[clamav-users] URGENT: Clamd is wedged on multiple installations

Ralf Hildebrandt Ralf.Hildebrandt at charite.de
Fri Jan 26 09:39:32 UTC 2018


* Dianne Skoll <dfs at roaringpenguin.com>:
> Hi,
> 
> Something went badly wrong with clamd recently; it's stuck with
> hundreds/thousands of open files per process and interrupting mail flow.
> 
> When a scanning thread finishes, I see this in the strace output.
> (I ran clamdscan /etc/hosts as a test):
> 
> [pid  3707] 02:11:01 sendto(295, "/etc/hosts: OK\n", 15, 0, NULL, 0) = 15
> [pid  3707] 02:11:01 shutdown(295, SHUT_RDWR) = 0
> [pid  3707] 02:11:01 close(295)         = 0
> [pid  3707] 02:11:01 futex(0x1933c3c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 387, {1516950691, 0}, ffffffff) = -1 ETIMEDOUT (Connection timed out)
> [pid  3707] 02:11:31 futex(0x1933c10, FUTEX_WAKE_PRIVATE, 1) = 0
> [pid  3707] 02:11:31 madvise(0x7fae6affe000, 8368128, MADV_DONTNEED) = 0
> [pid  3707] 02:11:31 _exit(0)           = ?
> [pid  3707] 02:11:31 +++ exited with 0 +++

clamd is leaking filedescriptors for temporary files - ls /proc/`pidof clamd`/fd shows a
lot of:

lrwx------ 1 root root 64 Jan 26 10:38 993 -> /tmp/clamav-736a3d0d2a944a0a79d465671fb754d5.tmp (deleted)
lrwx------ 1 root root 64 Jan 26 10:38 994 -> /tmp/clamav-59b5548fe87bc9a454486cbe37d5c89b.tmp (deleted)
lrwx------ 1 root root 64 Jan 26 10:38 995 -> /tmp/clamav-0e2983c3f35c37d833ea37c2867a0aba.tmp (deleted)
...

-- 
Ralf Hildebrandt                   Charite Universitätsmedizin Berlin
ralf.hildebrandt at charite.de        Campus Benjamin Franklin
https://www.charite.de             Hindenburgdamm 30, 12203 Berlin
Geschäftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20180126/d0242fa6/attachment.sig>


More information about the clamav-users mailing list