[clamav-users] What causes ClamMisc to fail scanning?

[G.W. Haywood]

Hi there,

On Wed, 22 Sep 2021, dee heffemm via clamav-users wrote:

> I'm trying to setup ClamAV on a host running Apache and Phusion Passenger.
> After bringing up clamd and clamonacc, connecting to the Passenger app (web
> browser on 443) will result in various "Daemon failed to scan" and "Not a
> regular file ERROR" messages in the logs. It's not always the same file and
> seems to be differ every time the machine is restarted.
>
> The file having trouble has 0664 perms and is owned by passenger:passenger

I don't use on-access scanning so I have little personal experience to
go on, but I suspect that you may be seeing the result of files being
modified while you are concurrently trying to scan them.  Be aware in
a multi-user, multi-tasking operating system that things don't always
happen in the sequence most convenient to you.  Often it's the least
convenient (and there I *do* have experience :) and you may need to
implement some kind of locking, semaphores, or other inter-process
communications to avoid tripping over your own feet.

> If I add clamav to the 'passenger' group, the whole VM becomes unresponsive
> when the app is connected to.

This sounds like a different issue and probably should be in its own thread.

> If I clamscan the file having trouble in the logs, everything seems to be
> OK. Any thoughts?

I would suggest that if you're investigating problems with scanning by
clamd, which is what clamonacc uses for the scanning, then clamdscan
might be better a better choice than clamscan for the investigations.

-- 

73,
Ged.