mainDazuko - Support: sr #106515, system hangs up with clamav...

 
 

sr #106515: system hangs up with clamav antivirus

Submitter:  Giuliano Dal Forno <bivacz>
Submitted:  Thu 09 Oct 2008 06:52:27 PM UTC
   
 
Assigned to:  None Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 04 Nov 2008 02:12:10 PM UTC, comment #4: 

Sorry for delay, i tried to upgrade the kernel from 2.6.22 to 2.6.25 in order to have dazuko built in, and it took me a lot of time to correct some bugs. One of those was dazuko-related because in the Fedora Kernel 2.6.25, in the include file sched.h, one component of structure task_struct was missing and the kernel could not get compiled: 

struct task_struct parent; / parent process */.

This component is in the vanilla kernel but not in the fedora patched one. So i simply added it manually, don't know if i made a mess.... but the i compiled the new kernel and installed. So clamav starts again and is able to register with dazuko.

I tried then to follow Your suggestions (created /tmp/test directory, stored eicar file there and opened with vi, set clamav to look only in that directory), but results are the same, with both kernels (2.6.22 where dazuko is loaded as a module, and 2.6.25 where dazuko is built in).
Really i don't know what the problem can be.... for the moment i disabled the VirusEvent in clamd.conf file.

Again, sorry for delay, Giuliano

Giuliano Dal Forno <bivacz>
Sat 11 Oct 2008 07:20:50 AM UTC, comment #3: 

The important thing about the test I mentioned is not that eicar is in /tmp/test but rather that /tmp/test is the ONLY directory watched by Dazuko. Do not include ANY OTHER directory. The system should not hang then.

John Ogness <ogman>
Group administrator
Fri 10 Oct 2008 07:50:58 AM UTC, comment #2: 

Well, i have only my desktop, i wrote a simple script that installs dazuko and starts clamav daemon (See attached file), so only one daemon registers. I have also attached the clamd.conf.

I have tried to put eicar file anywhere on my system , but results are the same. Strange thing is that when i try to open, the system hangs up immediately, i mean, after reboot there is nothing about the test signature found in any log (clamd log and system logs as well). I have also tried with clamav gui, i.e. klamav, to check if my clamd.conf file was wrong somewhere. Klamav starts a new daemon by itself with a different conf file (i shutdown my clamav daemon through SHUTDOWN command before running klamav, so that only one daemon runs on the system). Well, results are similar, when i enable the auto-scan and try to open eicar file system freezes. And it freezes if i disable auto-scan as well.


(file #16646, file #16647)

Giuliano Dal Forno <bivacz>
Thu 09 Oct 2008 08:28:22 PM UTC, comment #1: 

I am not familiar with that feature in ClamAV. Are you able to control how many ClamAV daemons register with Dazuko? If yes, you may want to set it higher. My guess is that VirusEvent is actually causing file events and if no other ClamAV daemons are handling events, the system can deadlock.

The strange thing is that you aren't including any paths that should have any relation to binaries. Have you tried only including something like "/tmp/test" and accessing eicar.com in that directory? Does it still hang?

John Ogness <ogman>
Group administrator
Thu 09 Oct 2008 06:52:27 PM UTC, original submission:  

I have installed Fedora core 6 and compiled kernel 2.6.22 with directives found on this site in order to correctly install dazuko (Capabilities loaded as a module). Dazuko compiling and installation worked. I was also able to to correctly register clamav daemon with Dazuko. My problem is that if i enable the "VirusEvent" in the clamd.conf file whenever a virus is found (i tried to open eicar test file on my Desktop), system hangs up, totally!!! I have to switch power button in order to boot system again. I tried to find solutions in the clamav site (check bug #1045) but actually they say that it looks like a Dazuko problem. If i disable the Virus event, then the access to eicar file is disabled and everything goes fine, but of course that's not (not only) what i want!! I have also upgraded to the last version of Dazuko (tried both Dazuko 2.3.5 and 2.3.6-pre2, behaviour is the same). Any ideas?

Here the log file when daemon starts:
Mon Oct  6 23:32:54 2008 -> +++ Started at Mon Oct  6 23:32:54 2008
Mon Oct  6 23:32:54 2008 -> clamd daemon 0.94 (OS: linux-gnu, ARCH: i386, CPU: i686)
Mon Oct  6 23:32:54 2008 -> Log file size limited to 1048576 bytes.
Mon Oct  6 23:32:54 2008 -> Reading databases from /usr/share/clamav
Mon Oct  6 23:32:54 2008 -> Included PUA categories:Mon Oct  6 23:32:54 2008 ->  SpyMon Oct  6 23:32:54 2008 ->  ScannerMon Oct  6 23:32:54 2008 ->  RATMon Oct  6 23:32:54 2008 ->
Mon Oct  6 23:32:57 2008 -> Loaded 436651 signatures.
Mon Oct  6 23:32:57 2008 -> TCP: Bound to address 127.0.0.1 on port 3310
Mon Oct  6 23:32:57 2008 -> TCP: Setting connection queue length to 15
Mon Oct  6 23:32:57 2008 -> LOCAL: Unix socket file /tmp/clamd.socket
Mon Oct  6 23:32:57 2008 -> LOCAL: Setting connection queue length to 15
Mon Oct  6 23:32:57 2008 -> Listening daemon: PID: 2627
Mon Oct  6 23:32:57 2008 -> Limits: Global size limit set to 104857600 bytes.
Mon Oct  6 23:32:57 2008 -> Limits: File size limit set to 26214400 bytes.
Mon Oct  6 23:32:57 2008 -> Limits: Recursion level limit set to 16.
Mon Oct  6 23:32:57 2008 -> Limits: Files limit set to 10000.
Mon Oct  6 23:32:57 2008 -> Archive support enabled.
Mon Oct  6 23:32:57 2008 -> Algorithmic detection enabled.
Mon Oct  6 23:32:57 2008 -> Portable Executable support enabled.
Mon Oct  6 23:32:57 2008 -> ELF support enabled.
Mon Oct  6 23:32:57 2008 -> Mail files support enabled.
Mon Oct  6 23:32:57 2008 -> OLE2 support enabled.
Mon Oct  6 23:32:57 2008 -> PDF support enabled.
Mon Oct  6 23:32:57 2008 -> HTML support enabled.
Mon Oct  6 23:32:57 2008 -> Self checking every 600 seconds.
Mon Oct  6 23:32:57 2008 -> Clamuko: Correctly registered with Dazuko.
Mon Oct  6 23:32:57 2008 -> Clamuko: Scan-on-open mode activated.
Mon Oct  6 23:32:57 2008 -> Clamuko: Included path /home/ciuccy/.mozilla/firefox/k4zo4ess.default
Mon Oct  6 23:32:57 2008 -> Clamuko: Included path /home/ciuccy/.java/deployment/cache
Mon Oct  6 23:32:57 2008 -> Clamuko: Included path /home/ciuccy/.java/deployment/tmp
Mon Oct  6 23:32:57 2008 -> Clamuko: Included path /home/ciuccy/.java/deployment/ext
Mon Oct  6 23:32:57 2008 -> Clamuko: Included path /home/ciuccy/Desktop
Mon Oct  6 23:32:57 2008 -> Clamuko: Excluded path /home/ciuccy/downloads
Mon Oct  6 23:32:57 2008 -> Clamuko: Excluded path /home/ciuccy/DIVX
Mon Oct  6 23:32:57 2008 -> Clamuko: Excluded path /home/ciuccy/virus
Mon Oct  6 23:32:57 2008 -> Clamuko: Excluded path /home/clamav
Mon Oct  6 23:32:57 2008 -> Clamuko: Excluded path /proc
Mon Oct  6 23:32:57 2008 -> Clamuko: Excluded path /sys
Mon Oct  6 23:32:57 2008 -> Clamuko: Excluded path /usr/bin
Mon Oct  6 23:32:57 2008 -> Clamuko: Excluded path /usr/sbin
Mon Oct  6 23:32:57 2008 -> Clamuko: Excluded path /sbin
Mon Oct  6 23:32:57 2008 -> Clamuko: Excluded path /bin
Mon Oct  6 23:32:57 2008 -> Clamuko: Excluded path /tmp
Mon Oct  6 23:32:57 2008 -> Clamuko: Excluded path /var/log
Mon Oct  6 23:32:57 2008 -> Clamuko: Max file size limited to 1048576 bytes.

Giuliano Dal Forno <bivacz>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #16646:  clamd_daemon added by bivacz (3KiB - application/octet-stream)
file #16647:  clamd.conf added by bivacz (12KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ogman (Posted a comment)
  • -email is unavailable- added by bivacz (Submitted the item)
  •  

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-03-19 ogman Assigned toogman None
    2008-10-10 bivacz Attached File- Added clamd_daemon, #16646
        Attached File- Added clamd.conf, #16647
    2008-10-09 ogman Assigned toNone ogman

    Back to the top

    Powered by Savane 3.13-0329.
    Corresponding source code