Add a New Comment Rich Markup
Sorry for delay, i tried to upgrade the kernel from 2.6.22 to 2.6.25 in order to have dazuko built in, and it took me a lot of time to correct some bugs. One of those was dazuko-related because in the Fedora Kernel 2.6.25, in the include file sched.h, one component of structure task_struct was missing and the kernel could not get compiled: struct task_struct parent; / parent process */. This component is in the vanilla kernel but not in the fedora patched one. So i simply added it manually, don't know if i made a mess.... but the i compiled the new kernel and installed. So clamav starts again and is able to register with dazuko. I tried then to follow Your suggestions (created /tmp/test directory, stored eicar file there and opened with vi, set clamav to look only in that directory), but results are the same, with both kernels (2.6.22 where dazuko is loaded as a module, and 2.6.25 where dazuko is built in). Really i don't know what the problem can be.... for the moment i disabled the VirusEvent in clamd.conf file. Again, sorry for delay, Giuliano
The important thing about the test I mentioned is not that eicar is in /tmp/test but rather that /tmp/test is the ONLY directory watched by Dazuko. Do not include ANY OTHER directory. The system should not hang then.
Well, i have only my desktop, i wrote a simple script that installs dazuko and starts clamav daemon (See attached file), so only one daemon registers. I have also attached the clamd.conf. I have tried to put eicar file anywhere on my system , but results are the same. Strange thing is that when i try to open, the system hangs up immediately, i mean, after reboot there is nothing about the test signature found in any log (clamd log and system logs as well). I have also tried with clamav gui, i.e. klamav, to check if my clamd.conf file was wrong somewhere. Klamav starts a new daemon by itself with a different conf file (i shutdown my clamav daemon through SHUTDOWN command before running klamav, so that only one daemon runs on the system). Well, results are similar, when i enable the auto-scan and try to open eicar file system freezes. And it freezes if i disable auto-scan as well. (file #16646, file #16647)
I am not familiar with that feature in ClamAV. Are you able to control how many ClamAV daemons register with Dazuko? If yes, you may want to set it higher. My guess is that VirusEvent is actually causing file events and if no other ClamAV daemons are handling events, the system can deadlock. The strange thing is that you aren't including any paths that should have any relation to binaries. Have you tried only including something like "/tmp/test" and accessing eicar.com in that directory? Does it still hang?
I have installed Fedora core 6 and compiled kernel 2.6.22 with directives found on this site in order to correctly install dazuko (Capabilities loaded as a module). Dazuko compiling and installation worked. I was also able to to correctly register clamav daemon with Dazuko. My problem is that if i enable the "VirusEvent" in the clamd.conf file whenever a virus is found (i tried to open eicar test file on my Desktop), system hangs up, totally!!! I have to switch power button in order to boot system again. I tried to find solutions in the clamav site (check bug #1045) but actually they say that it looks like a Dazuko problem. If i disable the Virus event, then the access to eicar file is disabled and everything goes fine, but of course that's not (not only) what i want!! I have also upgraded to the last version of Dazuko (tried both Dazuko 2.3.5 and 2.3.6-pre2, behaviour is the same). Any ideas? Here the log file when daemon starts: Mon Oct 6 23:32:54 2008 -> +++ Started at Mon Oct 6 23:32:54 2008 Mon Oct 6 23:32:54 2008 -> clamd daemon 0.94 (OS: linux-gnu, ARCH: i386, CPU: i686) Mon Oct 6 23:32:54 2008 -> Log file size limited to 1048576 bytes. Mon Oct 6 23:32:54 2008 -> Reading databases from /usr/share/clamav Mon Oct 6 23:32:54 2008 -> Included PUA categories:Mon Oct 6 23:32:54 2008 -> SpyMon Oct 6 23:32:54 2008 -> ScannerMon Oct 6 23:32:54 2008 -> RATMon Oct 6 23:32:54 2008 -> Mon Oct 6 23:32:57 2008 -> Loaded 436651 signatures. Mon Oct 6 23:32:57 2008 -> TCP: Bound to address 127.0.0.1 on port 3310 Mon Oct 6 23:32:57 2008 -> TCP: Setting connection queue length to 15 Mon Oct 6 23:32:57 2008 -> LOCAL: Unix socket file /tmp/clamd.socket Mon Oct 6 23:32:57 2008 -> LOCAL: Setting connection queue length to 15 Mon Oct 6 23:32:57 2008 -> Listening daemon: PID: 2627 Mon Oct 6 23:32:57 2008 -> Limits: Global size limit set to 104857600 bytes. Mon Oct 6 23:32:57 2008 -> Limits: File size limit set to 26214400 bytes. Mon Oct 6 23:32:57 2008 -> Limits: Recursion level limit set to 16. Mon Oct 6 23:32:57 2008 -> Limits: Files limit set to 10000. Mon Oct 6 23:32:57 2008 -> Archive support enabled. Mon Oct 6 23:32:57 2008 -> Algorithmic detection enabled. Mon Oct 6 23:32:57 2008 -> Portable Executable support enabled. Mon Oct 6 23:32:57 2008 -> ELF support enabled. Mon Oct 6 23:32:57 2008 -> Mail files support enabled. Mon Oct 6 23:32:57 2008 -> OLE2 support enabled. Mon Oct 6 23:32:57 2008 -> PDF support enabled. Mon Oct 6 23:32:57 2008 -> HTML support enabled. Mon Oct 6 23:32:57 2008 -> Self checking every 600 seconds. Mon Oct 6 23:32:57 2008 -> Clamuko: Correctly registered with Dazuko. Mon Oct 6 23:32:57 2008 -> Clamuko: Scan-on-open mode activated. Mon Oct 6 23:32:57 2008 -> Clamuko: Included path /home/ciuccy/.mozilla/firefox/k4zo4ess.default Mon Oct 6 23:32:57 2008 -> Clamuko: Included path /home/ciuccy/.java/deployment/cache Mon Oct 6 23:32:57 2008 -> Clamuko: Included path /home/ciuccy/.java/deployment/tmp Mon Oct 6 23:32:57 2008 -> Clamuko: Included path /home/ciuccy/.java/deployment/ext Mon Oct 6 23:32:57 2008 -> Clamuko: Included path /home/ciuccy/Desktop Mon Oct 6 23:32:57 2008 -> Clamuko: Excluded path /home/ciuccy/downloads Mon Oct 6 23:32:57 2008 -> Clamuko: Excluded path /home/ciuccy/DIVX Mon Oct 6 23:32:57 2008 -> Clamuko: Excluded path /home/ciuccy/virus Mon Oct 6 23:32:57 2008 -> Clamuko: Excluded path /home/clamav Mon Oct 6 23:32:57 2008 -> Clamuko: Excluded path /proc Mon Oct 6 23:32:57 2008 -> Clamuko: Excluded path /sys Mon Oct 6 23:32:57 2008 -> Clamuko: Excluded path /usr/bin Mon Oct 6 23:32:57 2008 -> Clamuko: Excluded path /usr/sbin Mon Oct 6 23:32:57 2008 -> Clamuko: Excluded path /sbin Mon Oct 6 23:32:57 2008 -> Clamuko: Excluded path /bin Mon Oct 6 23:32:57 2008 -> Clamuko: Excluded path /tmp Mon Oct 6 23:32:57 2008 -> Clamuko: Excluded path /var/log Mon Oct 6 23:32:57 2008 -> Clamuko: Max file size limited to 1048576 bytes.
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
Depends on the following items: None found
Items that depend on this one: None found
Please enter the title of George Orwell's famous dystopian book (it's a date):
Follow 4 latest changes.
Copyright © 2023 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.12