[clamav-users] Problem with Max Open desciptor Files limit
Jason J. W. Williams
jasonjwwilliams at gmail.com
Fri Jan 26 15:22:03 UTC 2018
Good find David. Thank you very much.
-J
On Fri, Jan 26, 2018 at 7:18 AM, David Shrimpton <d.shrimpton at its.uq.edu.au>
wrote:
> I found adding Vbs.Downloader.Generic-6431223-0 to local.ign2 and
> restarting clamd fixed the problem.
>
> This sig turned up in an update at 11:51AM GMT+10 26/1/2018 and problem
> began a few minutes later
> clamd run out of file descriptors.
>
> I also had to clean out TemporaryDirectory before restarting.
>
> Not sure what the exact reason for problem is.
>
> There is an EOF-15 in a subsig. Perhaps this causes a performance hit on
> large text files as end
> of file must be seeked to and this is sufficient on busy system to cause
> demand to exceed supply.
>
> sigtool --find Vbs.Downloader.Generic-6431223-0
> Vbs.Downloader.Generic-6431223-0;Engine:51-255,Target:7;(0|1)&2&3;0:
> 207075626c69632073756220;0:2073756220;EOF-15:
> 203d202272652220656e6420696620;657865202f63207374617274
>
> sigtool --find Vbs.Downloader.Generic-6431223-0 | sigtool --decode-sigs
> VIRUS NAME: Vbs.Downloader.Generic-6431223-0
> TDB: Engine:51-255,Target:7
> LOGICAL EXPRESSION: (0|1)&2&3
> * SUBSIG ID 0
> +-> OFFSET: 0
> +-> SIGMOD: NONE
> +-> DECODED SUBSIGNATURE:
> public sub
> * SUBSIG ID 1
> +-> OFFSET: 0
> +-> SIGMOD: NONE
> +-> DECODED SUBSIGNATURE:
> sub
> * SUBSIG ID 2
> +-> OFFSET: EOF-15
> +-> SIGMOD: NONE
> +-> DECODED SUBSIGNATURE:
> = "re" end if
> * SUBSIG ID 3
> +-> OFFSET: ANY
> +-> SIGMOD: NONE
> +-> DECODED SUBSIGNATURE:
> exe /c start
>
>
>
>
> David Shrimpton
>
> ________________________________________
> From: clamav-users <clamav-users-bounces at lists.clamav.net> on behalf of
> Carlos García Gómez <carlos.garcia at f-integra.org>
> Sent: Saturday, January 27, 2018 12:03:32 AM
> To: clamav-users at lists.clamav.net
> Subject: [clamav-users] Problem with Max Open desciptor Files limit
>
> Hi,
>
> We have a problem with ClamAV due to Max Open desciptor Files limit
> It’s seems like delete temp files are not freeded
> When the soft is reached the clamav proccess responses with an ERROR
>
> THe problem has begined Today with 0.99.2 clamav version
> We have updated to the last release 0.99.3 but then problem again be here.
>
>
>
> [root at mx2 tmp]# ps -ef |grep clamav
> clamav 22927 1 0 13:50 ? 00:00:00
> /home/vmail/antivirus/clamav/bin/freshclam -d
> root 23128 21677 0 15:01 pts/1 00:00:00 grep clamav
> clamav 23137 1 2 13:51 ? 00:01:39
> /home/vmail/antivirus/clamav/sbin/clamd
>
>
> [root at mx2 tmp]# lsof -p 23137
> COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
> clamd 23137 clamav cwd DIR 8,1 4096 2 /
> clamd 23137 clamav rtd DIR 8,1 4096 2 /
> clamd 23137 clamav txt REG 8,2 330823 1507346
> /home/vmail/antivirus/clamav-0.99.3/sbin/clamd
> clamd 23137 clamav 11u REG 8,2 46 1540613
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 40e1c3eb5c91506cd8029a626d44e430.tmp (deleted)
> clamd 23137 clamav 12u REG 8,2 119 1540264
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 6191bbf55622fa150f6a562fedaa96bf.tmp (deleted)
> clamd 23137 clamav 13u REG 8,2 119 1540266
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> d23444b929c3e8f70b245d0f7df9c64e.tmp (deleted)
> clamd 23137 clamav 14u REG 8,2 36 1540265
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 0323a84d6821a592bccefde5a36c0bb4.tmp (deleted)
> clamd 23137 clamav 15u REG 8,2 4793 1540268
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> a08b30fcf5ca4cbc35089753a49b688f.tmp (deleted)
> clamd 23137 clamav 16u REG 8,2 4793 1540267
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 8fa41cdf16f7e03e3fef00fa7faefe66.tmp (deleted)
> clamd 23137 clamav 17u REG 8,2 58 1540270
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 8106966405936ecc207ceb37377b2be5.tmp (deleted)
> clamd 23137 clamav 18u REG 8,2 183 1540272
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 6f395db61ea80440bbcdcccf8c1fd87e.tmp (deleted)
> clamd 23137 clamav 19u REG 8,2 293 1540273
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 4d454dfbedfa70c192000a2cc021a0e9.tmp (deleted)
> clamd 23137 clamav 20u REG 8,2 183 1540271
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> d7b9350895ea3c7c16a95810da93cbcd.tmp (deleted)
> clamd 23137 clamav 21u REG 8,2 3137 1540274
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 61ead91328b1a1fb2eed66e0092fab37.tmp (deleted)
> clamd 23137 clamav 22u REG 8,2 3137 1540276
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> ea8e77c7746f4e20efa08dd714e3bab1.tmp (deleted)
> clamd 23137 clamav 23u REG 8,2 42 1540275
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 6dc27ea80d232f5cf3354a7a3c8ec58d.tmp (deleted)
> clamd 23137 clamav 24u REG 8,2 44 1540277
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> fee6d1b3d366eda4e15f5ff8416bc606.tmp (deleted)
> clamd 23137 clamav 25u REG 8,2 677 1540279
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 2b9716c6173771c795a3b1c3bef56470.tmp (deleted)
> clamd 23137 clamav 26u REG 8,2 155 1540280
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> e63b9a7454908ebb5f47657898bdb2c5.tmp (deleted)
> clamd 23137 clamav 27u REG 8,2 1681 1540281
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> ba047ebfc0396a5b38b595eeec0f7437.tmp (deleted)
> clamd 23137 clamav 28u REG 8,2 46 1540278
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 49dbcc76c3c8b14d279a9d0aa74310a1.tmp (deleted)
> clamd 23137 clamav 29u REG 8,2 1681 1540283
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 46898158d350efefbe01636215301fad.tmp (deleted)
> clamd 23137 clamav 30u REG 8,2 48 1540282
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> fdc1f1fdaca0933e22778c22bf4306c2.tmp (deleted)
> clamd 23137 clamav 31u REG 8,2 1235 1540285
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 3849f6d05e67f2ad565d668e9a925158.tmp (deleted)
> clamd 23137 clamav 32u REG 8,2 38 1540284
> /home/vmail/antivirus/clamav-0.99.3/var/tmp/clamav-
> 9428301ea35432270076585aad066354.tmp (deleted)
>
> When there are 1024 FD => ClamAV crash
>
> Any Ideas?
>
> Regards.
>
>
>
>
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
More information about the clamav-users
mailing list