Page 1 of 1

ClamAV hangs server

Posted: 2019-02-15 09:05
by RvdH
Yesterday ClamAV has hung the SMTP traffic on our server for a unknown reason, it seem to have started after ClamAV correctly reloaded Databases
After that (21:06) almost no SMTP traffic was possible until about an hour later (22:09) when ClamAV detected a Database modification but could not correctly reloaded Databases which resulted in a ClamAV crash with ERROR: reload db failed: Can't allocate memory
After the ClamAV Crash, ClamAV restarted itself (22:11) and everything was normal and functioning properly again

Anyone eve experienced something like this?

hmailserver error logs:

Code: Select all

"ERROR"	6048	"2019-02-14 21:26:33.588"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:26:33.588"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6940	"2019-02-14 21:35:08.393"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:35:08.393"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	5236	"2019-02-14 21:36:00.280"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	552	"2019-02-14 21:36:00.280"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	5236	"2019-02-14 21:36:19.970"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:36:19.970"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	5236	"2019-02-14 21:38:10.821"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	552	"2019-02-14 21:38:10.821"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6048	"2019-02-14 21:39:25.945"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:39:25.945"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6048	"2019-02-14 21:39:37.955"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:39:37.955"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3836	"2019-02-14 21:39:40.669"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	696	"2019-02-14 21:39:40.669"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3132	"2019-02-14 21:39:59.900"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2532	"2019-02-14 21:39:59.900"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	7900	"2019-02-14 21:42:01.873"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2532	"2019-02-14 21:42:01.873"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	2476	"2019-02-14 21:42:05.347"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	696	"2019-02-14 21:42:05.347"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	2476	"2019-02-14 21:42:09.314"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:42:09.314"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	2756	"2019-02-14 21:43:19.727"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:43:19.727"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6048	"2019-02-14 21:43:44.464"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	552	"2019-02-14 21:43:44.464"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6576	"2019-02-14 21:44:47.568"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:44:47.568"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	8172	"2019-02-14 21:45:21.738"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:45:21.738"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	2476	"2019-02-14 21:46:26.442"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	552	"2019-02-14 21:46:26.442"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6576	"2019-02-14 21:46:40.076"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	696	"2019-02-14 21:46:40.076"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6048	"2019-02-14 21:47:01.476"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:47:01.476"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3436	"2019-02-14 21:49:27.537"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:49:27.537"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	8172	"2019-02-14 21:49:28.348"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	696	"2019-02-14 21:49:28.348"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3132	"2019-02-14 21:49:28.380"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	552	"2019-02-14 21:49:28.380"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6576	"2019-02-14 21:51:57.085"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	552	"2019-02-14 21:51:57.085"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	2476	"2019-02-14 21:52:01.519"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	696	"2019-02-14 21:52:01.519"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	8172	"2019-02-14 21:52:10.331"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:52:10.331"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3436	"2019-02-14 21:52:10.346"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:52:10.346"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3132	"2019-02-14 21:57:01.504"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:57:01.504"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3836	"2019-02-14 21:57:53.205"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:57:53.205"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	8172	"2019-02-14 21:59:32.331"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:59:32.331"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6576	"2019-02-14 22:02:04.793"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 22:02:04.793"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3836	"2019-02-14 22:02:35.336"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 22:02:35.336"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	2476	"2019-02-14 22:05:05.749"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 22:05:05.749"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3836	"2019-02-14 22:07:01.254"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 22:07:01.254"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3132	"2019-02-14 22:07:49.069"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 22:07:49.069"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3836	"2019-02-14 22:09:13.198"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 22:09:13.198"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3844	"2019-02-14 22:09:41.910"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	8136	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	3576	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	2212	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	48	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	6500	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	4828	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	2720	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	2124	"2019-02-14 22:09:41.941"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	7780	"2019-02-14 22:09:41.941"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	8136	"2019-02-14 22:09:43.944"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2720	"2019-02-14 22:09:43.975"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	7780	"2019-02-14 22:09:44.069"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	6500	"2019-02-14 22:09:44.069"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3844	"2019-02-14 22:09:44.100"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2212	"2019-02-14 22:09:44.131"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	4828	"2019-02-14 22:09:44.131"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2124	"2019-02-14 22:09:44.162"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	48	"2019-02-14 22:09:44.802"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3576	"2019-02-14 22:09:45.457"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2720	"2019-02-14 22:09:46.034"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	7780	"2019-02-14 22:09:46.112"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3844	"2019-02-14 22:09:46.128"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	4828	"2019-02-14 22:09:46.159"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2124	"2019-02-14 22:09:46.190"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	48	"2019-02-14 22:09:47.383"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3576	"2019-02-14 22:09:47.477"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2212	"2019-02-14 22:09:47.713"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3844	"2019-02-14 22:09:48.149"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	6500	"2019-02-14 22:09:48.352"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	8136	"2019-02-14 22:09:48.352"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2720	"2019-02-14 22:09:48.368"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	4828	"2019-02-14 22:09:48.399"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2124	"2019-02-14 22:09:48.524"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	48	"2019-02-14 22:09:49.470"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3576	"2019-02-14 22:09:49.501"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2212	"2019-02-14 22:09:49.766"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	7780	"2019-02-14 22:09:49.766"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3844	"2019-02-14 22:09:50.328"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	8136	"2019-02-14 22:09:50.515"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	6500	"2019-02-14 22:09:50.515"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	4828	"2019-02-14 22:09:50.515"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2720	"2019-02-14 22:09:50.515"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2124	"2019-02-14 22:09:50.578"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3576	"2019-02-14 22:09:51.530"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	48	"2019-02-14 22:09:51.530"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	7780	"2019-02-14 22:09:52.045"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3844	"2019-02-14 22:09:52.403"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	48	"2019-02-14 22:09:53.589"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	48	"2019-02-14 22:09:55.633"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	6500	"2019-02-14 22:10:16.271"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
clamd log

Code: Select all

Thu Feb 14 21:06:10 2019 -> Database correctly reloaded (6937328 signatures)
Thu Feb 14 21:06:10 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:06:12 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:06:14 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:06:15 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:12:49 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:12:52 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:18:03 2019 -> SelfCheck: Database status OK.
Thu Feb 14 21:22:39 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:24:33 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:26:34 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:30:46 2019 -> SelfCheck: Database status OK.
Thu Feb 14 21:30:46 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:32:39 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:33:08 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:35:09 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:36:01 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:36:21 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:38:11 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:39:27 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:39:38 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:39:41 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:49:41 2019 -> SelfCheck: Database status OK.
Thu Feb 14 21:59:41 2019 -> SelfCheck: Database status OK.
Thu Feb 14 22:09:41 2019 -> SelfCheck: Database modification detected. Forcing reload.
Thu Feb 14 22:09:41 2019 -> Reading databases from c:\clamav\db
Thu Feb 14 22:09:41 2019 -> ERROR: reload db failed: Can't allocate memory
Thu Feb 14 22:09:41 2019 -> Terminating because of a fatal error.
Thu Feb 14 22:09:41 2019 -> Pid file removed.
Thu Feb 14 22:09:41 2019 -> --- Stopped at Thu Feb 14 22:09:41 2019
Thu Feb 14 22:10:42 2019 -> +++ Started at Thu Feb 14 22:10:42 2019
Thu Feb 14 22:10:42 2019 -> Received 0 file descriptor(s) from systemd.
Thu Feb 14 22:10:42 2019 -> clamd daemon 0.101.1 (OS: win32, ARCH: i386, CPU: i386)
Thu Feb 14 22:10:42 2019 -> Log file size limited to 1048576 bytes.
Thu Feb 14 22:10:42 2019 -> Reading databases from c:\clamav\db
Thu Feb 14 22:10:42 2019 -> Not loading PUA signatures.
Thu Feb 14 22:10:42 2019 -> Bytecode: Security mode set to "TrustSigned".
Thu Feb 14 22:11:02 2019 -> Loaded 6937445 signatures.
Thu Feb 14 22:11:04 2019 -> TCP: Bound to [127.0.0.1]:3310
Thu Feb 14 22:11:04 2019 -> TCP: Setting connection queue length to 200
Thu Feb 14 22:11:04 2019 -> Limits: Global size limit set to 104857600 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: File size limit set to 26214400 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: Recursion level limit set to 16.
Thu Feb 14 22:11:04 2019 -> Limits: Files limit set to 10000.
Thu Feb 14 22:11:04 2019 -> Limits: MaxEmbeddedPE limit set to 10485760 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: MaxHTMLNormalize limit set to 10485760 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: MaxHTMLNoTags limit set to 2097152 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: MaxScriptNormalize limit set to 5242880 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: MaxZipTypeRcg limit set to 1048576 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: MaxPartitions limit set to 50.
Thu Feb 14 22:11:04 2019 -> Limits: MaxIconsPE limit set to 100.
Thu Feb 14 22:11:04 2019 -> Limits: MaxRecHWP3 limit set to 16.
Thu Feb 14 22:11:04 2019 -> Limits: PCREMatchLimit limit set to 100000.
Thu Feb 14 22:11:04 2019 -> Limits: PCRERecMatchLimit limit set to 2000.
Thu Feb 14 22:11:04 2019 -> Limits: PCREMaxFileSize limit set to 26214400.
Thu Feb 14 22:11:04 2019 -> Archive support enabled.
Thu Feb 14 22:11:04 2019 -> AlertExceedsMax heuristic detection disabled.
Thu Feb 14 22:11:04 2019 -> Heuristic alerts enabled.
Thu Feb 14 22:11:04 2019 -> Portable Executable support enabled.
Thu Feb 14 22:11:04 2019 -> ELF support enabled.
Thu Feb 14 22:11:04 2019 -> Mail files support enabled.
Thu Feb 14 22:11:04 2019 -> OLE2 support enabled.
Thu Feb 14 22:11:04 2019 -> PDF support enabled.
Thu Feb 14 22:11:04 2019 -> SWF support enabled.
Thu Feb 14 22:11:04 2019 -> HTML support enabled.
Thu Feb 14 22:11:04 2019 -> XMLDOCS support enabled.
Thu Feb 14 22:11:04 2019 -> HWP3 support enabled.
Thu Feb 14 22:11:04 2019 -> Self checking every 600 seconds.

Re: ClamAV hangs server

Posted: 2019-02-15 09:09
by RvdH
FYI: I have both VirusScan and Spam checking Maximums set to: 2048 for Maximum message size to virus scan (KB) in hmailServer

Now i think of it, isn't it a bit of waste of resources on the server to use both ClamAV in hmailserver and enable clamav.pm in SpamAssassin?
Each message is checked twice that way i think, right?

I disabled clamav.pm for now... as looking at the logs i believe it was SpamAssassin clamav.pm that started the trouble... The WinSock error code is 121 :!: :?:

Re: ClamAV hangs server

Posted: 2019-02-15 10:11
by jimimaseye
My thoughts and observations:

Yes, I was going to point out that the initial logs show the error was with SA (as you have already noticed). I know that Mattg user the clamav.pm for helping with his scoring system but yes it does mean that all messages are scanned twice. I guess you only need it if you you are putting you virus removals in the hands of the SA scoring system and therefore do not need the AV check. (Personally I dont see the point but that's just my preference).

Ive checked my system and there were no issues yesterday at all. BUT.......

....I am mindful that I have yet NOT allowed this months windows updates (I now wait some weeks to see other peoples experiences). You will remember we got burnt last year by that update that rendered to service useless when trying to stop it and the update need backing out (and patching by Microsoft). So could it be a similar thing happening here? Did you have windows updates go through this week and therefore could that be the cause (with it being a winsock error)?

Re: ClamAV hangs server

Posted: 2019-02-15 11:20
by RvdH
Yes, I installed updates this week...yesterday after 23:00, so that can't be the issue ;)
I have enabled debug login for clamd for the time being...lets see what happens

Btw, memory usage on this particular server is almost constantly somewhere between 80 and 84%, could it be a lack of free memory?

EDIT: ah...maybe it is related to this reported problems
https://lists.gt.net/clamav/users/73856#73856

Re: ClamAV hangs server

Posted: 2019-02-15 14:54
by SorenR
Just for the record, I'm still on 0.99.2 and the following SaneSecurity extensions..

Code: Select all

rsync://rsync.sanesecurity.net/sanesecurity;phish.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;rogue.hdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;sanesecurity.ftm;N;N;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;sigwhitelist.ign2;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;blurl.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;malwarehash.hsb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;hackingteam.hsb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;foxhole_generic.cdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;foxhole_filename.cdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;foxhole_js.cdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;winnow_malware.hdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;winnow_malware_links.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;winnow_extended_malware.hdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;winnow_extended_malware_links.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;scamnailer.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;crdfam.clamav.hdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;bofhland_cracked_URL.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;bofhland_malware_URL.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;bofhland_phishing_URL.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;bofhland_malware_attach.hdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;phishtank.ndb;N;Y;Y;N;N
No problems with database for at least 3 months back.

I too use ClamAV via SpamAssassin and must admit that I am thinking of killing ClamAV via hMailServer as 99% of my ClamAV hits come via SpamAssassin.

Looking at the ClamAV logs I see "stream" and "instream" connections so I presume hMailServer and SpamAssassin connect differently.

On a side note... Something must have changed as (still on hMail 5.4.2) when ClamAV fails on my server all I get is a note in the log and that's it. Does not block SMTP, it just don't get checked ;-)

Re: ClamAV hangs server

Posted: 2019-02-15 15:37
by jimimaseye
I'm on 0.99.4 and can't say in aware of any problems... ever. (Caveat: my logging is minimal and i don't look at my server much)

[Entered by mobile. Excuse my spelling.]

Re: ClamAV hangs server

Posted: 2019-02-15 19:10
by palinka
SorenR wrote:
2019-02-15 14:54
I too use ClamAV via SpamAssassin and must admit that I am thinking of killing ClamAV via hMailServer as 99% of my ClamAV hits come via SpamAssassin.
Does SA delete the attachment? I thought it just assigned a score. I rather prefer the slightly safer road of deleting the attachment. I changed my settings from hmailserver delete message to delete attachment after I added clamav scoring to SA. I wanted to see how it works (SA reason in message headers). It works but I don't believe it deletes anything - just gives the message a score.

Re: ClamAV hangs server

Posted: 2019-02-15 20:07
by RvdH
palinka wrote:
2019-02-15 19:10
SorenR wrote:
2019-02-15 14:54
I too use ClamAV via SpamAssassin and must admit that I am thinking of killing ClamAV via hMailServer as 99% of my ClamAV hits come via SpamAssassin.
Does SA delete the attachment? I thought it just assigned a score. I rather prefer the slightly safer road of deleting the attachment. I changed my settings from hmailserver delete message to delete attachment after I added clamav scoring to SA. I wanted to see how it works (SA reason in message headers). It works but I don't believe it deletes anything - just gives the message a score.
If you score it high enough in ClamAV.cf and the message total score is above the Spam delete threshold in hmailserver the mail in question doesn't get thru at all :lol:

@soren
I think the stalling of SMTP is caused by The WinSock error code is 121

Re: ClamAV hangs server

Posted: 2019-02-15 20:16
by palinka
RvdH wrote:
2019-02-15 20:07
If you score it high enough in ClamAV.cf and the message total score is above the Spam delete threshold in hmailserver the mail in question doesn't get thru at all :lol:
Sorry, I should have mentioned that I set hmailserver delete threshold to 8,000. I forward all spam to myself for sorting. But, yes, ordinarily the message would be deleted based on high > delete threshold score.

Re: ClamAV hangs server

Posted: 2019-02-15 22:16
by SorenR
palinka wrote:
2019-02-15 19:10
SorenR wrote:
2019-02-15 14:54
I too use ClamAV via SpamAssassin and must admit that I am thinking of killing ClamAV via hMailServer as 99% of my ClamAV hits come via SpamAssassin.
Does SA delete the attachment? I thought it just assigned a score. I rather prefer the slightly safer road of deleting the attachment. I changed my settings from hmailserver delete message to delete attachment after I added clamav scoring to SA. I wanted to see how it works (SA reason in message headers). It works but I don't believe it deletes anything - just gives the message a score.
ClamAV via hMailServer = email tagged with "* VIRUS *" in INBOX - without attachment.
ClamAV via SpamAssassin = email tagged with "* VIRUS *" in SPAM folder - with attachment.

SPAM score >= 3.
All SPAM is copied to SPAMTrap user.
SPAM scored above 6 is deleted from normal user.
Remaining SPAM is moved to SPAM folder.

Re: ClamAV hangs server

Posted: 2019-02-15 22:36
by palinka
SorenR wrote:
2019-02-15 22:16
ClamAV via hMailServer = email tagged with "* VIRUS *" in INBOX - without attachment.
ClamAV via SpamAssassin = email tagged with "* VIRUS *" in SPAM folder - with attachment.
That's what I thought. 👍

Re: ClamAV hangs server

Posted: 2019-02-15 23:30
by jimimaseye
And this is partly why i personally don't like the ideas of this: a virus is unwanted. No ifs or buts. Why keep it attached for the potential of being opened? Why not have it deleted immediately and be done.

Argument: "because of false positives"

Response: how often? And and given the rarity, is that 1 in 1000 chance worth the risk of the other 999 being inadvertently opened?

[Entered by mobile. Excuse my spelling.] (And up the pub) 🤪

Re: ClamAV hangs server

Posted: 2019-02-16 15:36
by palinka
jimimaseye wrote:
2019-02-15 23:30
And this is partly why i personally don't like the ideas of this: a virus is unwanted. No ifs or buts. Why keep it attached for the potential of being opened? Why not have it deleted immediately and be done.

Argument: "because of false positives"

Response: how often? And and given the rarity, is that 1 in 1000 chance worth the risk of the other 999 being inadvertently opened?

[Entered by mobile. Excuse my spelling.] (And up the pub) 🤪
Right on. The good thing about deleting the attachment and still delivering the message is in the extremely rare case a false positive gets through, the user will know and be able to inquire why. And you're still safe in case it wasn't a false positive at all.

Re: ClamAV hangs server

Posted: 2019-02-17 00:45
by mattg
A little while back I changed my Spam routine.

I used to reject all above about 15 on my system, catch all 7-15 in Quarantine, and pass 6 and under (I have fairly high scores and deliberately inflate SpamAssassin Scores)

Now I accept and quarantine everything from 7 and up, with an account level rule that simply deletes the scores of 15 and above. This is to limit the backscatter emanating from my machine.

Because I now accept this mail in Spam terms, the messages get AV scanned which wasn't happening when I was rejecting large spam scores. This means that before the message gets deleted the attachment also gets removed first for anything that triggers the SaneSecurity list,

I have double AV on my server anyway, and CLAM only seems to find stuff with the SaneSecurity defs, so I'm thinking that I may not send all accepted mail through ClamAV direct from hMailserver.

Re: ClamAV hangs server

Posted: 2019-02-19 00:57
by jimimaseye
jimimaseye wrote:
2019-02-15 15:37
I'm on 0.99.4 and can't say in aware of any problems... ever. (Caveat: my logging is minimal and i don't look at my server much)

[Entered by mobile. Excuse my spelling.]
:oops: :oops: :oops: Oops.

Ive just checked my system. My Clam database hasnt updated since February 4th and nor has my nightly scheduled scan of the system. Very weird. I might have stopped/deleted the Clamtray process by mistake but didnt realise it.

That'll teach me.

Re: ClamAV hangs server

Posted: 2019-02-20 15:34
by SorenR
mattg wrote:
2019-02-17 00:45
A little while back I changed my Spam routine.

I used to reject all above about 15 on my system, catch all 7-15 in Quarantine, and pass 6 and under (I have fairly high scores and deliberately inflate SpamAssassin Scores)

Now I accept and quarantine everything from 7 and up, with an account level rule that simply deletes the scores of 15 and above. This is to limit the backscatter emanating from my machine.

Because I now accept this mail in Spam terms, the messages get AV scanned which wasn't happening when I was rejecting large spam scores. This means that before the message gets deleted the attachment also gets removed first for anything that triggers the SaneSecurity list,

I have double AV on my server anyway, and CLAM only seems to find stuff with the SaneSecurity defs, so I'm thinking that I may not send all accepted mail through ClamAV direct from hMailserver.
I got inspired ...

The "Disconnect(oClient.IPAddress)" thingy is a 30 second wait followed by the good old cPorts by Nirsoft.

No Backscatter AND no SPAM mails :mrgreen:
The ONLY situation I respond with a 550 is mail from a banned server/IP Range delivered via my Backup-MX.

The short ban time is an experiment to keep my ban-list short(er).

Code: Select all

   '
   '   Check SMTP traffic
   '
   If (InStr("|25|587|465|", oClient.Port) > 0) Then
      '
      '   SnowShoe SPAM detection
      '
      If IsSnowShoe(oClient.IPAddress) Then
         Call AutoBan(oClient.IPAddress, "SnowShoe", 12, "h")
         Disconnect(oClient.IPAddress)
         Exit Sub
      End If
      '
      '   LashBack SPAM detection
      '
      If IsLashBack(oClient.IPAddress) Then
         Call AutoBan(oClient.IPAddress, "LashBack", 12, "h")
         Disconnect(oClient.IPAddress)
         Exit Sub
      End If
      '
      '   Filter out "impatient" servers. Alternative to GreyListing.
      '
      If (oClient.Port = 25) Then Wait(20)
   End If

Re: ClamAV hangs server

Posted: 2019-05-25 21:55
by rob2k2
This one Ever solved?

I'm having same issue i think..

In my Clamd.log file.. i get this.. after it runs for 20 - 30 days usually.. It stop the delievery queue in hmailserver.. and mails just queue up..

SelfCheck: Database status OK.
ERROR: pthread_create failed
ERROR: pthread_create failed

Here is my post.. https://www.hmailserver.com/forum/viewt ... =7&t=33950

Re: ClamAV hangs server

Posted: 2019-05-30 12:27
by RvdH
Nope, but i only notice this behavior occasionally... maybe 1 or 2 times a month
Most times this issue fixes itself when a database modification is detected. Forcing a reload, followed by a crash and then a restart of the service

Do you experience this more regularly? What version of ClamAv are you on?

Re: ClamAV hangs server

Posted: 2019-05-30 13:34
by rob2k2
RvdH wrote:
2019-05-30 12:27
Nope, but i only notice this behavior occasionally... maybe 1 or 2 times a month
Most times this issue fixes itself when a database modification is detected. Forcing a reload, followed by a crash and then a restart of the service

Do you experience this more regularly? What version of ClamAv are you on?
I experience the behaviour once or twice a month as well.. but it hangs hmail delievery queue and never comes back.. messages are still accepted into the queue but delivery stops and the queue starts to fill until i reboot the server. i tried restarting hmail doesnt fix but i never tried restarting clamd service..

it never fixes itself.. or i havent waited that long. It never crashes or fixes itself.. i think longest was a few hours..

im running 0.99.4 clamd version as im doing clamwin updates

since then someone suggested i run clamd on another server.. as it should just timeout and not crash the delivery queue.. so im trying that.. so far so good only been a week though..

check out full post here https://www.hmailserver.com/forum/viewt ... =7&t=33950

Re: ClamAV hangs server

Posted: 2019-05-30 14:31
by RvdH
I use some additional sanesecurity definitions, these are updated more regular, at least once per hour it seems looking at my logs
With these the database modification is detected at least once every hour. Forcing a reload, followed by a ClamAv crash (ERROR: reload db failed: Can't allocate memory) and then a automatic restart of the service

So, the 'problem' on my system maximum takes about an hour, but most times it's just a few minutes as these hangs are complete random and not on set times

Re: ClamAV hangs server

Posted: 2019-05-30 15:13
by rob2k2
RvdH wrote:
2019-05-30 14:31
I use some additional sanesecurity definitions, these are updated more regular, at least once per hour it seems looking at my logs
With these the database modification is detected at least once every hour. Forcing a reload, followed by a ClamAv crash (ERROR: reload db failed: Can't allocate memory) and then a automatic restart of the service

So, the 'problem' on my system maximum takes about an hour, but most times it's just a few minutes as these hangs are complete random and not on set times
Ahh.. that makes sense.. mine is daily i think.. clamwin defaults.. Well if i'm up for the challenge maybe i'll try the sanesecurity updates.. I have seen that can't allocate memory error in my logs before.. I think that comes after ERROR: pthread_create failed.. when it tries to re-load the database.. then it crashes and restarts.. i think i may have seen that before in my logs.. (it may have fixed itself) but I didn't really notice it or make the connection at the time....

In my debug logs on hmail server it shows.. "DEBUG" 2240 "xxxx-xx-xx 06:55:02.744" "Connecting to ClamAV virus scanner..." (and if clamd has no more delivery threads) then it stops exectuing deliverytask until a server reboot.. (or maybe until it can connect again to clamav service). You think they would have put a timeout value in hmailserver.. so it gives up after awhile.. Clamd must still be accepting connections.. until it fixes itself.. If the problem continues on my other server i don't see this helping..

At any rate if running it on this other server doesn't fix the issue.. i guess my solution to this could be to do updates more frequently if calmwin supports it (that is if there is any changes to the database).. or update to sanesecurity definitions (hopefully this isn't too difficult).. or what i'm trying now.. running the clamd or clamav on a different server.. Someone said if you run it on a different server and it cant connect it should just time out.. Or it just skipped it in their environment. I'm testing this now.. Hopefully that is the case; but i'm not so sure with this threads issues.. and clamd still accepting the connection looks like..

I guess i'll wait and see.. i'll try and post back.. on my results.. so far its been working.. think its been a week or so..

Re: ClamAV hangs server

Posted: 2019-05-30 15:18
by rob2k2
rob2k2 wrote:
2019-05-30 15:13
RvdH wrote:
2019-05-30 14:31
I use some additional sanesecurity definitions, these are updated more regular, at least once per hour it seems looking at my logs
With these the database modification is detected at least once every hour. Forcing a reload, followed by a ClamAv crash (ERROR: reload db failed: Can't allocate memory) and then a automatic restart of the service

So, the 'problem' on my system maximum takes about an hour, but most times it's just a few minutes as these hangs are complete random and not on set times
Ahh.. that makes sense.. mine is daily i think.. clamwin defaults.. Well if i'm up for the challenge maybe i'll try the sanesecurity updates.. I have seen that can't allocate memory error in my logs before.. I think that comes after ERROR: pthread_create failed.. when it tries to re-load the database.. then it crashes and restarts.. i think i may have seen that before in my logs.. (it may have fixed itself) but I didn't really notice it or make the connection at the time....

In my debug logs on hmail server it shows.. "DEBUG" 2240 "xxxx-xx-xx 06:55:02.744" "Connecting to ClamAV virus scanner..." (and if clamd has no more delivery threads) then it stops executing deliverytask until a server reboot.. (or maybe until it can connect again to clamav service). You think they would have put a timeout value in hmailserver.. so it gives up after awhile.. Clamd must still be accepting connections.. until it fixes itself.. If the problem continues on my other server i don't see this helping..

At any rate if running it on this other server doesn't fix the issue.. i guess my solution to this could be to do updates more frequently if calmwin supports it (that is if there is any changes to the database).. or update to sanesecurity definitions (hopefully this isn't too difficult).. or what i'm trying now.. running the clamd or clamav on a different server.. Someone said if you run it on a different server and it cant connect it should just time out.. Or it just skipped it in their environment. I'm testing this now.. Hopefully that is the case; but i'm not so sure with this threads issues.. and clamd still accepting the connection looks like..

I guess i'll wait and see.. i'll try and post back.. on my results.. so far its been working.. think its been a week or so..
For now i've changed my updates to hourly.. in calmwin (didn't realize this was an option).. If there aren't any updates though.. i'm not sure if clamd will detect a change.. or not.. so not sure if this will help..

Anyways will post back as another possible work around ( running from different server). I think the problem is with the build it self.. clamd build.. but i can't go back to clamwin.. it was burning out my cpu.. and emails were too slow.. so much better.. i know clamwin updates aren't that effective.. but i still get a few detections a month with clamav.. so to me it's worth running..

Re: ClamAV hangs server

Posted: 2019-05-30 16:02
by RvdH
In "ClamWin Free Antivirus Scanner Service" service properties under tab "Recovery" I have set First and Second Failure to restart the service, so that's been triggered as soon the service terminates
(Subsequent failures I left as is, eg: Take no action)

Re: ClamAV hangs server

Posted: 2019-05-30 21:40
by rob2k2
RvdH wrote:
2019-05-30 16:02
In "ClamWin Free Antivirus Scanner Service" service properties under tab "Recovery" I have set First and Second Failure to restart the service, so that's been triggered as soon the service terminates
(Subsequent failures I left as is, eg: Take no action)
I dont think i ever set this in the past for this service.

The thought crossed my mind before - when i disabled the service on the same server running hmail before i installed on different server. I wondered if maybe i should set this...

But I figured because the program wasn't crashing it wouldnt help.. it would have perhaps if i did updates more frequently then daily before; but this should help if it crashes now and i have updates set to one hour..

Thank you for the post and for your suggestions.. ill post an update to this.. to see how its working out. Can't Thank you enough..

I put subsequent failures to restart as well though.. not just the first two just incase it fails frequently.. Thank you!

Re: ClamAV hangs server

Posted: 2019-07-03 15:12
by rob2k2
I just want to post back that this resolved the issue.. No more server hangs.. and the service is still running on the other server. i didn't dig though the logs to see if it has crashed at all and restarted. But if it did it started backup.. as its still scanning mail. Its caught a few virus' as well - Thanks for all your help everyone.