av_scanner = clamd:/var/clamd Options

[Patrick]

Hi Pairote,

Thanks for your great script and have been using for awhile. Recently...

I have encountered alot of high spamd load and clamd failure in cpanel.

2007-05-04 14:57:29 1HjrhO-00057M-NY spam acl condition: error reading from spamd socket: Connection timed out
2007-05-04 20:46:16 1HjxAt-0004cV-Ub malware acl condition: clamd: unable to connect to UNIX socket /var/clamd (No such file or directory)

Did most of the stuff that cpanel forum had recommended but nothing helps.

Eventually my support resolved it and he described

" There was also a condition in your "Exim Configuration Editor" that appeared to either be a bit of legacy information, or it was added outside of the cPanel setup of clamav. This was causing clamd to fail. I removed this line and restarted your services. Things should be working properly now."

Yeah..nothing to detail I know, but I checked and realised that the line

"av_scanner = clamd:/var/clamd"

is no longer in exim.conf and everything is fine now.

Not sure if this is going to be useful for you.

Have a good day.

Patrick

[pairote]

Does virus scanning still work after removing av_scanner line?

Install script at http://forums.rvskin.com/index.php?s=&...post&p=5242 and check your stat.

[Patrick]

I went back in to check the logs and noticed that exim was defaulting to sophie ( because it kept saying that it could not find it.)

The problem was actually due to the SA rules as mentioned in

http://forums.cpanel.net/showthread.php?t=65838

Deleting all the .cf files resolved the problem.

I had then added the av_scanner = clamd:/var/clamd line back in and everything is working nice and dandy.

Thanks for asking.

[aarondwyer]

Hi Pariote

I also have this problem.

From the /var/log/exim_mainlog

2007-07-13 22:01:26 1I9Jpu-0002bH-A3 malware acl condition: clamd: unable to connect to UNIX socket /var/clamd (No such file or directory)

I've got all the SARE rules that you have in the tutorial in place.

This is occurring on both the machine that I installed the script on myself and on the machine that you installed for me.

Lost for what to do to fix it.? Any ideas?

Thanks
Aaron

[pairote]

Does the error occur several times an hour or just few times?

[aarondwyer]

Does the error occur several times an hour or just few times?

Many, many times, I think it could be on every legitimate email that gets delivered.

It was working until the 11Jul, now it's not. Strange.

I've just tried again on my new install that I did (not your original one) and it's now working and not complaining.

Jury is still out on what's going on with my other server.

Aaron

[pairote]

Make sure you have "av_scanner = clamd:/var/clamd" on the first box in EXIM advanced editor.

[aarondwyer]

Yes I have that line.

But I don't have a /var/clamav directory

or a /var/clamd file

This is very strange since this is on the server that you did the install on.

Cpanel still says that clamav is installed.

How do I know if clam is installed.?

Thanks
Aaron

[aarondwyer]

I'm still getting this error.

How do I know if clam is installed correctly.?

This was working Pariote after you setup the server the other week, but it's not so I'm trying to figure this out.

Perhaps an automatic update has affected it.

Thanks
Aaron

[dev_cw]

Make sure you have "av_scanner = clamd:/var/clamd" on the first box in EXIM advanced editor.

Actually you may need to remove this line from the first block. You will notice that the new exim.conf has this hard codded and they seem to be conflicting.

At least this is what I needed to do.