Mailing List Archive: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail

[clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail

Nov 13, 2019, 2:19 AM

Post #1 of 7 (634 views)

Hello,

I get the following error a few times a day for a while, so I thought I
would look into it.

I am using mimedefang to send mail to clamd and it works fine, but at
random point of the day I get the error:

mimedefang.pl[26234]: xAD8PbeZ009878: Timeout reading from clamd daemon
at /var/spool/MIMEDefang/clamd.sock
mimedefang.pl[26234]: xAD8PbeZ009878: Problem running virus scanner:
code=999, category=cannot-execute,

The problem is clamd has not being sent any other mails so don't see it
is a queuing problem.

For example I added a debug in mimedefang when it sends data to clamd:

mail 1) Nov 13 08:19:10 mimedefang send data to clamd
mail 1) Nov 13 08:19:11 mimedefang receives an answer
mail 2) Nov 13 08:25:38 mimedefang send data to clamd
mail 2) Nov 13 08:26:38 Timeout reading from clamd daemon at
/var/spool/MIMEDefang/clamd.sock YES! 60 seconds
mail 2) Nov 13 08:26:38 mimedefang tries again
mail 2) Nov 13 08:26:38 mimedefang gets error: Problem running virus
scanner: code=999, category=cannot-execute, action=tempfail
mail 3) Nov 13 08:28:21 works again

So, my question is there any tracing I can put in place so that I can
see what clamd is doing at this time. I looked at clamdtop but that show
live information so no good. At this time the email it breaks on is
randon and small.

Thanks,

Andrew

--
Andrew Watkins * Birkbeck, University of London * Computer Science *
* http://notallmicrosoft.blogspot.com *
* UKOUG Systems *
* UKOUG Tech committee *
* tel: 020 7631 6720 *

::e-mails are only read & actioned between 0900 and 1730 hours (Monday - Friday)

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail [ In reply to ]

clamav-users at lists

Nov 13, 2019, 2:26 AM

Post #2 of 7 (634 views)

Permalink

On 13/11/2019 12:19, Andrew Watkins via clamav-users wrote:
> Hello,
>
> I get the following error a few times a day for a while, so I thought
> I would look into it.
>
> I am using mimedefang to send mail to clamd and it works fine, but at
> random point of the day I get the error:
>
> mimedefang.pl[26234]: xAD8PbeZ009878: Timeout reading from clamd
> daemon at /var/spool/MIMEDefang/clamd.sock
> mimedefang.pl[26234]: xAD8PbeZ009878: Problem running virus scanner:
> code=999, category=cannot-execute,
>
> The problem is clamd has not being sent any other mails so don't see
> it is a queuing problem.
>
> For example I added a debug in mimedefang when it sends data to clamd:
>
> mail 1) Nov 13 08:19:10 mimedefang send data to clamd
> mail 1) Nov 13 08:19:11 mimedefang receives an answer
> mail 2) Nov 13 08:25:38 mimedefang send data to clamd
> mail 2) Nov 13 08:26:38 Timeout reading from clamd daemon at
> /var/spool/MIMEDefang/clamd.sock YES! 60 seconds
> mail 2) Nov 13 08:26:38 mimedefang tries again
> mail 2) Nov 13 08:26:38 mimedefang gets error: Problem running virus
> scanner: code=999, category=cannot-execute, action=tempfail
> mail 3) Nov 13 08:28:21 works again
>
> So, my question is there any tracing I can put in place so that I can
> see what clamd is doing at this time. I looked at clamdtop but that
> show live information so no good. At this time the email it breaks on
> is randon and small.

Check if it's coinciding with clamd reloading its databases. Clamd
currently doesn't scan when reloading databases.

Look for:

Nov 13 11:37:04 clamd clamd[15795]: SelfCheck: Database modification
detected. Forcing reload.
Nov 13 11:37:04 clamd clamd[15795]: Reading databases from /var/lib/clamav
Nov 13 11:37:56 clamd clamd[15795]: Database correctly reloaded
(13057843 signatures)

Good luck,
Reio

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail [ In reply to ]

clamav-users at lists

Nov 13, 2019, 2:33 AM

Post #3 of 7 (634 views)

Permalink

Hi there,

On Wed, 13 Nov 2019, Andrew Watkins via clamav-users wrote:

> I get the following error a few times a day for a while, so I thought I
> would look into it.
>
> I am using mimedefang to send mail to clamd and it works fine, but at
> random point of the day I get the error:
>
> mimedefang.pl[26234]:? xAD8PbeZ009878: Timeout reading from clamd daemon
> at /var/spool/MIMEDefang/clamd.sock

Perhaps clamd is reloading its databases when you see this. Depending
on configuration and the host performance it can take anywhere between
a few tens of seconds and several minutes to reload all the databases,
and during that time currently released versions of clamd won't scan.
Check the logs for the reload messages. There's a patch currently in
testing which permits clamd to continue scanning while reloading, the
patch is available if you wish to build clamd yourself, and it should
be available in a released version of clamd quite soon I hope. There
has been some discussion on this list recently if you'd like to look.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail [ In reply to ]

clamav-users at lists

Nov 13, 2019, 2:35 AM

Post #4 of 7 (634 views)

Permalink

On 11/13/19 10:26 AM, Reio Remma via clamav-users wrote:
> On 13/11/2019 12:19, Andrew Watkins via clamav-users wrote:
>
> Check if it's coinciding with clamd reloading its databases. Clamd
> currently doesn't scan when reloading databases.
>
> Look for:
>
> Nov 13 11:37:04 clamd clamd[15795]: SelfCheck: Database modification
> detected. Forcing reload.
> Nov 13 11:37:04 clamd clamd[15795]: Reading databases from
> /var/lib/clamav
> Nov 13 11:37:56 clamd clamd[15795]: Database correctly reloaded
> (13057843 signatures)
>
> Good luck,
> Reio
>
Thanks, but should have said.

Reload takes place at 10 mins past the hour, but saying that most errors
are between 11 to 29 past the hour. Will look again...

Andrew

--
Andrew Watkins * Birkbeck, University of London * Computer Science *
* http://notallmicrosoft.blogspot.com *
* UKOUG Systems *
* UKOUG Tech committee *
* tel: 020 7631 6720 *

::e-mails are only read & actioned between 0900 and 1730 hours (Monday - Friday)

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail [ In reply to ]

clamav-users at lists

Nov 13, 2019, 2:39 AM

Post #5 of 7 (634 views)

Permalink

On 11/13/19 10:33 AM, G.W. Haywood via clamav-users wrote:
>
> Perhaps clamd is reloading its databases when you see this. Depending
> on configuration and the host performance it can take anywhere between
> a few tens of seconds and several minutes to reload all the databases,
> and during that time currently released versions of clamd won't scan.
> Check the logs for the reload messages.? There's a patch currently in
> testing which permits clamd to continue scanning while reloading, the
> patch is available if you wish to build clamd yourself, and it should
> be available in a released version of clamd quite soon I hope. There
> has been some discussion on this list recently if you'd like to look.
>
Ah! I had read that discussion, but didn't put 2 and 2 together since I
thought the database re-load had finished, but I think it may be this. I
will look at download and build patched version.

Cheers,

Andrew

--
Andrew Watkins * Birkbeck, University of London * Computer Science *
* http://notallmicrosoft.blogspot.com *
* UKOUG Systems *
* UKOUG Tech committee *
* tel: 020 7631 6720 *

::e-mails are only read & actioned between 0900 and 1730 hours (Monday - Friday)

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail [ In reply to ]

clamav-users at lists

Nov 13, 2019, 4:21 AM

Post #6 of 7 (634 views)

Permalink

Hi there,

On Wed, 13 Nov 2019, Andrew Watkins via clamav-users wrote:
> On 11/13/19 10:33 AM, G.W. Haywood via clamav-users wrote:
>>
>> Perhaps clamd is reloading its databases when you see this. Depending
>> on configuration and the host performance it can take anywhere between
>> a few tens of seconds and several minutes to reload all the databases...
>>
> Ah! I had read that discussion, but didn't put 2 and 2 together since I
> thought the database re-load had finished, but I think it may be this. I will
> look at download and build patched version.

You could of course just increase your timeouts. :)

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail [ In reply to ]

clamav-users at lists

Nov 14, 2019, 2:57 AM

Post #7 of 7 (628 views)

Permalink

On 11/13/19 10:39 AM, Andrew Watkins via clamav-users wrote:
>
> On 11/13/19 10:33 AM, G.W. Haywood via clamav-users wrote:
>>
>> Perhaps clamd is reloading its databases when you see this. Depending
>> on configuration and the host performance it can take anywhere between
>> a few tens of seconds and several minutes to reload all the databases,
>> and during that time currently released versions of clamd won't scan.
>> Check the logs for the reload messages.? There's a patch currently in
>> testing which permits clamd to continue scanning while reloading, the
>> patch is available if you wish to build clamd yourself, and it should
>> be available in a released version of clamd quite soon I hope. There
>> has been some discussion on this list recently if you'd like to look.
>>
> Ah! I had read that discussion, but didn't put 2 and 2 together since
> I thought the database re-load had finished, but I think it may be
> this. I will look at download and build patched version.
>
Thanks! I installed latest devel version "ClamAV
0.103.0-devel-20191113/25633/Thu Nov 14 09:50:04 2019" and have not had
any errors in 24hours.

Will keep it running to see if any other problems with next release.
Anyway, great work.

Andrew

--
Andrew Watkins * Birkbeck, University of London * Computer Science *
* http://notallmicrosoft.blogspot.com *
* UKOUG Systems *
* UKOUG Tech committee *
* tel: 020 7631 6720 *

::e-mails are only read & actioned between 0900 and 1730 hours (Monday - Friday)

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml