strange messages log

[perica]

Hi everyone,

last night I done server setup with Cpanel / CENTOS 5.2 i686 (PowerEdge 2650 server). Today i notice strange messages log. Does anyone know what could be the problem?

Thanks...

Jan 19 20:06:52 galaxy kernel: audit(1232392012.104:1028): avc:  denied  { read } for  pid=17514 comm="clamd" name="1LOzSU-0004YT-Mo" dev=sda6 ino=160414 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir
Jan 19 20:06:52 galaxy kernel: audit(1232392012.105:1029): avc:  denied  { getattr } for  pid=17514 comm="clamd" path="/var/spool/exim/scan/1LOzSU-0004YT-Mo/1LOzSU-0004YT-Mo.eml" dev=sda6 ino=160416 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
Jan 19 20:06:52 galaxy kernel: audit(1232392012.105:1030): avc:  denied  { read } for  pid=17514 comm="clamd" name="1LOzSU-0004YT-Mo.eml" dev=sda6 ino=160416 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
Jan 19 20:10:37 galaxy pure-ftpd: ([email protected]) [INFO] New connection from 127.0.0.1
Jan 19 20:10:43 galaxy kernel: audit(1232392243.333:1031): avc:  denied  { read } for  pid=18272 comm="clamd" name="1LOzWC-0004kf-Cl" dev=sda6 ino=160414 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir
Jan 19 20:10:43 galaxy kernel: audit(1232392243.334:1032): avc:  denied  { getattr } for  pid=18272 comm="clamd" path="/var/spool/exim/scan/1LOzWC-0004kf-Cl/1LOzWC-0004kf-Cl.eml" dev=sda6 ino=160416 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
Jan 19 20:10:43 galaxy kernel: audit(1232392243.334:1033): avc:  denied  { read } for  pid=18272 comm="clamd" name="1LOzWC-0004kf-Cl.eml" dev=sda6 ino=160416 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
Jan 19 20:10:48 galaxy pure-ftpd: ([email protected]) [INFO] __cpanel__service__auth__ftpd__5n8dgUFwdmy4HIvLul2GYVo8RhXchLahYCr570kNuew_UtYLqJ9Bbb24oFqeMAw3 is now logged in
Jan 19 20:10:49 galaxy pure-ftpd: (__cpanel__service__auth__ftpd__5[email protected]127.0.0.1) [INFO] Logout.
Jan 19 20:12:17 galaxy kernel: audit(1232392337.076:1034): avc:  denied  { read } for  pid=18422 comm="clamd" name="1LOzXj-0004n4-UZ" dev=sda6 ino=160414 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir
Jan 19 20:12:17 galaxy kernel: audit(1232392337.076:1035): avc:  denied  { getattr } for  pid=18422 comm="clamd" path="/var/spool/exim/scan/1LOzXj-0004n4-UZ/1LOzXj-0004n4-UZ.eml" dev=sda6 ino=160416 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
Jan 19 20:12:17 galaxy kernel: audit(1232392337.077:1036): avc:  denied  { read } for  pid=18422 comm="clamd" name="1LOzXj-0004n4-UZ.eml" dev=sda6 ino=160416 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=file
Jan 19 20:12:37 galaxy kernel: audit(1232392357.985:1037): avc:  denied  { execmod } for  pid=18436 comm="php" path="/usr/local/IonCube/ioncube_loader_lin_5.2.so" dev=sda5 ino=1563683 scontext=root:system_r:unconfined_t:s0-s0:c0.c1023 tcontext=root:object_r:usr_t:s0 tclass=file

 

[dropby23]

this is the selinux log
you can disable selinux in
/etc/sysconfig/selinux
set as "SELINUX=disabled"
and reboot the server