Pegasus Mail & Mercury

I am very satisfied with the detection rate of ClamWall running under Mercury on my Server 2003 platform. Not only viruses, but using the SaneSecurity signatures, hundreds of Phishing messages and other scams also eliminated.

What is a matter of concerned is that, perhaps once a month or so, ClamD seems to get itself into trouble and fail. The only way that I become aware of it is by checking the ClamWall logs and finding the "ClamD not responding!" line. Sometimes it appears that ClamD is not running, but manually starting it by double-clicking on the executable in clamav\bin does the trick. Alternatively, sometimes ClamD appears as a hung process or application, and stopping it via the Task Manager is required.

 

Has anyone on the list had a similar experience?  Any ideas on how to be alerted as soon as there is a failure?

 

 

What about a filtering rule to check for the X-CLAMWALL header on incoming mail?

If it's NOT there "Run a Program" calling a batch script to kill & restart the clamd daemon.

 

EDIT:

X-CLAMWALL header is inserted by Clamwall even if clamd fails to respond ...GRRR

Plan B: Periodically run a script to scan a small test file against clamd and check for a proper reply then kill & restart if necessary.

If Lucas (or anyone who knows) knows of a win app to scan using STREAM (as clamwall does) to the clamd TCP port, I would love to get hold of it. 

pbeddy:

Has anyone on the list had a similar experience?  Any ideas on how to be alerted as soon as there is a failure?

Yes, but rarely, and no.  The way clamd listens on the port doesn't make it easy for automated tests (like serversalive) to check if it's working.

dilberts_left_nut:

If Lucas (or anyone who knows) knows of a win app to scan using STREAM (as clamwall does) to the clamd TCP port, I would love to get hold of it. 

ClamDScan.exe? :)

Best regards

Nico

From what I can gather clamdscan just passes the path\filename to clamd which then goes and scans the file(s)

What I am after is something to STREAM the file to the TCP port for scanning (as clamwall seems to from the clamd log file).

This would allow me to run 1 clamd server on the network for streaming clients to use rather that a clamav install on each machine.

dilberts_left_nut:

From what I can gather clamdscan just passes the path\filename to clamd which then goes and scans the file(s)

What I am after is something to STREAM the file to the TCP port for scanning (as clamwall seems to from the clamd log file).

This would allow me to run 1 clamd server on the network for streaming clients to use rather that a clamav install on each machine.

Ah I see. Well, ClamDscan is able to scan by STREAM if '-' as the filename is used. Then ClamDscan streams STDIN to the ClamD daemon. Still it won't help much in your case and I know of no other Win32 solution which is able to stream to a ClamD daemon on a different server. There's a Unix stream client for ClamD on sourceforge which does that but as far as I remember it doesn't compile under Cygwin because the Addrinfo structure which it uses is not implemented there. It would probably run under Cygwin if the GetHostByName/Addr functions are used instead (haven't tried to compile it under MSVC yet).

Best regards

Nico

pbeddy:

Has anyone on the list had a similar experience?

No but I don't run ClamWall.

pbeddy:

Any ideas on how to be alerted as soon as there is a failure?

I've written a small script now which checks if ClamD responds and if not, kills ClamD if it exists and restarts it afterwards. It's here:

http://hideout.ath.cx/clamav/clamdog.zip

Hope it helps

Best regards

Nico

Thanks Nico, trying it out now.

Ditto to that. I am very grateful for everyone's input on my problem and the solution that Nico has given us.