ClamAV==Clamscan??

[eagle]

I have installed the Mailscanner option on the CPanel downloads (Latest MailScanner installer [exim4 virus scanner] (unsupported):
mailscanner-autoinstall-1.5.tar.gz (Sat Aug 2 21:53:19 2003))

Recently, I see very high cpu states with the Clamscan process (sometimes 50%, which results in loads higher than 5 - 6)

Is it normal that the Clamscan process takes that much? Is there a way to lessen this (besides uninstalling :-))?

Thanks.
Sam

cPanel.net Support Ticket Number:

cPanel.net Support Ticket Number:

[Tina]

I am observing the same issue. Is anyone aware of what might be the problem/issue/resolution?

Thanks.

[eagle]

That's a shame , especially with those never ending worm attacks.

[casey]

Try upgrading to the latest mailscanner and using clamavmodule instead of clamav. That should reduce the load. It did for me.

[Snowman30]

upgraded to the latest and ran the perl module and ive found that all is ok then suddenly loads go thru the roof and the only fix is to killall -9 mailscanner and then restart mailscanner

anyone else found this or know of a solution???

Im running this on a hyperthreaded 3Ghz P4 with 2Gb ram so it should never have become an issue

[chirpy]

Just to check, did you do all the following steps:

You installed Mail::ClamAV:

/scripts/perlinstaller Mail::ClamAV

You then edited your /usr/mailscanner/etc/MailScanner.conf file and changed the line:

Virus Scanners = clamav

to:

Virus Scanners = clamavmodule

Then killed off all the MailScanner processes and restarted MailScanner?

Doing this should work, as it has for me on many servers and many others here.

[Snowman30]

Originally posted by chirpy
Just to check, did you do all the following steps:

You installed Mail::ClamAV:

/scripts/perlinstaller Mail::ClamAV

You then edited your /usr/mailscanner/etc/MailScanner.conf file and changed the line:

Virus Scanners = clamav

to:

Virus Scanners = clamavmodule

Then killed off all the MailScanner processes and restarted MailScanner?

Doing this should work, as it has for me on many servers and many others here.

Yes all done.

It works well for a while then suddenly with no warning loads go thru the roof and i have to killall and then restart it

happens at least 6 times a day

[jalons]

Anybody else having problems with Inline::C failing while trying to install the Mail::ClamAV option?

(sorry about the bump)

[Snowman30]

Originally posted by jalons
Anybody else having problems with Inline::C failing while trying to install the Mail::ClamAV option?

(sorry about the bump)

Yes getting the same sort of problem.

Starting "make" Stage
make[1]: Entering directory `/home/.cpan/build/Mail-ClamAV-0.08/_Inline/build/Mail/ClamAV'
/usr/bin/perl /usr/lib/perl5/5.8.1/ExtUtils/xsubpp -typemap /usr/lib/perl5/5.8.1/ExtUtils/typemap ClamAV.xs > ClamAV.xsc && mv ClamAV.xsc ClamAV.c
cc -c -I/home/.cpan/build/Mail-ClamAV-0.08 -I/usr/include -fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O3 -DVERSION=\"0.08\" -DXS_VERSION=\"0.08\" -fpic "-I/usr/lib/perl5/5.8.1/i686-linux/CORE" ClamAV.c
ClamAV.xs: In function `clamav_perl__scanbuff':
ClamAV.xs:140: warning: passing arg 3 of `cl_scanbuff' from incompatible pointer type
ClamAV.xs: In function `clamav_perl__scanfd':
ClamAV.xs:180: warning: passing arg 2 of `cl_scandesc' from incompatible pointer type
ClamAV.xs: In function `clamav_perl__scanfile':
ClamAV.xs:216: warning: passing arg 2 of `cl_scanfile' from incompatible pointer type
ClamAV.xs: In function `clamav_perl_constant':
ClamAV.xs:274: `CL_OLE2' undeclared (first use in this function)
ClamAV.xs:274: (Each undeclared identifier is reported only once
ClamAV.xs:274: for each function it appears in.)
ClamAV.xs:275: `CL_ENCRYPTED' undeclared (first use in this function)
make[1]: *** [ClamAV.o] Error 1
make[1]: Leaving directory `/home/.cpan/build/Mail-ClamAV-0.08/_Inline/build/Mail/ClamAV'

A problem was encountered while attempting to compile and install your Inline
C code. The command that failed was:
make

The build directory was:
/home/.cpan/build/Mail-ClamAV-0.08/_Inline/build/Mail/ClamAV

To debug the problem, cd to the build directory, and inspect the output files.

at /home/.cpan/build/Mail-ClamAV-0.08/blib/lib/Mail/ClamAV.pm line 150
BEGIN failed--compilation aborted at /home/.cpan/build/Mail-ClamAV-0.08/blib/lib/Mail/ClamAV.pm line 429.
Compilation failed in require.
BEGIN failed--compilation aborted.
make: *** [ClamAV.inl] Error 2
/usr/bin/make -- NOT OK
Running make install
make had returned bad status, install seems impossible
perlmod--Install done

so i tried reinstalling Inline::C but it made no difference.

anyone have a fix for it?

[eagle]

I had the same problem. Only reinstalling with the autoinstaller and with these :


This is a revised howto from the one posted by anand at the cPanel forums.
http://forums.cpanel.net/showthread....ghlight=clamav

If you already have MailScanner installed:
1) cd mailscanner-autoinstall-1.5
2) ./uninstall

If not, start here:
1) Install the following perl modules from WHM:
Net::CIDR
Inline
2) wget http://layer1.cpanel.net/mailscanner...all-1.5.tar.gz
3) tar -xzvf mailscanner-autoinstall-1.5.tar.gz
4) cd mailscanner-autoinstall-1.5
5) wget http://www.sng.ecs.soton.ac.uk/mails....28.6-1.tar.gz
6) mv MailScanner-4.28.6-1.tar.gz MailScanner-4.28.6.tar.gz
7) pico install
8) Change QUOTE
$version = "4.22-5";
to QUOTE
$version = "4.28.6";

9) ctrl-x to save
10) wget http://twtelecom.dl.sourceforge.net/...0.70-rc.tar.gz
11) pico claminstall
12) Go to line 10, and replace tar xfzv clamav-0.60.tar.gz with tar xfzv clamav-0.70-rc.tar.gz
On line 11, replace cd clamav-0.60 with cd clamav-0.70-rc
13) ctrl-x to save


directions (from http://forum.cpanelhosts.com/index.p...f=2&t=299&st=0)



and than manually (not through whm) installing mail::clamav did it. But now I get a lot of defuncts and hanging mailscanner processes, so I shut it down to avoid enormous loads.

[eagle]

I've deinstalled mailscanner. I'm sick of the loads and Mail::ClamAv doens't seem to work (the virus warnings suddenly stopped as where I received a couple in an hour before.

Does anyone know of another scanner, which doesn't take so much load???

[perlchild]

Originally posted by eagle
I have installed the Mailscanner option on the CPanel downloads (Latest MailScanner installer [exim4 virus scanner] (unsupported):
mailscanner-autoinstall-1.5.tar.gz (Sat Aug 2 21:53:19 2003))

Recently, I see very high cpu states with the Clamscan process (sometimes 50%, which results in loads higher than 5 - 6)

Is it normal that the Clamscan process takes that much? Is there a way to lessen this (besides uninstalling :-))?

Thanks.
Sam

cPanel.net Support Ticket Number:

cPanel.net Support Ticket Number:

Another idea would be to use clamdscan instead, since libclamav is a bit recent

I'm not 100% sure on how to do this yet, I'll have to post a thread on the mailscanner forum/mailing list
if anyone beats me there, please post a pointer here...

[anand]

Originally posted by perlchild
Another idea would be to use clamdscan instead, since libclamav is a bit recent

I'm not 100% sure on how to do this yet, I'll have to post a thread on the mailscanner forum/mailing list
if anyone beats me there, please post a pointer here...

An extract from clamav website

http://clamav.sourceforge.net/doc/0.70/html/node19.html

Clamdscan

it can't use external unpackers


So what happens to attachment scanning ?

[anand]

hmmm...

Another extract from clam website

All ClamAV scanners depend on LibClamAV. It has a built-in support for the following formats:
Zip
Gzip
Bzip2
RAR (2.0 only)


Probably answer to my own question

[eagle]

Just decided to reinstall the thing and start from scratch again (well, only the mailscanner thing ).

The result is :

http://forums.cpanel.net/showthread....509#post108509