Clamd file size limit exceeded?

[TheTechGuide]

I just started using Mailscanner/Mailscanner FE about a month ago, ConfigServer installed it for me. I'm using version 4.74.16, and version v0.94.2 of ClamAV; CENTOS 5.2, cPanel 11.24.4

There have been no updates to the server, and CP updates are run manually. This evening at 5pm clamd stopped and will not start. I've tried the following things:
restarted mailscanner
run freshclam (it runs with no errors)
forced a re-install through the Mailscanner FE of ClamAV.

When I try service clamd start, I receive the error:
Starting clamd: /bin/bash: line 1: 16264 File size limit exceeded/usr/local/sbin/clamd

Any ideas why this has started happening and how it could be fixed? Thank you for any ideas!

[TheTechGuide]

I am seeing some other mailscanner/clamav errors in the logs, but I'm not sure where to go from here to solve the problem:
Cannot find Socket (/tmp/clamd) Exiting! : 70 Time(s)
Cannot lock /var/spool/MailScanner/incoming/Locks/clamavBusy.lock, No such file or directory : 3 Time(s)
Error in configuration file line 2755, directory /var/spool/MailScanner/incoming/Locks for lockfiledir does not exist (or is not readable) : 1 Time(s)
Could not read directory /var/spool/MailScanner/incoming/Locks : 1 Time(s)
Found /tmp/clamd but it is not a valid UNIX Socket. Exiting : 1 Time(s)

[Sarah]

We've had a couple of people with this same issue but have not been able to see this on a server ourselves. If you're willing to let us have a look, please log a support ticket on our helpdesk with server access info. Thanks!

Regards,
Sarah

[Sarah]

If anyone else is having the problem that clamd will not start because of file size limit exceeded, here is the solution:

1. Edit the file /etc/init.d/clamd

Change the following line:

Code: Select all

ulimit -f 20000

to

Code: Select all

ulimit -f 30000

Save the file.

2. Restart clamd with

Code: Select all

service clamd restart

It should start without problems. If it doesn't start, check that your /tmp directory is not full. You can remove any directories that start with "clamav":

Code: Select all

rm -Rfv /tmp/clamav-*

3. Then restart MailScanner with

Code: Select all

service MailScanner restart

Please note, you may not actually see any errors about file size limits, but instead you may just see an error that the /tmp/clamd socket cannot be found, or just notice that chkservd is trying to restart clamav every 8 minutes. Try this solution to see if the file size limit is the problem.

Regards,
Sarah

[Ski_K2]

I started having this clamav issue this morning and tried this fix.

So far it seems to have resolved my clamav not starting issue

cPanel 11.24.4-S35075 - WHM 11.24.2 - X 3.9
REDHAT Enterprise 5.2 i686 standard

Thanks

[pli]

I started having this clamav issue this morning and tried this fix.

So far it seems to have resolved my clamav not starting issue

cPanel 11.24.4-S35075 - WHM 11.24.2 - X 3.9
REDHAT Enterprise 5.2 i686 standard

Thanks

I had this too and Sarah suggestion fixed it. It was quickly filling up my /tmp directory to the extent that some sites were not running.
Thanks Sarah

Peter

[pwsowner]

Change the following line:

Code: Select all

ulimit -f 20000

to

Code: Select all

ulimit -f 30000

Thanks. I just suddenly started getting "clamav failed" emails an hour ago. I tried a force upgrade, as well as a few other ideas, then a search took me to this thread. I went to edit and noticed mine was already set to 30000 so I changed it to 40000 and that fixed it.

If it's not too complicated, could you explain what makes this increase necessary?

[cmajkrzak]

As what happened to pwsowner, my CPanel box just started doing this very early this morning (Centos 5.2). My ulimit was 20000, 30000 didnt do it, so I went to 40000 and now its working without issue.

[puffin]

Just had to do the same, upped it to 40K and now seems resolved.

[KTG]

Any idea how this happened? Took one of my servers offline for hours

Anyway, the fix worked, thanks for that..

Robert