clamd not creating socket or pid file

[Tom Hodder]

Hi,

I have the 0.90.3 rpm from the fedora core 6 repos running on my fedora
6 box.
It is running as the defang user, and has been running fine for a long
while, however the clamd was restarted last night and mimedefang is
complaining that there is no /var/run/clamav/clamd.sock file, and sure
enough there is not. There is also no pid file also;

It looks like the /etc/clamd.conf parses ok;

[root@vs802 MIMEDefang]# clamconf -n
/etc/clamd.conf: clamd directives
-----------------
LogFile = "/var/log/clamav/clamd.log"
LogFileMaxSize = 0
LogTime = yes
LogVerbose = yes
LogSyslog = yes
PidFile = "/var/run/clamav/clamd.pid"
TemporaryDirectory = "/tmp"
ArchiveMaxCompressionRatio = 300
LocalSocket = "/var/run/clamav/clamd.sock"
MaxConnectionQueueLength = 30
MaxThreads = 50
ReadTimeout = 300
FixStaleSocket = yes
User = "defang"

/etc/freshclam.conf: freshclam directives
-----------------
PidFile = "/var/run/clamav/freshclam.pid"
DatabaseOwner = "defang"
Checks = 24
UpdateLogFile = "/var/log/clamav/freshclam.log"
DatabaseMirror = "db.gb.clamav.net"
NotifyClamd = "/etc/clamd.conf"


The log files just have the basics in them;

==> clamd.log <==
Tue Jan  6 21:40:09 2009 -> +++ Started at Tue Jan  6 21:40:09 2009
Tue Jan  6 21:40:09 2009 -> clamd daemon 0.90.3 (OS: linux-gnu, ARCH:
i386, CPU: i386)
Tue Jan  6 21:40:09 2009 -> Log file size limit disabled.
Tue Jan  6 21:40:09 2009 -> Reading databases from /var/lib/clamav

==> /var/log/messages <==
Jan  6 21:40:09 vs802 clamd[1633]: clamd daemon 0.90.3 (OS: linux-gnu,
ARCH: i386, CPU: i386)
Jan  6 21:40:09 vs802 clamd[1633]: Log file size limit disabled.
Jan  6 21:40:09 vs802 clamd[1633]: Reading databases
from /var/lib/clamav



Any ideas on what has happened and how to fix it?

(I am going to update the server fedora core 10 soon, which should give
me the new clamav packages - but for the moment I would just like to get
this working again)

Many Thanks,

T












_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml

[Dennis Peterson]

Tom H wrote:

> Hi,
>
> I have the 0.90.3 rpm from the fedora core 6 repos running on my fedora
> 6 box.
> It is running as the defang user, and has been running fine for a long
> while, however the clamd was restarted last night and mimedefang is
> complaining that there is no /var/run/clamav/clamd.sock file, and sure
> enough there is not. There is also no pid file also;
>
> It looks like the /etc/clamd.conf parses ok;
>
> [root@vs802 MIMEDefang]# clamconf -n
> /etc/clamd.conf: clamd directives
> -----------------
> LogFile = "/var/log/clamav/clamd.log"
> LogFileMaxSize = 0
> LogTime = yes
> LogVerbose = yes
> LogSyslog = yes
> PidFile = "/var/run/clamav/clamd.pid"
> TemporaryDirectory = "/tmp"
> ArchiveMaxCompressionRatio = 300
> LocalSocket = "/var/run/clamav/clamd.sock"
> MaxConnectionQueueLength = 30
> MaxThreads = 50
> ReadTimeout = 300
> FixStaleSocket = yes
> User = "defang"
>
> /etc/freshclam.conf: freshclam directives
> -----------------
> PidFile = "/var/run/clamav/freshclam.pid"
> DatabaseOwner = "defang"
> Checks = 24
> UpdateLogFile = "/var/log/clamav/freshclam.log"
> DatabaseMirror = "db.gb.clamav.net"
> NotifyClamd = "/etc/clamd.conf"

>
>
> Any ideas on what has happened and how to fix it?
>
> (I am going to update the server fedora core 10 soon, which should give
> me the new clamav packages - but for the moment I would just like to get
> this working again)
>

Does user "dfang" have read/write permissions in the /var/run/clamav
directory (and does that directory exist?).

dp
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml

[Gary V-2]

> Hi,
>
> I have the 0.90.3 rpm from the fedora core 6 repos running on my fedora
> 6 box.
> It is running as the defang user, and has been running fine for a long
> while, however the clamd was restarted last night and mimedefang is
> complaining that there is no /var/run/clamav/clamd.sock file, and sure
> enough there is not. There is also no pid file also;
>
> It looks like the /etc/clamd.conf parses ok;
>
> [root@vs802 MIMEDefang]# clamconf -n
> /etc/clamd.conf: clamd directives
> -----------------
> LogFile = "/var/log/clamav/clamd.log"
> LogFileMaxSize = 0
> LogTime = yes
> LogVerbose = yes
> LogSyslog = yes
> PidFile = "/var/run/clamav/clamd.pid"
> TemporaryDirectory = "/tmp"
> ArchiveMaxCompressionRatio = 300
> LocalSocket = "/var/run/clamav/clamd.sock"
> MaxConnectionQueueLength = 30
> MaxThreads = 50
> ReadTimeout = 300
> FixStaleSocket = yes
> User = "defang"
>
> /etc/freshclam.conf: freshclam directives
> -----------------
> PidFile = "/var/run/clamav/freshclam.pid"
> DatabaseOwner = "defang"
> Checks = 24
> UpdateLogFile = "/var/log/clamav/freshclam.log"
> DatabaseMirror = "db.gb.clamav.net"
> NotifyClamd = "/etc/clamd.conf"
>
>
> The log files just have the basics in them;
>
> ==> clamd.log <==
> Tue Jan 6 21:40:09 2009 -> +++ Started at Tue Jan 6 21:40:09 2009
> Tue Jan 6 21:40:09 2009 -> clamd daemon 0.90.3 (OS: linux-gnu, ARCH:
> i386, CPU: i386)
> Tue Jan 6 21:40:09 2009 -> Log file size limit disabled.
> Tue Jan 6 21:40:09 2009 -> Reading databases from /var/lib/clamav
>
> ==> /var/log/messages <==
> Jan 6 21:40:09 vs802 clamd[1633]: clamd daemon 0.90.3 (OS: linux-gnu,
> ARCH: i386, CPU: i386)
> Jan 6 21:40:09 vs802 clamd[1633]: Log file size limit disabled.
> Jan 6 21:40:09 vs802 clamd[1633]: Reading databases
> from /var/lib/clamav
>
>
>
> Any ideas on what has happened and how to fix it?
>
> (I am going to update the server fedora core 10 soon, which should give
> me the new clamav packages - but for the moment I would just like to get
> this working again)
>
> Many Thanks,
>
> T
>

 
This version of clamav is known to have issues loading current pattern databases. If you wait long enough after you start clamd, the socket will eventually get created, but I doubt you want to wait 15 minutes or so after each pattern update for the signatures to be loaded and the socket to be created. The only cure is to upgrade. Try running clamscan on a file and observe how long it takes.

Gary V
_________________________________________________________________
It’s the same Hotmail®. If by “same” you mean up to 70% faster.
http://windowslive.com/online/hotmail?ocid=TXT_TAGLM_WL_hotmail_acq_broad1_122008
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml