[clamav-users] 0.100.1 issues - allocation memory / pthread create failed

Tue Oct 9 00:17:08 UTC 2018

Sorry no I'm not suggesting that 0.100.0 would be more stable.  My phrasing could've been more precise.  I was just trying to confirm that the issue didn't appear for you between 0.100.0 and 0.100.1.  You should certainly upgrade to 0.100.2 though when you get the chance because it fixes a few security bugs.

Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.

On Oct 8, 2018, at 5:16 PM, Jamal Saleh <jsaleh at TSDWEB.COM<mailto:jsaleh at TSDWEB.COM>> wrote:

We felt the 0.100.1 was the right move as we used it in QA for a couple of weeks without issue.  But production obviously has more volume.  But yes, we went directly to 0.100.1 from 0.99.2.  So are you saying that 0.100.0 might be more stable or do you suggest possibly moving to 0.100.2?

Thanks!

From: clamav-users <clamav-users-bounces at lists.clamav.net<mailto:clamav-users-bounces at lists.clamav.net>> On Behalf Of Micah Snyder (micasnyd)
Sent: Monday, October 8, 2018 5:12 PM
To: ClamAV users ML <clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>>
Subject: Re: [clamav-users] 0.100.1 issues - allocation memory / pthread create failed

Oh, Windows!  This is not what I was expecting at all.  OnAccess-scanning isn't available for Windows at all at this time anyhow so it's clearly not that!  Silly me.

Did you have the issue with 0.100.0, or did you switch immediately from 0.99.2 to 0.100.1?

Since 0.100.0 there have been a number of reports with reallocation issues but not widespread and we haven't tracked down the cause yet:
Namely, https://bugzilla.clamav.net/show_bug.cgi?id=12129
also, https://bugzilla.clamav.net/show_bug.cgi?id=12183

Perhaps the issue you're seeing is related.

Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.

On Oct 8, 2018, at 2:46 PM, Jamal Saleh <jsaleh at TSDWEB.COM<mailto:jsaleh at TSDWEB.COM>> wrote:

So we have this running as an instream active service with a pretty decent volume.  We inherited the application from a previous developer so the detailed technical understanding isn’t there, but we’ve modified the basic parameters like max threads, stream size plus additional logging parameters for debugging and continuous signature updates.  We initially tried to use the Cisco provided build but it would not run as a Windows service.  The build we used is the ClamAV Antivirus Native Win32 Port - 0.100.1 located here - http://oss.netfarm.it/clamav/ but it was until we used 0.100.1 that the logs started to producing the memory allocation errors, then we’d stop processing threads all together.

From: clamav-users <clamav-users-bounces at lists.clamav.net<mailto:clamav-users-bounces at lists.clamav.net>> On Behalf Of Micah Snyder (micasnyd)
Sent: Monday, October 8, 2018 2:36 PM
To: ClamAV users ML <clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>>
Subject: Re: [clamav-users] 0.100.1 issues - allocation memory / pthread create failed

If you are using clamd's on-access scanning feature, this may be a result of the issue with the "OnAccessExtraScanning" option that prompted us to disable extra-scanning in 0.100.2 (and the upcoming 0.101) until we have the thread resource issue with extra-scanning resolved.

https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html
https://bugzilla.clamav.net/show_bug.cgi?id=12048#c5

Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.

On Oct 8, 2018, at 12:41 PM, G.W. Haywood <clamav at jubileegroup.co.uk<mailto:clamav at jubileegroup.co.uk>> wrote:

Hi there,

On Mon, 8 Oct 2018, Jamal Saleh wrote:

...
Can't allocate memory ERROR
ERROR: pthread_create failed

Looking to get help on the aforementioned errors.  On version 0.99.2
we had no issues but once we went to this version, we''ve processing
outages and only a server restart / unload would resolve the issue.
Any help would be appreciated, but the configs are basically default
aside from the advanced logging values we have set.  The servers are
never taxes nor does the traffic seem to peek when this occurs -
happens at random times but every few days.
...

Your description sounds to me like the sypmtoms of a memory leak.  To
begin with I'd put something like this

* * * * * /bin/date >> /tmp/clamstats.log ; /usr/bin/top -b -n1 | /bin/grep clam >> /tmp/clamstats.log

in the crontab.  It's unclear to me if ClamAV is the problem or not,
and this at least ought to tell you something.

--

73,
Ged.
_______________________________________________
clamav-users mailing list
clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20181009/d6b1171f/attachment.htm>