ClamAV, freshclam и память

Проблемы с установкой, настройкой и работой системных и сетевых программ.

Модераторы: GRooVE, alexco

Правила форума
Убедительная просьба юзать теги [code] при оформлении листингов.
Сообщения не оформленные должным образом имеют все шансы быть незамеченными.
Аватара пользователя
Diamond Phoenix
проходил мимо
Сообщения: 4
Зарегистрирован: 2010-02-06 18:42:55

ClamAV, freshclam и память

Непрочитанное сообщение Diamond Phoenix » 2010-10-12 16:19:52

Доброго времени суток!
Подкинули небольшую подработку - поднять на удаленном сервере самбу, МТА и кое что по мелочи. По старой привычке на всякий случай решил прикрутить ClamAV и поймал вот такую проблему:

Код: Выделить всё

inet_gw# freshclam
ClamAV update process started at Tue Oct 12 22:26:59 2010
WARNING: DNS record is older than 3 hours.
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Reading CVD header (main.cvd): WARNING: Unknown response from remote server
WARNING: Can't read main.cvd header from database.clamav.net (IP: 194.186.47.19)
Trying again in 5 secs...
ClamAV update process started at Tue Oct 12 22:27:05 2010
WARNING: DNS record is older than 3 hours.
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Reading CVD header (main.cvd): OK (IMS)
main.cvd is up to date (version: 52, sigs: 704727, f-level: 44, builder: sven)
Reading CVD header (daily.cvd): OK
WARNING: getfile: daily-11979.cdiff not found on remote server (IP: 62.140.250.250)
WARNING: getpatch: Can't download daily-11979.cdiff from database.clamav.net
WARNING: getfile: daily-11979.cdiff not found on remote server (IP: 194.186.47.19)
WARNING: getpatch: Can't download daily-11979.cdiff from database.clamav.net
WARNING: getfile: daily-11979.cdiff not found on remote server (IP: 194.186.47.19)
WARNING: getpatch: Can't download daily-11979.cdiff from database.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
Downloading daily.cvd [100%]
LibClamAV Error: cl_engine_new: Can't allocate memory for memory pool
Вывод clamconf:

Код: Выделить всё

inet_gw# clamconf
Checking configuration files in /usr/local/etc

Config file: clamd.conf
-----------------------
LogFile = "/var/log/clamav/clamd.log"
LogFileUnlock disabled
LogFileMaxSize = "1048576"
LogTime disabled
LogClean disabled
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
ExtendedDetectionInfo disabled
PidFile = "/var/run/clamav/clamd.pid"
TemporaryDirectory disabled
DatabaseDirectory = "/var/db/clamav"
OfficialDatabaseOnly disabled
LocalSocket = "/var/run/clamav/clamd.sock"
LocalSocketGroup disabled
LocalSocketMode disabled
FixStaleSocket = "yes"
TCPSocket disabled
TCPAddr disabled
MaxConnectionQueueLength = "15"
StreamMaxLength = "26214400"
StreamMinPort = "1024"
StreamMaxPort = "2048"
MaxThreads = "10"
ReadTimeout = "120"
CommandReadTimeout = "5"
SendBufTimeout = "500"
MaxQueue = "100"
IdleTimeout = "30"
ExcludePath disabled
MaxDirectoryRecursion = "15"
FollowDirectorySymlinks disabled
FollowFileSymlinks disabled
CrossFilesystems = "yes"
SelfCheck = "600"
VirusEvent disabled
ExitOnOOM disabled
Foreground disabled
Debug disabled
LeaveTemporaryFiles disabled
User = "clamav"
AllowSupplementaryGroups = "yes"
Bytecode = "yes"
BytecodeSecurity = "TrustSigned"
BytecodeTimeout = "60000"
BytecodeMode = "Auto"
DetectPUA disabled
ExcludePUA disabled
IncludePUA disabled
AlgorithmicDetection = "yes"
ScanPE = "yes"
ScanELF = "yes"
DetectBrokenExecutables disabled
ScanMail = "yes"
ScanPartialMessages disabled
PhishingSignatures = "yes"
PhishingScanURLs = "yes"
PhishingAlwaysBlockCloak disabled
PhishingAlwaysBlockSSLMismatch disabled
HeuristicScanPrecedence disabled
StructuredDataDetection disabled
StructuredMinCreditCardCount = "3"
StructuredMinSSNCount = "3"
StructuredSSNFormatNormal = "yes"
StructuredSSNFormatStripped disabled
ScanHTML = "yes"
ScanOLE2 = "yes"
ScanPDF = "yes"
ScanArchive = "yes"
ArchiveBlockEncrypted disabled
MaxScanSize = "104857600"
MaxFileSize = "26214400"
MaxRecursion = "16"
MaxFiles = "10000"
ClamukoScanOnAccess disabled
ClamukoScannerCount = "3"
ClamukoScanOnOpen disabled
ClamukoScanOnClose disabled
ClamukoScanOnExec disabled
ClamukoIncludePath disabled
ClamukoExcludePath disabled
ClamukoMaxFileSize = "5242880"
DevACOnly disabled
DevACDepth disabled

Config file: freshclam.conf
---------------------------
LogFileMaxSize = "1048576"
LogTime disabled
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
PidFile = "/var/run/clamav/freshclam.pid"
DatabaseDirectory = "/var/db/clamav"
Foreground disabled
Debug disabled
AllowSupplementaryGroups = "yes"
UpdateLogFile = "/var/log/clamav/freshclam.log"
DatabaseOwner = "clamav"
Checks = "12"
DNSDatabaseInfo = "current.cvd.clamav.net"
DatabaseMirror = "database.clamav.net"
MaxAttempts = "3"
ScriptedUpdates = "yes"
TestDatabases = "yes"
CompressLocalDatabase disabled
ExtraDatabase disabled
HTTPProxyServer disabled
HTTPProxyPort disabled
HTTPProxyUsername disabled
HTTPProxyPassword disabled
HTTPUserAgent disabled
NotifyClamd = "/usr/local/etc/clamd.conf"
OnUpdateExecute disabled
OnErrorExecute disabled
OnOutdatedExecute disabled
LocalIPAddress disabled
ConnectTimeout = "30"
ReceiveTimeout = "30"
SubmitDetectionStats disabled
DetectionStatsCountry disabled
DetectionStatsHostID disabled
SafeBrowsing disabled
Bytecode = "yes"

Config file: clamav-milter.conf
-------------------------------
LogFile disabled
LogFileUnlock disabled
LogFileMaxSize = "1048576"
LogTime disabled
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
PidFile = "/var/run/clamav/clamav-milter.pid"
TemporaryDirectory disabled
FixStaleSocket = "yes"
MaxThreads = "10"
ReadTimeout = "120"
Foreground disabled
User = "clamav"
AllowSupplementaryGroups = "yes"
MaxFileSize = "26214400"
ClamdSocket = "unix:/var/run/clamav/clamd.sock"
MilterSocket = "/var/run/clamav/clmilter.sock"
MilterSocketGroup disabled
MilterSocketMode disabled
LocalNet disabled
OnClean = "Accept"
OnInfected = "Quarantine"
OnFail = "Defer"
RejectMsg disabled
AddHeader = "no"
ReportHostname disabled
VirusAction disabled
Chroot disabled
Whitelist disabled
SkipAuthenticated disabled
LogInfected disabled

Software settings
-----------------
Version: 0.96.3
Optional features supported: MEMPOOL BIGSTACK AUTOIT_EA06 BZIP2 RAR JIT

Database information
--------------------
Database directory: /var/db/clamav
main.cvd: version 52, sigs: 704727, built on Mon Feb 15 14:54:51 2010
daily.cvd: version 11978, sigs: 130608, built on Mon Sep 20 14:17:07 2010
Total number of signatures: 835335
LibClamAV Warning: RWX mapping denied: Can't allocate RWX Memory: Bad file descriptor

Platform information
--------------------
uname: FreeBSD 7.2-RELEASE FreeBSD 7.2-RELEASE #4: Wed May 20 17:46:03 UTC 2009     admin@i i386
OS: freebsd7.2, ARCH: i386, CPU: i386
zlib version: 1.2.3 (1.2.3), compile flags: 55
Triple: i386-portbld-freebsd7.2
CPU: core2, Little-endian
platform id: 0x031137370404020100040201

Build information
-----------------
GNU C: 4.2.1 20070719  [FreeBSD] (4.2.1)
GNU C++: 4.2.1 20070719  [FreeBSD] (4.2.1)
CPPFLAGS: -I/usr/local/include  
CFLAGS: -O2 -fno-strict-aliasing -pipe -march=i486
CXXFLAGS: -O2 -fno-strict-aliasing -pipe -march=i486
LDFLAGS: -L/usr/local/lib  -lthr
Configure: '--libdir=/usr/local/lib' '--with-dbdir=/var/db/clamav' '--with-zlib=/usr' '--disable-clamuko' '--disable-clamav' '--enable-bigstack' '--enable-readdir_r' '--enable-gethostbyname_r' '--disable-dependency-tracking' '--enable-clamdtop' '--with-iconv' '--enable-llvm' '--with-sendmail=/usr/sbin/sendmail' '--enable-milter' '--enable-check' '--prefix=/usr/local' '--mandir=/usr/local/man' '--infodir=/usr/local/info/' '--build=i386-portbld-freebsd7.2' 'build_alias=i386-portbld-freebsd7.2' 'CC=cc' 'CFLAGS=-O2 -fno-strict-aliasing -pipe -march=i486' 'LDFLAGS= -L/usr/local/lib  -lthr' 'CPPFLAGS=-I/usr/local/include  '
sizeof(void*) = 4
Engine flevel: 55, dconf: 55
Смущает строка LibClamAV Warning: RWX mapping denied: Can't allocate RWX Memory: Bad file descriptor

Серв:

Код: Выделить всё

FreeBSD 7.2-RELEASE #4: Wed May 20 17:46:03 UTC 2009
CPU: Intel(R) Celeron(R) CPU        E1400  @ 2.00GHz (1994.49-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0x6fd  Stepping = 13
  Cores per package: 2
real memory  = 1072365568 (1022 MB)
avail memory = 1040519168 (992 MB)
Сначала грешил на нехватку места, предыдущий админ заполнил / и /var почти до отказа разной гадостью. Почистил, но ничего не изменилось...

Да, чуть не забыл - freshclam.log

Код: Выделить всё

ClamAV update process started at Tue Oct 12 22:26:59 2010
WARNING: DNS record is older than 3 hours.
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Reading CVD header (main.cvd): WARNING: Unknown response from remote server
WARNING: Can't read main.cvd header from database.clamav.net (IP: 194.186.47.19)
Trying again in 5 secs...
ClamAV update process started at Tue Oct 12 22:27:05 2010
WARNING: DNS record is older than 3 hours.
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Reading CVD header (main.cvd): OK (IMS)
main.cvd is up to date (version: 52, sigs: 704727, f-level: 44, builder: sven)
Reading CVD header (daily.cvd): OK
WARNING: getfile: daily-11979.cdiff not found on remote server (IP: 62.140.250.250)
WARNING: getpatch: Can't download daily-11979.cdiff from database.clamav.net
WARNING: getfile: daily-11979.cdiff not found on remote server (IP: 194.186.47.19)
WARNING: getpatch: Can't download daily-11979.cdiff from database.clamav.net
WARNING: getfile: daily-11979.cdiff not found on remote server (IP: 194.186.47.19)
WARNING: getpatch: Can't download daily-11979.cdiff from database.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
Downloading daily.cvd [100%]
Никаких ошибок нет

clamav.log

Код: Выделить всё

cat clamd.log
+++ Started at Tue Oct 12 22:14:29 2010
clamd daemon 0.96.3 (OS: freebsd7.2, ARCH: i386, CPU: i386)
Running as user clamav (UID 106, GID 106)
Log file size limited to 1048576 bytes.
ERROR: Can't initialize antivirus engine
+++ Started at Tue Oct 12 22:16:59 2010
clamd daemon 0.96.3 (OS: freebsd7.2, ARCH: i386, CPU: i386)
Running as user clamav (UID 106, GID 106)
Log file size limited to 1048576 bytes.
ERROR: Can't initialize antivirus engine
Нет баз - не стартует

Запуск демона:

Код: Выделить всё

inet_gw# /usr/local/etc/rc.d/clamav-clamd start
Starting clamav_clamd.
LibClamAV Error: cl_engine_new: Can't allocate memory for memory pool
ERROR: Can't initialize antivirus engine
Пересобирал с отключением всех по очереди опций - одно и то же. Порт однозначно рабочий - на своем боевом сервере специально обновил версию, обновил базы - никаких проблем.
Гугл советует добавить памяти, но физического доступа к серверу у меня нет, да и разве гигабайта памяти мало?

Хостинговая компания Host-Food.ru
Хостинг HostFood.ru
 

Услуги хостинговой компании Host-Food.ru

Хостинг HostFood.ru

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

Аватара пользователя
Alex Keda
стреляли...
Сообщения: 35456
Зарегистрирован: 2004-10-18 14:25:19
Откуда: Made in USSR
Контактная информация:

Re: ClamAV, freshclam и память

Непрочитанное сообщение Alex Keda » 2010-10-13 16:00:12

зеркало не обновилось
чуть позже попробуйте
Убей их всех! Бог потом рассортирует...

Аватара пользователя
Diamond Phoenix
проходил мимо
Сообщения: 4
Зарегистрирован: 2010-02-06 18:42:55

Re: ClamAV, freshclam и память

Непрочитанное сообщение Diamond Phoenix » 2010-10-15 1:32:15

Благодарю за инфу, а то задолбался мучить гугл этим вопросом =) Подождем еще пару-тройку дней

Аватара пользователя
Diamond Phoenix
проходил мимо
Сообщения: 4
Зарегистрирован: 2010-02-06 18:42:55

Re: ClamAV, freshclam и память

Непрочитанное сообщение Diamond Phoenix » 2010-10-20 6:42:54

Вобщем проблема осталась... Загрузил файлы вручную с зеркала - freshclam теперь рисует

Код: Выделить всё

inet_gw# freshclam
ClamAV update process started at Wed Oct 20 14:35:11 2010
main.cvd is up to date (version: 52, sigs: 704727, f-level: 44, builder: sven)
daily.cvd is up to date (version: 12159, sigs: 141843, f-level: 53, builder: guitar)
bytecode.cvd is up to date (version: 82, sigs: 10, f-level: 53, builder: edwin)
Но при запуске демона все равно ругается:

Код: Выделить всё

inet_gw# /usr/local/etc/rc.d/clamav-clamd start
Starting clamav_clamd.
LibClamAV Error: cl_engine_new: Can't allocate memory for memory pool
ERROR: Can't initialize antivirus engine
Читать-то я конечно умею, и вижу что он не может инициализировать вирусную базу.
Владельца каталога и файлов проверил - clamav:clamav. Права - 0766...
Может кто сталкивался с такой проблемой?

Аватара пользователя
Diamond Phoenix
проходил мимо
Сообщения: 4
Зарегистрирован: 2010-02-06 18:42:55

Re: ClamAV, freshclam и память

Непрочитанное сообщение Diamond Phoenix » 2010-10-20 6:49:06

пробовал стартовать от рута - та же история...