1 (edited by hotpaganini 2016-03-26 09:37:03)

Topic: I CANT stop that stupid clamd!!

==== Required information ====
- iRedMail version (check /etc/iredmail-release): v0.9.4
- Linux/BSD distribution name and version: CentOS7
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MariaDB
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? no
- Related log if you're reporting an issue:
====

How disable that terrorist??? Killing ALL my memory and CPU! WTF??
Ok, I haven't any of clamav service such "clamd" or "freshclamd", so, nothing to disable. When I starting amavisd service, in proccess clamd appear. Ok, I disabled in amavisd.conf @bypass_virus_checks_maps = (1); (removed comment sign), trying and (1), and (0)... I commented

@av_scanners = (
    #### http://www.clamav.net/
   ['ClamAV-clamd',
    \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamd.amavisd/clamd.socket"],
    qr/\bOK$/, qr/\bFOUND$/,
    qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
);

changed to

@av_scanners = (
    #### http://www.clamav.net/
#   ['ClamAV-clamd',
#    \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamd.amavisd/clamd.socket"],
#   qr/\bOK$/, qr/\bFOUND$/,
#   qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
);

So. NO RESULT!!!! I starting amavisd and... clamd process appears in htop, with 100% CPU.

I so tired to fight with clamd. Please, tell me, how REALLY kill FOREVER clamd? Why this shit-program starting???
So, now I sitting without amavisd and DKIM and Spamassasin.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: I CANT stop that stupid clamd!!

*) On RHEL/CentOS 7, the service name is "clamd@amavisd". To stop it, try:

systemctl disable 'clamd@amavisd'

*) Add "@bypass_virus_checks_maps = (1);" in Amavisd config file to disable virus scanning.

3

Re: I CANT stop that stupid clamd!!

ZhangHuangbin wrote:

*) On RHEL/CentOS 7, the service name is "clamd@amavisd". To stop it, try:

systemctl disable 'clamd@amavisd'

*) Add "@bypass_virus_checks_maps = (1);" in Amavisd config file to disable virus scanning.

Sorry, but not working. I try to stop and disable clamd@amavisd, but status - active. Below my terminal log. Very strange situation.

Authenticating with public key "imported-openssh-key"
Last login: Sat Mar 26 04:27:07 2016 from

Try to disable clamav:

[r@local ~]# systemctl disable 'clamd@amavisd'

Checking status:

[r@local ~]# systemctl status 'clamd@amavisd'
● clamd@amavisd.service - clamd scanner (amavisd) daemon
   Loaded: loaded (/usr/lib/systemd/system/clamd@.service; disabled; vendor pres                                                            et: disabled)
   Active: inactive (dead) since Sat 2016-03-26 04:27:22 MSK; 1h 29min ago
Main PID: 1019 (code=killed, signal=TERM)

Mar 26 04:26:47 local.frgh.ru systemd[1]: Started clamd scanner (am...
Mar 26 04:26:47 local.frgh.ru systemd[1]: Starting clamd scanner (a...
Mar 26 04:26:48 local.frgh.ru clamd[1019]: clamd daemon 0.99 (OS: l...
Mar 26 04:26:48 local.frgh.ru clamd[1019]: Running as user amavis (...
Mar 26 04:26:48 local.frgh.ru clamd[1019]: Log file size limited to...
Mar 26 04:26:48 local.frgh.ru clamd[1019]: Reading databases from /...
Mar 26 04:26:48 local.frgh.ru clamd[1019]: Not loading PUA signatures.
Mar 26 04:26:48 local.frgh.ru clamd[1019]: Bytecode: Security mode ...
Mar 26 04:27:22 local.frgh.ru systemd[1]: Stopping clamd scanner (a...
Mar 26 04:27:22 local.frgh.ru systemd[1]: Stopped clamd scanner (am...
Hint: Some lines were ellipsized, use -l to show in full.

Searching another instances of amavisd.conf:

[r@local ~]# find / -name amavisd.conf
/etc/amavisd/amavisd.conf
/etc/clamd.d/amavisd.conf

Ok, there is only one. Lets try to start amavisd...

[r@local ~]# systemctl start amavisd

...and what with my system?..

[r@local ~]# top
top - 06:02:17 up  1:35,  2 users,  load average: 0.74, 0.24, 0.11
Tasks: 114 total,   5 running, 109 sleeping,   0 stopped,   0 zombie
%Cpu(s): 52.6 us,  4.1 sy,  0.0 ni,  0.0 id, 12.3 wa,  0.0 hi,  0.0 si, 31.0 st
KiB Mem :   857852 total,   123796 free,   635604 used,    98452 buff/cache
KiB Swap:        0 total,        0 free,        0 used.    51152 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S %CPU %MEM     TIME+ COMMAND

WHATTT?????? Clamd - 49.7%CPU and 38.6RAM?????
3235 amavis    20   0  418400 331152    324 R 49.7 38.6   0:08.82 clamd

3240 amavis    20   0  249648  34524   1276 R 10.4  4.0   0:00.49 amavisd
   25 root      20   0       0      0      0 D  1.9  0.0   0:00.22 kswapd0
   10 root      20   0       0      0      0 S  0.3  0.0   0:00.82 rcu_sched
  396 root      20   0  558848  10736    184 S  0.3  1.3   0:01.24 tuned
    1 root      20   0  139688   1824    372 R  0.0  0.2   0:02.18 systemd
    2 root      20   0       0      0      0 S  0.0  0.0   0:00.00 kthreadd
    3 root      20   0       0      0      0 S  0.0  0.0   0:00.02 ksoftirqd/0
    5 root       0 -20       0      0      0 S  0.0  0.0   0:00.00 kworker/0:0H
    6 root      20   0       0      0      0 S  0.0  0.0   0:00.03 kworker/u2:0
    7 root      rt   0       0      0      0 S  0.0  0.0   0:00.00 migration/0
    8 root      20   0       0      0      0 S  0.0  0.0   0:00.00 rcu_bh
    9 root      20   0       0      0      0 S  0.0  0.0   0:00.00 rcuob/0
   11 root      20   0       0      0      0 R  0.0  0.0   0:00.98 rcuos/0
   12 root      rt   0       0      0      0 S  0.0  0.0   0:00.04 watchdog/0
   13 root       0 -20       0      0      0 S  0.0  0.0   0:00.00 khelper
   14 root      20   0       0      0      0 S  0.0  0.0   0:00.00 kdevtmpfs

Really, this is disabled and "inactive" service? Checking...

[r@local ~]# systemctl status clamd@amavisd
-bash: fork: Cannot allocate memory

Hahahaha! (sadly)

[r@local ~]# systemctl stop clamd@alavisd
[r@local ~]# systemctl status clamd@amavisd

● clamd@amavisd.service - clamd scanner (amavisd) daemon
   Loaded: loaded (/usr/lib/systemd/system/clamd@.service; disabled; vendor preset: disabled)
   Active: active (running) since Sat 2016-03-26 06:05:09 MSK; 12s ago
Main PID: 3272 (clamd)
   CGroup: /system.slice/system-clamd.slice/clamd@amavisd.service
           └─3272 /usr/sbin/clamd -c /etc/clamd.d/amavisd.conf --nofork=yes

So, this service wan't to stop, or may be another process starting him? Lets check...
Stopping amavisd.

-bash-4.2# systemctl stop amavisd

-bash-4.2# systemctl status clamd@amavisd

● clamd@amavisd.service - clamd scanner (amavisd) daemon
   Loaded: loaded (/usr/lib/systemd/system/clamd@.service; disabled; vendor preset: disabled)
   Active: active (running) since Sat 2016-03-26 06:12:15 MSK; 9min ago
Main PID: 3528 (clamd)
   CGroup: /system.slice/system-clamd.slice/clamd@amavisd.service
           └─3528 /usr/sbin/clamd -c /etc/clamd.d/amavisd.conf --nofork=yes

Hmm... Clamav still working. Ok, trying to stop...

-bash-4.2# systemctl stop clamd@amavisd
-bash-4.2# systemctl status clamd@amavisd
● clamd@amavisd.service - clamd scanner (amavisd) daemon
   Loaded: loaded (/usr/lib/systemd/system/clamd@.service; disabled; vendor preset: disabled)
   Active: inactive (dead) since Sat 2016-03-26 06:22:00 MSK; 1s ago
  Process: 3528 ExecStart=/usr/sbin/clamd -c /etc/clamd.d/%i.conf --nofork=yes (code=exited, status=0/SUCCESS)
Main PID: 3528 (code=exited, status=0/SUCCESS)

WOW!!! Ok, only of amavisd dead, I can to stop clamd. Disabling not working. In conf -

# COMMONLY ADJUSTED SETTINGS:

@bypass_virus_checks_maps = (1);  # controls running of anti-virus code
# @bypass_spam_checks_maps  = (1);  # controls running of anti-spam code
# $bypass_decode_parts = 1;         # controls running of decoders&dearchivers

What goin' on???

Thank you in advice and sorry for long log

4

Re: I CANT stop that stupid clamd!!

hotpaganini wrote:

# top
...
3235 amavis    20   0  418400 331152    324 R 49.7 38.6   0:08.82 clamd

This is Amavisd daemon running as "clamd" user.