[Pkg-clamav-devel] Bug#824196: Bug#824196: clamav-daemon: clamd crashes daily

[Will Aoki]

On Fri, May 13, 2016 at 09:35:07PM +0200, Sebastian Andrzej Siewior wrote:
> On 2016-05-13 09:43:24 [-0600], Will Aoki wrote:
> > Before crashing, the daemon spews the message
> > 
> >    accept() failed:
> This is it? Nothing more? There should be an error message included
> after the colon.

That's it. A space is logged after the colon, but nothing else.

May 13 08:56:05 skunk clamd[12310]: accept() failed:
May 13 08:56:05 skunk clamd: Last message 'accept() failed: ' repeated 198 times, suppressed by syslog-ng on [the loghost]
May 13 08:56:11 skunk clamd[12310]: accept() failed:
May 13 08:56:11 skunk clamd: Last message 'accept() failed: ' repeated 199 times, suppressed by syslog-ng on [the loghost]

I've noticed that /tmp is filling up with directories named e.g.
clamav-fe97224f9fa888d6e2d47ddfee0ca573.tmp

> You mean you gave a "normal" file and it was reported as a virus?

It's a test we run to make sure that the our exclusions of two PUA
signatures work. We want most PUA signatures, but we don't want to use
these two.

We added the exclusion and the test earlier this week, after the crashes
had started.