MailScanner: Cannot find Socket (/tmp/clamd) Exiting!

[alinford]

First off, mail is working, and is being both sent and received, so this issue is not stopping email delivery.

When looking at the Maillog, I get this error every 30 seconds or so:
MailScanner: Cannot find Socket (/tmp/clamd) Exiting!

Restarting Clamd and MailScanner services results in an'OK', and status shows them both running.
There is no tmp/clamd file, but there is a tmp/clamd.socket file of 0 KB. The time stamp for clamd.socket updates when restarting clamd, otherwise it does not change.
I tried upping etc/rc.d/init.d/clamd file ulimit -f 100000, but that did not make any difference.
I Enabled ClamAV Daemon in Service Manager (but left Monitor disabled). Both Enabled and Monitor are checked for clamav under Additional Services.

[Sarah]

If you installed mailscanner and clamav yourself, it sounds like you may have skipped one or more steps in the clamav installation. Instructions are here:
http://www.configserver.com/free/clamav.html

Sounds like at least this part was missed out:

Code: Select all

pico -w /usr/local/etc/clamd.conf

Change the following line:
#LocalSocket /tmp/clamd.socket

to this:

LocalSocket /tmp/clamd

[alinford]

Sarah - Thanks. That fixed the error
The issue happened when a server update enabled cPanel's built in Clamd, so I restored a couple of backups to fix things, and ended up restoring the wrong clamd.conf file.

Lines 83-93 now look like this:

Code: Select all

# Path to a local socket file the daemon will listen on.
# Default: disabled (must be specified by a user)
LocalSocket /tmp/clamd

# Sets the group ownership on the unix socket.
# Default: disabled (the primary group of the user running clamd)
#LocalSocketGroup virusgroup

# Sets the permissions on the unix socket to the specified mode.
# Default: disabled (socket is world accessible)
#LocalSocketMode 660

On the original clamd.conf that I should have restored, I noticed that Lines 83-93 look like this:

Code: Select all

# Path to a local socket file the daemon will listen on.
# Default: disabled (must be specified by a user)
LocalSocket /tmp/clamd

# Sets the group ownership on the unix socket.
# Default: disabled (the primary group of the user running clamd)
LocalSocket /tmp/clamd

# Sets the permissions on the unix socket to the specified mode.
# Default: disabled (socket is world accessible)
LocalSocket /tmp/clamd

2 Questions:
1. Was the original incorrect, or should I change those lines as well?
2. When the "Cannot find Socket (/tmp/clamd) Exiting!" error was occurring, was clamd not working?

[Sarah]

2 Questions:
1. Was the original incorrect, or should I change those lines as well?

Looks like your original file was incorrect. It should look like this:

Code: Select all

# Path to a local socket file the daemon will listen on.
# Default: disabled (must be specified by a user)
LocalSocket /tmp/clamd

# Sets the group ownership on the unix socket.
# Default: disabled (the primary group of the user running clamd)
#LocalSocketGroup virusgroup

# Sets the permissions on the unix socket to the specified mode.
# Default: disabled (socket is world accessible)
#LocalSocketMode 660

I don't think it would have caused any problems, though, because the missing settings are commented out and it was just repeating the LocalSocket setting.

2. When the "Cannot find Socket (/tmp/clamd) Exiting!" error was occurring, was clamd not working?

That's right. No virus scanning of email would have been happening during that time.

Regards,
Sarah

[aarondwyer]

Sorry to open up an old thread but I have this issue

I mistakenly installed clamav from the WHM plugins menu, then mailscanner stopped working. So I uninstalled clamav using the same WHM plugin area.

Now I'm getting this error in the logs.

MailScanner: Cannot find Socket (/tmp/clamd) Exiting!


And my /usr/local/etc/clamd.conf

Had the same issue with the repeated /tmp/clamd reference 3 times.

I changed the clamd.conf file and the error message is still there.

Anything else I can look at?

Thanks
Aaron

[Sarah]

The latest version of MailScanner and MSFE uses the WHM clamavconnector plugin, so you should no longer have this issue. Have you updated MailScanner and MSFE?

[aarondwyer]

Yes I have updated the Mailscanner and MSFE, but it looks like I don't have clamav installed.

In WHM under Manage Plugins there is no tick against this to be installed.

Name: clamavconnector
Author: cPanel Inc.
Version: 0.98.7-1.cp1154

I'm a bit lost sorry.

Tried to restart clamav

[root@mars ~]# /usr/local/cpanel/scripts/restartsrv_clamd
info [restartsrv_base] The system could not find required package 'cpanel-clamav' for service 'clamd'...
Service Error
(XID wse32y) The “clamd” service is not installed.

Startup Log
LibClamAV Warning: **************************************************
LibClamAV Warning: *** The virus database is older than 7 days! ***
LibClamAV Warning: *** Please update it as soon as possible. ***
LibClamAV Warning: **************************************************

clamd has failed. Contact your system administrator if the service does not automagically recover.


But looking in

/var/log/mailog

Aug 11 12:12:57 mars MailScanner: New Batch: Scanning 1 messages, 152363 bytes
Aug 11 12:12:57 mars MailScanner: Virus and Content Scanning: Starting
Aug 11 12:12:57 mars MailScanner: Clamd::ERROR:: COULD NOT CONNECT TO CLAMD, RECOMMEND RESTARTING DAEMON :: .
Aug 11 12:12:57 mars MailScanner: Virus Scanning: Clamd found 1 infections
Aug 11 12:12:57 mars MailScanner: Virus Scanning: Found 1 viruses

I'm now getting a different error, it looks like it's actually finding viruses.

Any ideas?

Thanks
Aaron

[Sarah]

If you updated MSFE it should have installed clamavconnector as part of the update. In the MSFE is there a button "force clamavconnector update"?

You could try installing clamavconnector in WHM > Manage Plugins. If you'd rather have us take a look then please submit a ticket on the helpdesk:
https://support.configserver.com/