[clamav-users] Problem running virus scanner: code=999, category=cannot-execute, action=tempfail

[Reio Remma]

On 13/11/2019 12:19, Andrew Watkins via clamav-users wrote:
> Hello,
>
> I get the following error a few times a day for a while, so I thought 
> I would look into it.
>
> I am using mimedefang to send mail to clamd and it works fine, but at 
> random point of the day I get the error:
>
> mimedefang.pl[26234]:  xAD8PbeZ009878: Timeout reading from clamd 
> daemon at /var/spool/MIMEDefang/clamd.sock
> mimedefang.pl[26234]:  xAD8PbeZ009878: Problem running virus scanner: 
> code=999, category=cannot-execute,
>
> The problem is clamd has not being sent any other mails so don't see 
> it is a queuing problem.
>
> For example I added a debug in mimedefang when it sends data to clamd:
>
> mail 1) Nov 13 08:19:10 mimedefang send data to clamd
> mail 1) Nov 13 08:19:11 mimedefang receives an answer
> mail 2) Nov 13 08:25:38 mimedefang send data to clamd
> mail 2) Nov 13 08:26:38 Timeout reading from clamd daemon at 
> /var/spool/MIMEDefang/clamd.sock YES! 60 seconds
> mail 2) Nov 13 08:26:38 mimedefang tries again
> mail 2) Nov 13 08:26:38 mimedefang gets error: Problem running virus 
> scanner: code=999, category=cannot-execute, action=tempfail
> mail 3) Nov 13 08:28:21 works again
>
> So, my question is there any tracing I can put in place so that I can 
> see what clamd is doing at this time. I looked at clamdtop but that 
> show live information so no good. At this time the email it breaks on 
> is randon and small. 

Check if it's coinciding with clamd reloading its databases. Clamd 
currently doesn't scan when reloading databases.

Look for:

Nov 13 11:37:04 clamd clamd[15795]: SelfCheck: Database modification 
detected. Forcing reload.
Nov 13 11:37:04 clamd clamd[15795]: Reading databases from /var/lib/clamav
Nov 13 11:37:56 clamd clamd[15795]: Database correctly reloaded 
(13057843 signatures)

Good luck,
Reio