[Pkg-clamav-devel] Bug#515798: Bug#515798: Bug#515798: clamav: clamdscan fails to connect to clamd

[Stephen Gran]

This one time, at band camp, Mikołaj Menke said:
> Dnia 18.02.2009 22:57 użytkownik Stephen Gran napisał :
> > This one time, at band camp, Mikolaj Menke said:
> >> Very often clamdscan fails to connect to clamd giving false sense of
> >> security, as nothing is reported, even when the scanned data is infected.
> > 
> > steve at vancouver:~$ clamdscan bin/
> > connect(): Connection refused
> > WARNING: Can't connect to clamd.
> > 
> > I can't reproduce this description of how it works.
> 
> Yes, sometimes clamd is unavailable. The second example just shows that 
> exim handles clamd's error, but the problem is still there.

Again, I can't reproduce that behavior.  clamdscan (as shown above)
always returns the error output for me.  Do you have a local install of
clamav somewhere?  What is the output of `which clamdscan` ?

> > Can you quantify "very often" ? I certainly don't see it that often,
> > but if you do, there's probably something we should be chasing down.
> 
> How often? Just look below:
> 
> miki at menek(23:35:13)~$clamdscan /usr/local/share/eicar/eicar.com
> /usr/local/share/eicar/eicar.com: Eicar-Test-Signature FOUND
> 
> ----------- SCAN SUMMARY -----------
> Infected files: 1
> Time: 0.023 sec (0 m 0 s)
> miki at menek(23:35:28)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:28)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:29)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:29)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:30)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:30)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:30)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:31)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:32)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:32)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:32)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:33)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:33)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:34)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:34)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:34)~$clamdscan /usr/local/share/eicar/eicar.com
> miki at menek(23:35:35)~$clamdscan /usr/local/share/eicar/eicar.com
> /usr/local/share/eicar/eicar.com: Eicar-Test-Signature FOUND

Assuming this is not a local install, can you install clamav-dbg,
attach gdb to clamd, and send the backtrace you get when it becomes
unavailable?  If you're not sure how to do these things, feel free to
ask.

Cheers,
-- 
 -----------------------------------------------------------------
|   ,''`.                                            Stephen Gran |
|  : :' :                                        sgran at debian.org |
|  `. `'                        Debian user, admin, and developer |
|    `-                                     http://www.debian.org |
 -----------------------------------------------------------------
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/pkg-clamav-devel/attachments/20090218/ab010ff7/attachment.pgp