aus der MailWarteschlange

Code:

8449C5A9135      687 Sat May  1 23:40:02  smmsp@maject.de
(host 127.0.0.1[127.0.0.1] said: 451-4.5.0 Error in processing,  id=30407-01, virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED:  ClamAV-clamd av-scanner FAILED: run_av error: Too many retries to talk  to /var/run/clamav/clamd.ctl (Can't connect to UNIX socket  /var/run/clamav/clamd.ctl: Datei oder Verzeichnis nicht gefunden) at  (eval 88) line 309.; ClamAV-clamscan av-scanner FAILED:  /usr/bin/clamscan unexpected exit 2, output="WARNING: Ignoring  deprecated option --disable-summary 451-4.5.0 LibClamAV Error:  mpool_malloc(): Can't allocate memory (262144 bytes). 451-4.5.0  LibClamAV Error: cli_ac_addpatt: Can't allocate memory for  next->trans 451-4.5.0 LibClamAV Error: cli_parse_add(): Problem  adding signature (3). 451-4.5.0 LibClamAV Error: Problem parsing  database at line 489 451-4.5.0 LibClamAV Error: Can't load main.ndb:  Malformed database 451-4.5.0 LibClamAV Error: cli_tgzload: Can't load  main.ndb 451-4.5.0 LibClamAV Error: Can't load  /var/lib/clamav//main.cvd: Malformed database 451-4.5.0 ERROR: Malformed  database 451-4.5.0  451-4.5.0 ----------- SCAN SUMMARY -----------  451-4.5.0 Known viruses: 698548 451-4.5.0 Engine version: 0.96 451-4.5.0  Scanned directories: 0 451-4.5.0 Scanned files: 0 451-4.5.0 Infected  files: 0 451-4.5.0 Data scanned: 0.00 MB 451-4.5.0 Data read: 0.00 MB  (ratio 0.00:1) 451 4.5.0 Time: 8.551 sec (0 m 8 s)" at (eval 88) line  527. (in reply to end of DATA command))
                                         root@maject.de

Auszug aus dem Mail-Protokoll

Code:

May  2 08:44:44 h1242412 amavis[7749]: (07749-04-3) (!!)TROUBLE in  check_mail: virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED:  ClamAV-clamd av-scanner FAILED: run_av error: Too many retries to talk  to /var/run/clamav/clamd.ctl (Can't connect to UNIX socket  /var/run/clamav/clamd.ctl: Datei oder Verzeichnis nicht gefunden) at  (eval 88) line 309.; ClamAV-clamscan av-scanner FAILED:  /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527.
May  2 08:44:44 h1242412 postfix/bounce[9357]: fatal: append file defer  583075A9167: Disk quota exceeded
May  2 08:44:44 h1242412 amavis[7749]: (07749-04-3) (!)PRESERVING  EVIDENCE in /var/lib/amavis/tmp/amavis-20100502T084428-07749
May  2 08:44:44 h1242412 amavis[7489]: (07489-05-3) (!!)ClamAV-clamscan  av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval  88) line 527.
May  2 08:44:44 h1242412 amavis[7489]: (07489-05-3) (!!)TROUBLE in  check_mail: virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED:  ClamAV-clamd av-scanner FAILED: run_av error: Too many retries to talk  to /var/run/clamav/clamd.ctl (Can't connect to UNIX socket  /var/run/clamav/clamd.ctl: Datei oder Verzeichnis nicht gefunden) at  (eval 88) line 309.; ClamAV-clamscan av-scanner FAILED:  /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527.

Auszug aus dem MailWarn-Protokoll

Code:

May  2 08:44:44 h1242412 amavis[7489]: (07489-05-3) (!!)TROUBLE in  check_mail: virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED:  ClamAV-clamd av-scanner FAILED: run_av error: Too many retries to talk  to /var/run/clamav/clamd.ctl (Can't connect to UNIX socket  /var/run/clamav/clamd.ctl: Datei oder Verzeichnis nicht gefunden) at  (eval 88) line 309.; ClamAV-clamscan av-scanner FAILED:  /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527.
May  2 08:44:44 h1242412 amavis[7489]: (07489-05-3) (!)PRESERVING  EVIDENCE in /var/lib/amavis/tmp/amavis-20100502T084428-07489
May  2 08:44:44 h1242412 postfix/bounce[9358]: fatal: append file defer  E4C455A917A: Disk quota exceeded
May  2 08:44:45 h1242412 postfix/smtp[9231]: warning: 583075A9167: defer  service failure
May  2 08:44:45 h1242412 postfix/master[21869]: warning: process  /usr/lib/postfix/bounce pid 9357 exit status 1
May  2 08:44:45 h1242412 postfix/smtp[9349]: warning: E4C455A917A: defer  service failure
May  2 08:44:45 h1242412 postfix/master[21869]: warning: process  /usr/lib/postfix/bounce pid 9358 exit status 1
May  2 08:44:45 h1242412 amavis[7749]: (07749-04-4) (!!)TROUBLE in  process_request: Can't create directory  /var/lib/amavis/tmp/amavis-20100502T084445-07749: Der zugewiesene  Plattenplatz (Quota) ist \303\274berschritten at /usr/sbin/amavisd-new  line 5081,  line 166.
May  2 08:44:45 h1242412 amavis[7749]: (07749-04-4) (!)Requesting  process rundown after fatal error
May  2 08:44:45 h1242412 amavis[7489]: (07489-05-4) (!!)TROUBLE in  process_request: Can't create directory  /var/lib/amavis/tmp/amavis-20100502T084445-07489: Der zugewiesene  Plattenplatz (Quota) ist \303\274berschritten at /usr/sbin/amavisd-new  line 5081,  line 177.

Auszug aus dem MailError-Protokoll

Code:

May  2 08:44:36 h1242412 amavis[7749]: (07749-04-3) (!!)WARN: all  primary virus scanners failed, considering backups
May  2 08:44:44 h1242412 amavis[7749]: (07749-04-3) (!!)ClamAV-clamscan  av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval  88) line 527.
May  2 08:44:44 h1242412 amavis[7749]: (07749-04-3) (!!)TROUBLE in  check_mail: virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED:  ClamAV-clamd av-scanner FAILED: run_av error: Too many retries to talk  to /var/run/clamav/clamd.ctl (Can't connect to UNIX socket  /var/run/clamav/clamd.ctl: Datei oder Verzeichnis nicht gefunden) at  (eval 88) line 309.; ClamAV-clamscan av-scanner FAILED:  /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527.
May  2 08:44:44 h1242412 postfix/bounce[9357]: fatal: append file defer  583075A9167: Disk quota exceeded
May  2 08:44:44 h1242412 amavis[7489]: (07489-05-3) (!!)ClamAV-clamscan  av-scanner FAILED: /usr/bin/clamscan DIED on signal 11

FreshClam-Protokoll

Code:

Unable to read /var/log/clamav/freshclam.log

vmtl. wird das Log von Freshclam woanders liegen.

ClamAv-Protokoll

Code:

Sun May  2 00:46:22 2010 -> +++ Started at Sun May  2 00:46:22 2010
Sun May  2 00:46:22 2010 -> clamd daemon 0.96 (OS: linux-gnu, ARCH:  i386, CPU: i486)
Sun May  2 00:46:22 2010 -> Log file size limit disabled.
Sun May  2 00:46:22 2010 -> Reading databases from /var/lib/clamav
Sun May  2 00:46:22 2010 -> Not loading PUA signatures.
Sun May  2 00:46:29 2010 -> ERROR: Malformed database

Wo könnte ich jetzt anfangen? Mit Can't connect to UNIX socket /var/run/clamav/clamd.ctl: Datei oder Verzeichnis nicht gefunden vielleicht?

Edit:
Ab und zu bekomme ich eine Mail:

Code:

/usr/share/sendmail/sendmail: line 880: /usr/sbin/sendmail-msp: No such file or directory

Und bevor ichs vergesse,
ich habe einen StratoVserver A - Debian 5.0 - IspConfig

wstuermer · May 2, 2010

Du könntest entweder ClamAV auf eine Version >=0.95 aktualisieren oder den Virenscan in der /etc/amavis.conf deaktivieren.

Anschließend dann einmal amavis, postfix und sysklogd neustarten.

maject · May 2, 2010

Code:

# freshclam
ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).

Hast du in den Logs irgendwas erkannt das ClamAv nicht >= 0.95 ist? Hatte nämlich die 0.96 schon das einbinden der volatile-sources // update // upgrade installiert

wstuermer · May 2, 2010

Das Log kann er nicht aktualisieren, weil Deine Platte voll ist. Lösch mal /var/spool/amavis/tmp/*

maject · May 2, 2010

Die Platte ist "noch" nicht voll, zur zeit bin ich bei 5 GB, <= 2 wäre in etwa normal, und 10 ist Maximum.
Ich glaube du meinst das Verzeichnis /var/log/clamav/tmp, dort wo er immer die platte vollschreibt. Das Verzeichnis habe ich geleert aber freshclam bringt immernoch die selbe fehlermeldung.

Edit: Dein genanntes Verzeichnis hab ich garnicht

wstuermer · May 2, 2010

Die Dienste neu gestartet anschließend?

maject · May 2, 2010

Ja, aber wie gesagt Freshclam bringt immernoch die selbe Fehlermessage. Beim Starten habe ich nichts ungewöhnliches beobachten könne, also keine Fehlermeldungen direkt beim Start in der Konsole. Virenscan hab ich jedoch nicht deaktiviert.

wstuermer · May 2, 2010

Du musst erstmal entscheiden, was Du willst. Entweder: Virenscan deaktivieren -ODER- Virenscanner aktualisieren.

Ältere Versionen als 0.95 werden seit dem 16.4. nicht mehr unterstützt und werfen dank eines entsprechenden Signaturupdates nur noch SegmentationFaults.

Entscheide dich

maject · May 2, 2010

Hast du meinen Post #3 gelesen? Theoretisch sollte über volatile ClamAv 0.96+dfsg-4~volatile1 drauf sein

wstuermer · May 2, 2010

Nicht, nach deinem Edit... da ich da schon längst geantwortet hatte

Ich setze mal voraus, dass Du die Hinweise in dem Freshclam-Log schon überprüft hast, oder?

maject · May 2, 2010

Scheinbar schreibt er ja dieses Log garnicht. Es ist jedenfalls nicht da, und über updatedb // locate freshclam.log kann er auch nichts finden.

wstuermer · May 2, 2010

Unter welchem Benutzer läuft dein freshclam? Existiert das Verzeichnis /var/log/clamav/ und darf der Freshclam-User schreibend auf dieses Verzeichnis zugreifen?

maject · May 2, 2010

Code:

drwxr-xr-x 2 amavis   amavis      4096  2. Mai 13:12 clamav

Wo/Wie kann ich ermitteln, unter welchem Benutzer freshclam läuft?

Edit:

Ich vermute mal du meinst du /etc/clamav/freshclam.conf

Code:

# Automatically created by the clamav-freshclam postinst
# Comments will get lost when you reconfigure the clamav-freshclam package

DatabaseOwner clamav
UpdateLogFile /var/log/clamav/freshclam.log
LogVerbose false
LogSyslog false
LogFacility LOG_LOCAL6
LogFileMaxSize 0
LogTime true
Foreground false
Debug false
MaxAttempts 5
DatabaseDirectory /var/lib/clamav/
DNSDatabaseInfo current.cvd.clamav.net
AllowSupplementaryGroups false
PidFile /var/run/clamav/freshclam.pid
ConnectTimeout 30
ReceiveTimeout 30
ScriptedUpdates yes
CompressLocalDatabase no
Bytecode true
# Check for new database 24 times a day
Checks 24
DatabaseMirror db.local.clamav.net
DatabaseMirror database.clamav.net

wstuermer · May 2, 2010

Na wir nähern uns doch langsam. Und noch ein "ps afux|grep clam"

maject · May 2, 2010

Code:

root     13683  0.0  0.0   3024   728 pts/1    S+   13:27   0:00          \_ grep clam
clamav   32581  0.0  0.0  12188  1520 ?        Ss   00:18   0:00 /usr/bin/freshclam -d --quiet

Siehst du was, was ich nicht sehe?

wstuermer · May 2, 2010

maject said:
Siehst du was, was ich nicht sehe?

Ja

Ich sehe einen freshclam, der unter dem Benutzer "clamav" läuft. In /var/log/clamav/ darf aber nur der Benutzer "amavis" schreiben

maject · May 2, 2010

GROSSES EDIT - DEBIAN 5.0 Lenny neuinstalliert // gleiche Probleme -.-

Nach langem hin und her hab ichs dann nochmal von vorn versucht. Ich bekomme schon probleme wenn ich auf dem laufenden default-lenny mit apache2 ispconfig einfach -nur- postfix ohne virenscan/spam etc. installieren möchte.

Dann habe ich dies hier gemacht:
http://www.howtoforge.com/virtual-users-domains-postfix-courier-mysql-squirrelmail-debian-lenny

Aus Spaß hab ich dann die ClamAv Zeilen in der Amavis.conf kommentiert // neugestartet // immernoch probleme

Code:

# /etc/amavis/conf.d/15_av-scanners kommentierte zeilen entfernt
use strict;
@av_scanners = ();
@av_scanners_backup = ();
1;

Code:

# /etc/clamav/clamav.conf kommentierte zeilen entfernt
LocalSocket /var/run/clamav/clamd.ctl
FixStaleSocket true
LocalSocketGroup clamav
LocalSocketMode 666
User clamav
AllowSupplementaryGroups true
ScanMail true
ScanArchive true
ArchiveBlockEncrypted false
MaxDirectoryRecursion 15
FollowDirectorySymlinks false
FollowFileSymlinks false
ReadTimeout 180
MaxThreads 12
MaxConnectionQueueLength 15
StreamMaxLength 10M
LogSyslog false
LogFacility LOG_LOCAL6
LogClean false
LogVerbose false
PidFile /var/run/clamav/clamd.pid
DatabaseDirectory /var/lib/clamav
SelfCheck 3600
Foreground false
Debug false
ScanPE true
ScanOLE2 true
ScanHTML true
DetectBrokenExecutables false
ExitOnOOM false
LeaveTemporaryFiles false
AlgorithmicDetection true
ScanELF true
IdleTimeout 30
PhishingSignatures true
PhishingScanURLs true
PhishingAlwaysBlockSSLMismatch false
PhishingAlwaysBlockCloak false
DetectPUA false
ScanPartialMessages false
HeuristicScanPrecedence false
StructuredDataDetection false
CommandReadTimeout 5
SendBufTimeout 200
MaxQueue 100
LogFile /var/log/clamav/clamav.log
LogTime true
LogFileUnlock false
LogFileMaxSize 0
Bytecode true
BytecodeSecurity TrustSigned
BytecodeTimeout 60000
OfficialDatabaseOnly false
CrossFilesystems true

Code:

# freshclam.conf
DatabaseOwner clamav
UpdateLogFile /var/log/clamav/freshclam.log
LogVerbose false
LogSyslog false
LogFacility LOG_LOCAL6
LogFileMaxSize 0
LogTime true
Foreground false
Debug false
MaxAttempts 5
DatabaseDirectory /var/lib/clamav/
DNSDatabaseInfo current.cvd.clamav.net
AllowSupplementaryGroups false
PidFile /var/run/clamav/freshclam.pid
ConnectTimeout 30
ReceiveTimeout 30
ScriptedUpdates yes
CompressLocalDatabase no
Bytecode true
# Check for new database 24 times a day
Checks 24
DatabaseMirror db.local.clamav.net
DatabaseMirror database.clamav.net

Code:

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
append_dot_mydomain = no
readme_directory = /usr/share/doc/postfix
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
myhostname = h1242412.stratoserver.net
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = h1242412.stratoserver.net, localhost, localhost.localdomain
relayhost = 
mynetworks = 127.0.0.0/8
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
html_directory = /usr/share/doc/postfix/html
virtual_alias_domains = 
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_mailbox_base = /home/vmail
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_tls_security_level = may
transport_maps = proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
relay_domains = mysql:/etc/postfix/mysql-virtual_relaydomains.cf
relay_recipient_maps = mysql:/etc/postfix/mysql-virtual_relayrecipientmaps.cf
virtual_create_maildirsize = yes
virtual_maildir_extended = yes
virtual_mailbox_limit_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailbox_limit_maps.cf
virtual_mailbox_limit_override = yes
virtual_maildir_limit_message = "The user you are trying to reach is over quota."
virtual_overquota_bounce = yes
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $virtual_mailbox_limit_maps
smtpd_sender_restrictions = check_sender_access mysql:/etc/postfix/mysql-virtual_sender.cf
smtpd_client_restrictions = check_client_access mysql:/etc/postfix/mysql-virtual_client.cf
maildrop_destination_concurrency_limit = 1
maildrop_destination_recipient_limit = 1
virtual_transport = maildrop
header_checks = regexp:/etc/postfix/header_checks
mime_header_checks = regexp:/etc/postfix/mime_header_checks
nested_header_checks = regexp:/etc/postfix/nested_header_checks
body_checks = regexp:/etc/postfix/body_checks
content_filter = amavis:[127.0.0.1]:10024
receive_override_options = no_address_mappings
message_size_limit = 30720000

Code:

#postfix/master.cf

pickup    fifo  n       -       -       60      1       pickup
cleanup   unix  n       -       -       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       -       1000?   1       tlsmgr
rewrite   unix  -       -       -       -       -       trivial-rewrite
bounce    unix  -       -       -       -       0       bounce
defer     unix  -       -       -       -       0       bounce
trace     unix  -       -       -       -       0       bounce
verify    unix  -       -       -       -       1       verify
flush     unix  n       -       -       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       -       -       -       smtp

relay     unix  -       -       -       -       -       smtp
    -o smtp_fallback_relay=

showq     unix  n       -       -       -       -       showq
error     unix  -       -       -       -       -       error
retry     unix  -       -       -       -       -       error
discard   unix  -       -       -       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       -       -       -       lmtp
anvil     unix  -       -       -       -       1       anvil
scache    unix  -       -       -       -       1       scache

maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/bin/maildrop -d vmail ${extension} ${recipient} ${user} ${nexthop} ${sender}

uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)

ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix    -    n    n    -    2    pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman   unix  -       n       n       -       -       pipe
  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  ${nexthop} ${user}


amavis unix - - - - 2 smtp
        -o smtp_data_done_timeout=1200
        -o smtp_send_xforward_command=yes

127.0.0.1:10025 inet n - - - - smtpd
        -o content_filter=
        -o local_recipient_maps=
        -o relay_recipient_maps=
        -o smtpd_restriction_classes=
        -o smtpd_client_restrictions=
        -o smtpd_helo_restrictions=
        -o smtpd_sender_restrictions=
        -o smtpd_recipient_restrictions=permit_mynetworks,reject
        -o mynetworks=127.0.0.0/8
        -o strict_rfc821_envelopes=yes
        -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
        -o smtpd_bind_address=127.0.0.1

Code:

#clamav log
Mon May  3 00:11:46 2010 -> +++ Started at Mon May  3 00:11:46 2010
Mon May  3 00:11:46 2010 -> clamd daemon 0.96 (OS: linux-gnu, ARCH: i386, CPU: i486)
Mon May  3 00:11:46 2010 -> Log file size limit disabled.
Mon May  3 00:11:46 2010 -> Reading databases from /var/lib/clamav
Mon May  3 00:11:46 2010 -> Not loading PUA signatures.
Mon May  3 00:11:52 2010 -> Loaded 759782 signatures.
Mon May  3 00:11:52 2010 -> LOCAL: Unix socket file /var/run/clamav/clamd.ctl
Mon May  3 00:11:52 2010 -> LOCAL: Setting connection queue length to 15
Mon May  3 00:11:52 2010 -> ERROR: daemonize() failed
Mon May  3 00:11:52 2010 -> Socket file removed.
Mon May  3 00:13:47 2010 -> +++ Started at Mon May  3 00:13:47 2010
Mon May  3 00:13:47 2010 -> clamd daemon 0.96 (OS: linux-gnu, ARCH: i386, CPU: i486)
Mon May  3 00:13:47 2010 -> Running as user clamav (UID 112, GID 114)
Mon May  3 00:13:47 2010 -> Log file size limit disabled.
Mon May  3 00:13:47 2010 -> Reading databases from /var/lib/clamav
Mon May  3 00:13:47 2010 -> Not loading PUA signatures.
Mon May  3 00:13:54 2010 -> ERROR: Malformed database

Code:

#freshclam log
Mon May  3 00:00:55 2010 -> --------------------------------------
Mon May  3 00:00:55 2010 -> freshclam daemon 0.96 (OS: linux-gnu, ARCH: i386, CPU: i486)
Mon May  3 00:00:55 2010 -> ClamAV update process started at Mon May  3 00:00:55 2010
Mon May  3 00:00:55 2010 -> main.cvd is up to date (version: 52, sigs: 704727, f-level: 44, builder: sven)
Mon May  3 00:00:55 2010 -> daily.cvd is up to date (version: 10890, sigs: 55754, f-level: 51, builder: guitar)
Mon May  3 00:00:55 2010 -> bytecode.cvd is up to date (version: 13, sigs: 1, f-level: 51, builder: nervous)
Mon May  3 00:00:55 2010 -> --------------------------------------
Mon May  3 00:11:33 2010 -> --------------------------------------
Mon May  3 00:11:33 2010 -> ClamAV update process started at Mon May  3 00:11:33 2010
Mon May  3 00:11:33 2010 -> main.cvd is up to date (version: 52, sigs: 704727, f-level: 44, builder: sven)
Mon May  3 00:11:33 2010 -> daily.cvd is up to date (version: 10890, sigs: 55754, f-level: 51, builder: guitar)
Mon May  3 00:11:33 2010 -> bytecode.cvd is up to date (version: 13, sigs: 1, f-level: 51, builder: nervous)

Code:

# ein paar Zeilen aus der mail.log
May  3 00:51:31 h1242412 amavis[10165]: (10165-01) (!!)ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527.
May  3 00:51:31 h1242412 amavis[10165]: (10165-01) (!!)TROUBLE in check_mail: virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527.
May  3 00:51:31 h1242412 amavis[10165]: (10165-01) (!)PRESERVING EVIDENCE in /var/lib/amavis/tmp/amavis-20100503T005120-10165
May  3 00:51:32 h1242412 amavis[10164]: (10164-01) (!!)ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527.
May  3 00:51:32 h1242412 amavis[10164]: (10164-01) (!!)TROUBLE in check_mail: virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527.
May  3 00:51:32 h1242412 amavis[10164]: (10164-01) (!)PRESERVING EVIDENCE in /var/lib/amavis/tmp/amavis-20100503T005120-10164
May  3 00:51:39 h1242412 postfix/smtp[12070]: 282355381E5: to=<deja-vu@maject.de>, relay=127.0.0.1[127.0.0.1]:10024, delay=916, delays=905/0.09/0.01/11, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 Error in processing, id=10165-01, virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527. (in reply to end of DATA command))
May  3 00:51:39 h1242412 postfix/smtp[12067]: 4DDB65381E9: to=<atze@maject.de>, relay=127.0.0.1[127.0.0.1]:10024, delay=543, delays=532/0.08/0.01/11, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 Error in processing, id=10164-01, virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527. (in reply to end of DATA command))
May  3 00:51:39 h1242412 amavis[10165]: (10165-02) (!!)WARN: all primary virus scanners failed, considering backups
May  3 00:51:39 h1242412 amavis[10164]: (10164-02) (!!)WARN: all primary virus scanners failed, considering backups
May  3 00:51:50 h1242412 amavis[10165]: (10165-02) (!!)ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527.
May  3 00:51:50 h1242412 amavis[10165]: (10165-02) (!!)TROUBLE in check_mail: virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527.
May  3 00:51:50 h1242412 amavis[10164]: (10164-02) (!!)ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527.
May  3 00:51:50 h1242412 amavis[10165]: (10165-02) (!)PRESERVING EVIDENCE in /var/lib/amavis/tmp/amavis-20100503T005139-10165
May  3 00:51:50 h1242412 amavis[10164]: (10164-02) (!!)TROUBLE in check_mail: virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527.
May  3 00:51:50 h1242412 amavis[10164]: (10164-02) (!)PRESERVING EVIDENCE in /var/lib/amavis/tmp/amavis-20100503T005139-10164
May  3 00:51:56 h1242412 postfix/smtp[12070]: 4CD8053810F: to=<maject.de@maject.de>, relay=127.0.0.1[127.0.0.1]:10024, delay=1361, delays=1331/19/0.02/11, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 Error in processing, id=10164-02, virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527. (in reply to end of DATA command))
May  3 00:51:56 h1242412 postfix/smtp[12067]: 472C2538037: to=<matthiasmeyer@maject.de>, relay=127.0.0.1[127.0.0.1]:10024, delay=5000, delays=4970/19/0.01/11, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 Error in processing, id=10165-02, virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan DIED on signal 11 (008b) at (eval 88) line 527. (in reply to end of DATA command))
May  3 00:51:57 h1242412 amavis[10165]: (10165-02-2) (!!)WARN: all primary virus scanners failed, considering backups
May  3 00:51:57 h1242412 amavis[10164]: (10164-02-2) (!!)WARN: all primary virus scanners failed, considering backups

Desweiteren werden mails über Telnet localhost 25 angenommen // Auch über Thunderbird. Telnet localhost 110 (vmtl. pop scheitert dagegen nach dem Eingeben des Passworts mit :

Code:

# telnet localhost 110
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
+OK Hello there.
USER maject
+OK Password required.
PASS *********
[B]-ERR Temporary problem, please try again later[/B]
Connection closed by foreign host.

Die Mailwarteschlange wird immer länger und sieht jetzt ungefähr so aus:

Code:

8CEAD5390B4     7443 Mon May  3 10:20:25   iexajykod9617@airtelbroadband.in
(temporary failure. Command output: pipe: fatal: pipe_command: execvp  /usr/bin/maildrop: No such file or directory)
                                         matthiasmeyer@maject.de

849A653907D     7661 Mon May  3 09:00:18  vu@maject.de
(temporary failure. Command output: pipe: fatal: pipe_command: execvp  /usr/bin/maildrop: No such file or directory)
                                         matthiasmeyer@maject.de

85740538F9E    12376 Mon May  3 03:04:10  Arzmiller_aesitscyr@gmail.com
(temporary failure. Command output: pipe: fatal: pipe_command: execvp  /usr/bin/maildrop: No such file or directory)
                                         matthiasmeyer@maject.de

Das Verzeichnis /usr/bin/maildrop exisitiert wirklich nicht, und habe ich jetzt einfach mal angelegt.

maject · May 3, 2010

Sorry, für den Doppelpost habe in vorangegangen Beitrag ja allerhand Logs & Configs gepostet. Hat dazu jemand noch eine Idee, bzw. fehlt etwas wichtiges?

Noch eine Frage zwischendurch: Ist es möglich die Mails manuell aus der Warteschlange zu holen, damit ich sie mir auf meinen Heimrechner laden kann und Thunderbird ansehen kann?

LinuxAdmin · May 4, 2010

maject said:
Das Verzeichnis /usr/bin/maildrop exisitiert wirklich nicht, und habe ich jetzt einfach mal angelegt.

Wie der Name schon andeutet, liegen unter /usr/bin keine Verzeichnisse, sondern ausführbare binaries (=Programme). Dort ein Verzeichnis anzulegen, trägt nicht zur Lösung des Problems bei.
http://packages.debian.org/de/lenny/maildrop

Probleme mit Amavis & clamav

maject

New Member

wstuermer

Active Member

maject

New Member

wstuermer

Active Member

maject

New Member

wstuermer

Active Member

maject

New Member

wstuermer

Active Member

maject

New Member

wstuermer

Active Member

maject

New Member

wstuermer

Active Member

maject

New Member

wstuermer

Active Member

maject

New Member

wstuermer

Active Member

maject

New Member

maject

New Member

LinuxAdmin

Moderator

We value your privacy