clamav-milter issues after debian update

**freedom** · Sep 11th 2019

Hi Nuxwin,

You are right. I found the README file in the directory of the plugin.

After restarting the clamav-daemon and the clamav-milter:

Output of ls -la /run/clamav:

Code

ls -la /run/clamav
total 4
drwxr-xr-x 2 clamav root 80 Sep 11 17:34 .
drwxr-xr-x 33 root root 1200 Sep 11 17:29 ..
-rw-r--r-- 1 clamav root 5 Sep 11 17:34 clamav-milter.pid
srw-rw-rw- 1 clamav clamav 0 Sep 11 17:34 clamd.ctl

Output of ls -la /var/spool/postfix/clamav:

Code

ls -la /var/spool/postfix/clamav
total 8
drwxr-xr-x 2 clamav root 4096 Sep 11 17:34 .
drwxr-xr-x 22 root root 4096 Apr 29 00:29 ..
srw-rw-rw- 1 clamav clamav 0 Sep 11 17:34 clamav-milter.ctl

Output of cat /etc/clamav/clamd.conf:

Code

#Automatically Generated by clamav-daemon postinst
#To reconfigure clamd run #dpkg-reconfigure clamav-daemon
#Please read /usr/share/doc/clamav-daemon/README.Debian.gz for details
LocalSocket /var/run/clamav/clamd.ctl
FixStaleSocket true
LocalSocketGroup clamav
LocalSocketMode 666
# TemporaryDirectory is not set to its default /tmp here to make overriding
# the default with environment variables TMPDIR/TMP/TEMP possible
User clamav
ScanMail true
ScanArchive true
ArchiveBlockEncrypted false
MaxDirectoryRecursion 15
FollowDirectorySymlinks false
FollowFileSymlinks false
ReadTimeout 180
MaxThreads 12
MaxConnectionQueueLength 15
LogSyslog false
LogRotate true
LogFacility LOG_LOCAL6
LogClean false
LogVerbose false
PreludeEnable no
PreludeAnalyzerName ClamAV
DatabaseDirectory /var/lib/clamav
OfficialDatabaseOnly false
SelfCheck 3600
Foreground false
Debug false
ScanPE true
MaxEmbeddedPE 10M
ScanOLE2 true
ScanPDF true
ScanHTML true
MaxHTMLNormalize 10M
MaxHTMLNoTags 2M
MaxScriptNormalize 5M
MaxZipTypeRcg 1M
ScanSWF true
ExitOnOOM false
LeaveTemporaryFiles false
AlgorithmicDetection true
ScanELF true
IdleTimeout 30
CrossFilesystems true
PhishingSignatures true
PhishingScanURLs true
PhishingAlwaysBlockSSLMismatch false
PhishingAlwaysBlockCloak false
PartitionIntersection false
DetectPUA false
ScanPartialMessages false
HeuristicScanPrecedence false
StructuredDataDetection false
CommandReadTimeout 5
SendBufTimeout 200
MaxQueue 100
ExtendedDetectionInfo true
OLE2BlockMacros false
ScanOnAccess false
AllowAllMatchScan true
ForceToDisk false
DisableCertCheck false
DisableCache false
MaxScanTime 120000
MaxScanSize 100M
MaxFileSize 25M
MaxRecursion 16
MaxFiles 10000
MaxPartitions 50
MaxIconsPE 100
PCREMatchLimit 10000
PCRERecMatchLimit 5000
PCREMaxFileSize 25M
ScanXMLDOCS true
ScanHWP3 true
MaxRecHWP3 16
StreamMaxLength 25M
LogFile /var/log/clamav/clamav.log
LogTime true
LogFileUnlock false
LogFileMaxSize 0
Bytecode true
BytecodeSecurity TrustSigned
BytecodeTimeout 60000

Display More

Output of cat /etc/clamav/clamav-milter.conf:

Code

#Automatically Generated by clamav-milter postinst
#To reconfigure clamav-milter run #dpkg-reconfigure clamav-milter
#Please read /usr/share/doc/clamav-base/README.Debian.gz for details
#MilterSocket /var/run/clamav/clamav-milter.ctl
#FixStaleSocket true
#User clamav
#ReadTimeout 120
#Foreground false
#PidFile /var/run/clamav/clamav-milter.pid
#ClamdSocket unix:/var/run/clamav/clamd.ctl
#OnClean Accept
#OnInfected Quarantine
#OnFail Defer
#AddHeader Replace
#LogSyslog false
#LogFacility LOG_LOCAL6
#LogVerbose false
#LogInfected Off
#LogClean Off
#LogRotate true
#MaxFileSize 25M
#SupportMultipleRecipients false
#TemporaryDirectory /tmp
#LogFile /var/log/clamav/clamav-milter.log
#LogTime true
#LogFileUnlock false
#LogFileMaxSize 1M
#MilterSocketGroup clamav
#MilterSocketMode 666
# Begin Plugin::ClamAV
LogClean Off
FixStaleSocket true
LogFacility LOG_MAIL
AddHeader Replace
OnInfected Reject
LogSyslog true
LogInfected Basic
LogTime true
RejectMsg Blocked by ClamAV - FOUND VIRUS: %v
TemporaryDirectory /tmp
MaxFileSize 25M
OnClean Accept
MilterSocket /var/spool/postfix/clamav/clamav-milter.ctl
PidFile /var/run/clamav/clamav-milter.pid
Foreground false
LogVerbose false
SupportMultipleRecipients false
ReadTimeout 120
LogRotate true
OnFail Defer
LogFile /var/log/clamav/clamav-milter.log
LogFileMaxSize 0M
User clamav
LogFileUnlock false
MilterSocketMode 666
MilterSocketGroup clamav
ClamdSocket unix:/var/run/clamav/clamd.ctl
# Ending Plugin::ClamAV

Display More

The weird thing now is:

The previous problem described by fulltilt and myself does not show again after the current restart, but did before. See:

Code

systemctl status clamav-milter
● clamav-milter.service - LSB: ClamAV virus milter
Loaded: loaded (/etc/init.d/clamav-milter; generated; vendor preset: enabled)
Active: active (running) since Wed 2019-09-11 17:34:33 CEST; 14min ago
Docs: man:systemd-sysv-generator(8)
Process: 6788 ExecStop=/etc/init.d/clamav-milter stop (code=exited, status=0/SUCCESS)
Process: 9472 ExecStart=/etc/init.d/clamav-milter start (code=exited, status=0/SUCCESS)
Tasks: 6 (limit: 4915)
CGroup: /system.slice/clamav-milter.service
└─9596 /usr/sbin/clamav-milter --config-file=/etc/clamav/clamav-milter.conf
Sep 11 17:34:33 neptun systemd[1]: Starting LSB: ClamAV virus milter...
Sep 11 17:34:33 neptun clamav-milter[9595]: +++ Started at Wed Sep 11 17:34:33 2019
Sep 11 17:34:33 neptun clamav-milter[9472]: Starting Sendmail milter plugin for ClamAV: clamav-milter.
Sep 11 17:34:33 neptun systemd[1]: Started LSB: ClamAV virus milter.

Display More

Code

systemctl status clamav-daemon
● clamav-daemon.service - Clam AntiVirus userspace daemon
Loaded: loaded (/lib/systemd/system/clamav-daemon.service; enabled; vendor preset: enabled)
Drop-In: /etc/systemd/system/clamav-daemon.service.d
└─extend.conf
Active: active (running) since Wed 2019-09-11 17:33:31 CEST; 15min ago
Docs: man:clamd(8)
man:clamd.conf(5)
https://www.clamav.net/documents/
Process: 7546 ExecStartPre=/bin/chown clamav /run/clamav (code=exited, status=0/SUCCESS)
Process: 7543 ExecStartPre=/bin/mkdir /run/clamav (code=exited, status=1/FAILURE)
Main PID: 7549 (clamd)
Tasks: 2 (limit: 4915)
CGroup: /system.slice/clamav-daemon.service
└─7549 /usr/sbin/clamd --foreground=true
Sep 11 17:34:04 neptun clamd[7549]: Wed Sep 11 17:34:04 2019 -> Portable Executable support enabled.
Sep 11 17:34:04 neptun clamd[7549]: Wed Sep 11 17:34:04 2019 -> ELF support enabled.
Sep 11 17:34:04 neptun clamd[7549]: Wed Sep 11 17:34:04 2019 -> Mail files support enabled.
Sep 11 17:34:04 neptun clamd[7549]: Wed Sep 11 17:34:04 2019 -> OLE2 support enabled.
Sep 11 17:34:04 neptun clamd[7549]: Wed Sep 11 17:34:04 2019 -> PDF support enabled.
Sep 11 17:34:04 neptun clamd[7549]: Wed Sep 11 17:34:04 2019 -> SWF support enabled.
Sep 11 17:34:04 neptun clamd[7549]: Wed Sep 11 17:34:04 2019 -> HTML support enabled.
Sep 11 17:34:04 neptun clamd[7549]: Wed Sep 11 17:34:04 2019 -> XMLDOCS support enabled.
Sep 11 17:34:04 neptun clamd[7549]: Wed Sep 11 17:34:04 2019 -> HWP3 support enabled.
Sep 11 17:34:04 neptun clamd[7549]: Wed Sep 11 17:34:04 2019 -> Self checking every 3600 seconds.

Display More

Output of tail -f /var/log/clamav/clamav-milter.log after the update until now:

Code

tail -f /var/log/clamav/clamav-milter.log
Wed Sep 11 02:00:19 2019 -> WARNING: No clamd server appears to be available
Wed Sep 11 02:15:53 2019 -> +++ Started at Wed Sep 11 02:15:53 2019
Wed Sep 11 02:15:53 2019 -> WARNING: No clamd server appears to be available
Wed Sep 11 02:16:52 2019 -> WARNING: No clamd server appears to be available
Wed Sep 11 02:45:07 2019 -> +++ Started at Wed Sep 11 02:45:07 2019
Wed Sep 11 02:45:07 2019 -> WARNING: No clamd server appears to be available
Wed Sep 11 17:32:46 2019 -> +++ Started at Wed Sep 11 17:32:46 2019
Wed Sep 11 17:32:46 2019 -> WARNING: No clamd server appears to be available
Wed Sep 11 17:34:33 2019 -> +++ Started at Wed Sep 11 17:34:33 2019

The latest restart at 17:34:33 2019 - right before I started to check everything again - seems to fixed the problem itself, because the previous error WARNING: No clamd server appears to be available isn't there anymore.

**Nuxwin** · Sep 11th 2019

fulltilt freedom

I've juste tested the behavior under Debian Stretch. The problem seem to be related to the /run/clamav/clamd.ctl socket file which make very long time to be created and so, when the clamav-milter service is being started, the /run/clamav/clamd.ctl socket file is not found, leading to the "WARNING: No clamd server appears to be available" message, and possibly other error messages.

Basically put:

Code

root@phpswitcher:~# service clamav-daemon status
● clamav-daemon.service - Clam AntiVirus userspace daemon
Loaded: loaded (/lib/systemd/system/clamav-daemon.service; enabled; vendor preset: enabled)
Drop-In: /etc/systemd/system/clamav-daemon.service.d
└─extend.conf
Active: active (running) since Wed 2019-09-11 17:51:33 CEST; 2s ago
Docs: man:clamd(8)
man:clamd.conf(5)
https://www.clamav.net/documents/
Process: 2712 ExecStartPre=/bin/chown clamav /run/clamav (code=exited, status=0/SUCCESS)
Process: 2710 ExecStartPre=/bin/mkdir /run/clamav (code=exited, status=1/FAILURE)
Main PID: 2716 (clamd)
Tasks: 1 (limit: 4915)
CGroup: /system.slice/clamav-daemon.service
└─2716 /usr/sbin/clamd --foreground=true
sept. 11 17:51:33 phpswitcher systemd[1]: Starting Clam AntiVirus userspace daemon...
sept. 11 17:51:33 phpswitcher mkdir[2710]: /bin/mkdir: impossible de créer le répertoire « /run/clamav »: Le fichier existe
sept. 11 17:51:33 phpswitcher systemd[1]: Started Clam AntiVirus userspace daemon.

Display More

Code

root@phpswitcher:~# ls /run/clamav
clamav-milter.pid

As you can see here, the clamav-daemon is running but the /run/clamav/clamd.ctl socket file is not created yet....

However, after few seconds:

Code

root@phpswitcher:~# ls /run/clamav
clamav-milter.pid clamd.ctl

Problem is that the clamav-milter service, is started just after the clamav-damon service but at this time, the /run/clamav/clamd.ctl socket file has not been created yet...

Well, this has nothing to do with the plugin in fact... I need investigate further to know why the /run/clamav/clamd.ctl socket file creation is so long...

**Nuxwin** · Sep 11th 2019

freedom

Your /etc/clamav/clamav-milter.conf configuration file is totally wrong... It look like the content of the /etc/clamav/clamd.conf configuration file... Did you do a wrong copy past or? Content, when the i-MSCP ClamAV plugin is activated, should be:

Code

#Automatically Generated by clamav-milter postinst
#To reconfigure clamav-milter run #dpkg-reconfigure clamav-milter
#Please read /usr/share/doc/clamav-base/README.Debian.gz for details
#MilterSocket /var/run/clamav/clamav-milter.ctl
#FixStaleSocket true
#User clamav
#ReadTimeout 120
#Foreground false
#PidFile /var/run/clamav/clamav-milter.pid
#ClamdSocket unix:/var/run/clamav/clamd.ctl
#OnClean Accept
#OnInfected Quarantine
#OnFail Defer
#AddHeader Replace
#LogSyslog false
#LogFacility LOG_LOCAL6
#LogVerbose false
#LogInfected Off
#LogClean Off
#LogRotate true
#MaxFileSize 25M
#SupportMultipleRecipients false
#TemporaryDirectory /tmp
#LogFile /var/log/clamav/clamav-milter.log
#LogTime true
#LogFileUnlock false
#LogFileMaxSize 1M
#MilterSocketGroup clamav
#MilterSocketMode 666
# Begin Plugin::ClamAV
LogClean Off
User clamav
SupportMultipleRecipients false
Foreground false
RejectMsg Blocked by ClamAV - FOUND VIRUS: %v
MilterSocket /var/spool/postfix/clamav/clamav-milter.ctl
LogFacility LOG_MAIL
MaxFileSize 25M
LogFile /var/log/clamav/clamav-milter.log
TemporaryDirectory /tmp
AddHeader Replace
LogFileUnlock false
MilterSocketMode 666
LogFileMaxSize 0M
FixStaleSocket true
LogVerbose false
LogSyslog true
PidFile /var/run/clamav/clamav-milter.pid
LogRotate true
ClamdSocket unix:/var/run/clamav/clamd.ctl
OnInfected Reject
LogInfected Basic
MilterSocketGroup clamav
ReadTimeout 120
OnClean Accept
LogTime true
OnFail Defer
# Ending Plugin::ClamAV

Display More

**freedom** · Sep 11th 2019

Nuxwin

I copy pasted the same content, my fault. I fixed the output above.

Correct output of cat /etc/clamav/clamav-milter.conf is:

Code

#Automatically Generated by clamav-milter postinst
#To reconfigure clamav-milter run #dpkg-reconfigure clamav-milter
#Please read /usr/share/doc/clamav-base/README.Debian.gz for details
#MilterSocket /var/run/clamav/clamav-milter.ctl
#FixStaleSocket true
#User clamav
#ReadTimeout 120
#Foreground false
#PidFile /var/run/clamav/clamav-milter.pid
#ClamdSocket unix:/var/run/clamav/clamd.ctl
#OnClean Accept
#OnInfected Quarantine
#OnFail Defer
#AddHeader Replace
#LogSyslog false
#LogFacility LOG_LOCAL6
#LogVerbose false
#LogInfected Off
#LogClean Off
#LogRotate true
#MaxFileSize 25M
#SupportMultipleRecipients false
#TemporaryDirectory /tmp
#LogFile /var/log/clamav/clamav-milter.log
#LogTime true
#LogFileUnlock false
#LogFileMaxSize 1M
#MilterSocketGroup clamav
#MilterSocketMode 666
# Begin Plugin::ClamAV
LogClean Off
FixStaleSocket true
LogFacility LOG_MAIL
AddHeader Replace
OnInfected Reject
LogSyslog true
LogInfected Basic
LogTime true
RejectMsg Blocked by ClamAV - FOUND VIRUS: %v
TemporaryDirectory /tmp
MaxFileSize 25M
OnClean Accept
MilterSocket /var/spool/postfix/clamav/clamav-milter.ctl
PidFile /var/run/clamav/clamav-milter.pid
Foreground false
LogVerbose false
SupportMultipleRecipients false
ReadTimeout 120
LogRotate true
OnFail Defer
LogFile /var/log/clamav/clamav-milter.log
LogFileMaxSize 0M
User clamav
LogFileUnlock false
MilterSocketMode 666
MilterSocketGroup clamav
ClamdSocket unix:/var/run/clamav/clamd.ctl
# Ending Plugin::ClamAV

Display More

And yes. The clamav plugin is installed and activated in i-mscp. It seems to work without any problems now. But I can confirm, that the clamav package update changed something in the config, it was displayed in the apt upgrade process. I think it was the milter configuration file.

I can see that your clamav-milter.conf is different from mine.

**Nuxwin** · Sep 11th 2019

fulltilt freedom

See below to know why the socket file is very long to be created:

Code

root@phpswitcher:~# service clamav-daemon stop

Code

root@phpswitcher:~# /usr/sbin/clamd --foreground=false --debug
root@phpswitcher:~# pkill -KILL -f /usr/sbin/clamd

A the same time on another console:

Code

root@phpswitcher:/var/log/clamav# tail -fn0 clamav.log
Wed Sep 11 18:14:40 2019 -> +++ Started at Wed Sep 11 18:14:40 2019
Wed Sep 11 18:14:40 2019 -> Received 0 file descriptor(s) from systemd.
Wed Sep 11 18:14:40 2019 -> clamd daemon 0.101.4 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Wed Sep 11 18:14:40 2019 -> Running as user clamav (UID 117, GID 121)
Wed Sep 11 18:14:40 2019 -> Log file size limited to 4294967295 bytes.
Wed Sep 11 18:14:40 2019 -> Reading databases from /var/lib/clamav
Wed Sep 11 18:14:40 2019 -> Not loading PUA signatures.
Wed Sep 11 18:14:40 2019 -> Bytecode: Security mode set to "TrustSigned".
Wed Sep 11 18:15:20 2019 -> Loaded 6492894 signatures.
Wed Sep 11 18:15:21 2019 -> LOCAL: Removing stale socket file /var/run/clamav/clamd.ctl
Wed Sep 11 18:15:21 2019 -> LOCAL: Unix socket file /var/run/clamav/clamd.ctl
Wed Sep 11 18:15:21 2019 -> LOCAL: Setting connection queue length to 15
Wed Sep 11 18:15:21 2019 -> Limits: Global time limit set to 120000 milliseconds.
Wed Sep 11 18:15:21 2019 -> Limits: Global size limit set to 104857600 bytes.
Wed Sep 11 18:15:21 2019 -> Limits: File size limit set to 26214400 bytes.
Wed Sep 11 18:15:21 2019 -> Limits: Recursion level limit set to 16.
Wed Sep 11 18:15:21 2019 -> Limits: Files limit set to 10000.
Wed Sep 11 18:15:21 2019 -> Limits: MaxEmbeddedPE limit set to 10485760 bytes.
Wed Sep 11 18:15:21 2019 -> Limits: MaxHTMLNormalize limit set to 10485760 bytes.
Wed Sep 11 18:15:21 2019 -> Limits: MaxHTMLNoTags limit set to 2097152 bytes.
Wed Sep 11 18:15:21 2019 -> Limits: MaxScriptNormalize limit set to 5242880 bytes.
Wed Sep 11 18:15:21 2019 -> Limits: MaxZipTypeRcg limit set to 1048576 bytes.
Wed Sep 11 18:15:21 2019 -> Limits: MaxPartitions limit set to 50.
Wed Sep 11 18:15:21 2019 -> Limits: MaxIconsPE limit set to 100.
Wed Sep 11 18:15:21 2019 -> Limits: MaxRecHWP3 limit set to 16.
Wed Sep 11 18:15:21 2019 -> Limits: PCREMatchLimit limit set to 10000.
Wed Sep 11 18:15:21 2019 -> Limits: PCRERecMatchLimit limit set to 5000.
Wed Sep 11 18:15:21 2019 -> Limits: PCREMaxFileSize limit set to 26214400.
Wed Sep 11 18:15:21 2019 -> Archive support enabled.
Wed Sep 11 18:15:21 2019 -> AlertExceedsMax heuristic detection disabled.
Wed Sep 11 18:15:21 2019 -> Heuristic alerts enabled.
Wed Sep 11 18:15:21 2019 -> Portable Executable support enabled.
Wed Sep 11 18:15:21 2019 -> ELF support enabled.
Wed Sep 11 18:15:21 2019 -> Mail files support enabled.
Wed Sep 11 18:15:21 2019 -> OLE2 support enabled.
Wed Sep 11 18:15:21 2019 -> PDF support enabled.
Wed Sep 11 18:15:21 2019 -> SWF support enabled.
Wed Sep 11 18:15:21 2019 -> HTML support enabled.
Wed Sep 11 18:15:21 2019 -> XMLDOCS support enabled.
Wed Sep 11 18:15:21 2019 -> HWP3 support enabled.
Wed Sep 11 18:15:21 2019 -> Self checking every 3600 seconds.

Display More

Basically put, loading signatures is very long process (~40 seconds)... And the socket file will not be created before...

**Nuxwin** · Sep 11th 2019

Quote from freedom

And yes. The clamav plugin is installed and activated in i-mscp. It seems to work without any problems now. But I can confirm, that the clamav package update changed something in the config, it was displayed in the apt upgrade process. I think it was the milter configuration file.

I can see that your clamav-milter.conf is different from mine.

Yes, the plugin is working as expected. There is only the problem of the clamd socket file that is very long to be created as explained in my previous messages... That's a big problem because I don't know how we can delay the start of the clamav-milter service till that the clamd socket file is effectively created...

You milter conffile seem to be same as me

**fulltilt** · May 1st 2020

some more details on this:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942172

**Mr.X** · Dec 17th 2020

Hi gents,

any solution available? I am facing the same issue now .-/

Code

==> mail.log <==
Dec 17 13:33:50 s1 clamav-milter[8038]: No clamd server appears to be available

My system looks like this

- debian 9.13 stretch

- clamav* 0.102.4+dfsg-0+deb9u1 -> latest stable version

Any help is much appreviated

Br

Mr.X

**ciscllc** · Dec 17th 2020

Do a Debian upgrade. Maybe that will do it.

Otherwise you may change the systemd file to start after clamd.

https://wiki.debian.org/systemd/Services

User after=

Regards

clamav-milter issues after debian update

Nuxwin Sep 11th 2019

Share

Daily visitors