psmon/webnic.xxxxx.com] Spawned 'clamd' with '/sbin/

stormlord · **Joined:** Sun Mar 23, 2008 12:54 pm **Posts:** 22

Hi,
I know atomicrocket for a while but , I have just discover asl (wow)
I have install it yesterday all run very well I have install the last version (asl-1.9.8-7.el5.art) , The problem I have is I receive 1000 e-mail day with

Command executed: /sbin/service clamd restart
Exit value: 0
Signal number: 0
Dumped core?: 0

Stopping Clam AntiVirus Daemon: [FAILED]

Starting Clam AntiVirus Daemon: [ OK ]

How fix the issue , Thx,

stormlord · **Joined:** Sun Mar 23, 2008 12:54 pm **Posts:** 22

ok

[root@webnic ~]# clamd stop
[root@webnic ~]# clamd start

resolve the problem receive alert email
but if I reboot I have to redo stop start , I can make script but I want to correct the problem

here is a part on clamd.log

before stop :

Sun Mar 23 19:13:04 2008 -> +++ Started at Sun Mar 23 19:13:04 2008
Sun Mar 23 19:13:04 2008 -> clamd daemon 0.92.1 (OS: linux-gnu, ARCH: i386, CPU: i386)
Sun Mar 23 19:13:04 2008 -> Running as user clamav (UID 117, GID 103)
Sun Mar 23 19:13:04 2008 -> Log file size limit disabled.
Sun Mar 23 19:13:04 2008 -> Reading databases from /var/clamav
Sun Mar 23 19:13:04 2008 -> Not loading PUA signatures.
Sun Mar 23 19:13:04 2008 -> ERROR: Unable to open file or directory

after restart

Sun Mar 23 19:19:43 2008 -> +++ Started at Sun Mar 23 19:19:43 2008
Sun Mar 23 19:19:43 2008 -> clamd daemon 0.92.1 (OS: linux-gnu, ARCH: i386, CPU: i386)
Sun Mar 23 19:19:43 2008 -> Running as user clamav (UID 117, GID 103)
Sun Mar 23 19:19:43 2008 -> Log file size limit disabled.
Sun Mar 23 19:19:43 2008 -> Reading databases from /var/clamav
Sun Mar 23 19:19:43 2008 -> Not loading PUA signatures.
Sun Mar 23 19:19:57 2008 -> Loaded 253074 signatures.
Sun Mar 23 19:19:58 2008 -> Bound to address 127.0.0.1 on tcp port 3310
Sun Mar 23 19:19:58 2008 -> Setting connection queue length to 30
Sun Mar 23 19:19:58 2008 -> Unix socket file /tmp/clamd.socket
Sun Mar 23 19:19:58 2008 -> Setting connection queue length to 30
Sun Mar 23 19:19:58 2008 -> Archive: Archived file size limit set to 10485760 bytes.
Sun Mar 23 19:19:58 2008 -> Archive: Recursion level limit set to 8.
Sun Mar 23 19:19:58 2008 -> Archive: Files limit set to 1000.
Sun Mar 23 19:19:58 2008 -> Archive: Compression ratio limit set to 300.
Sun Mar 23 19:19:58 2008 -> Archive support enabled.
Sun Mar 23 19:19:58 2008 -> Algorithmic detection enabled.
Sun Mar 23 19:19:58 2008 -> Portable Executable support enabled.
Sun Mar 23 19:19:58 2008 -> ELF support enabled.
Sun Mar 23 19:19:58 2008 -> Detection of broken executables enabled.
Sun Mar 23 19:19:58 2008 -> Mail files support enabled.
Sun Mar 23 19:19:58 2008 -> Mail: Recursion level limit set to 64.
Sun Mar 23 19:19:58 2008 -> OLE2 support enabled.
Sun Mar 23 19:19:58 2008 -> PDF support disabled.
Sun Mar 23 19:19:58 2008 -> HTML support enabled.
Sun Mar 23 19:19:58 2008 -> Self checking every 1800 seconds.
Sun Mar 23 19:20:03 2008 -> Loaded 253074 signatures.
Sun Mar 23 19:20:03 2008 -> ERROR: bind() error: Address already in use

stormlord · **Joined:** Sun Mar 23, 2008 12:54 pm **Posts:** 22

ok solve the problem with installing
kernel (2.6.24.2) in the asl-2.0-testing channel

BruceLee · **Posted:** Tue Jun 29, 2010 5:44 am

suddenly today these errors started on my server too:

Command executed: /sbin/service clamd restart Exit value: 0 Signal number: 0 Dumped core?: 0
Stopping Clam AntiVirus Daemon: [FAILED] Starting Clam AntiVirus Daemon: [ OK ]

I'm using latest centos, latest plesk, latest ASL except of the kernel which is 2.6.32.8-1.art now.
I don't wanted to upgrade due to iowats and ipv6 errors.

What can I do?

/var/log/messages:

Code:

Jun 29 09:42:02 www clamd[18154]: clamd daemon 0.96.1 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) 
Jun 29 09:42:02 www clamd[18154]: Running as user root (UID 0, GID 0) 
Jun 29 09:42:02 www clamd[18154]: Log file size limit disabled. 
Jun 29 09:42:02 www clamd[18154]: Reading databases from /var/clamav 
Jun 29 09:42:02 www clamd[18154]: Not loading PUA signatures. 
Jun 29 09:42:05 www xinetd[2581]: START: smtp pid=18155 from=83.103.139.140
Jun 29 09:42:11 www clamd[18154]: Loaded 1598260 signatures. 
Jun 29 09:42:11 www clamd[18154]: TCP: Bound to address 127.0.0.1 on port 3310 
Jun 29 09:42:11 www clamd[18154]: TCP: Setting connection queue length to 30 
Jun 29 09:42:11 www clamd[18154]: LOCAL: Removing stale socket file /tmp/clamd.socket 
Jun 29 09:42:11 www clamd[18154]: LOCAL: Unix socket file /tmp/clamd.socket 
Jun 29 09:42:11 www clamd[18154]: LOCAL: Setting connection queue length to 30 
Jun 29 09:42:11 www clamd[18157]: Limits: Global size limit set to 104857600 bytes. 
Jun 29 09:42:11 www clamd[18157]: Limits: File size limit set to 26214400 bytes. 
Jun 29 09:42:11 www clamd[18157]: Limits: Recursion level limit set to 16. 
Jun 29 09:42:11 www clamd[18157]: Limits: Files limit set to 10000. 
Jun 29 09:42:11 www clamd[18157]: Archive support enabled. 
Jun 29 09:42:11 www clamd[18157]: Algorithmic detection enabled. 
Jun 29 09:42:11 www clamd[18157]: Portable Executable support enabled. 
Jun 29 09:42:11 www clamd[18157]: ELF support enabled. 
Jun 29 09:42:11 www clamd[18157]: Detection of broken executables enabled. 
Jun 29 09:42:11 www clamd[18157]: Mail files support enabled. 
Jun 29 09:42:11 www clamd[18157]: OLE2 support enabled. 
Jun 29 09:42:11 www clamd[18157]: PDF support enabled. 
Jun 29 09:42:11 www clamd[18157]: HTML support enabled. 
Jun 29 09:42:11 www clamd[18157]: Self checking every 600 seconds. 
Jun 29 09:42:12 www psmon[15980]: Spawned 'clamd' with '/sbin/service clamd restart'

/var/log/clamav/clamd.log:

Code:

Tue Jun 29 09:36:35 2010 -> SelfCheck: Database status OK.
Tue Jun 29 09:42:02 2010 -> +++ Started at Tue Jun 29 09:42:02 2010
Tue Jun 29 09:42:02 2010 -> clamd daemon 0.96.1 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Tue Jun 29 09:42:02 2010 -> Running as user root (UID 0, GID 0)
Tue Jun 29 09:42:02 2010 -> Log file size limit disabled.
Tue Jun 29 09:42:02 2010 -> Reading databases from /var/clamav
Tue Jun 29 09:42:02 2010 -> Not loading PUA signatures.
Tue Jun 29 09:42:11 2010 -> Loaded 1598260 signatures.
Tue Jun 29 09:42:11 2010 -> TCP: Bound to address 127.0.0.1 on port 3310
Tue Jun 29 09:42:11 2010 -> TCP: Setting connection queue length to 30
Tue Jun 29 09:42:11 2010 -> LOCAL: Removing stale socket file /tmp/clamd.socket
Tue Jun 29 09:42:11 2010 -> LOCAL: Unix socket file /tmp/clamd.socket
Tue Jun 29 09:42:11 2010 -> LOCAL: Setting connection queue length to 30
Tue Jun 29 09:42:11 2010 -> Limits: Global size limit set to 104857600 bytes.
Tue Jun 29 09:42:11 2010 -> Limits: File size limit set to 26214400 bytes.
Tue Jun 29 09:42:11 2010 -> Limits: Recursion level limit set to 16.
Tue Jun 29 09:42:11 2010 -> Limits: Files limit set to 10000.
Tue Jun 29 09:42:11 2010 -> Archive support enabled.
Tue Jun 29 09:42:11 2010 -> Algorithmic detection enabled.
Tue Jun 29 09:42:11 2010 -> Portable Executable support enabled.
Tue Jun 29 09:42:11 2010 -> ELF support enabled.
Tue Jun 29 09:42:11 2010 -> Detection of broken executables enabled.
Tue Jun 29 09:42:11 2010 -> Mail files support enabled.
Tue Jun 29 09:42:11 2010 -> OLE2 support enabled.
Tue Jun 29 09:42:11 2010 -> PDF support enabled.
Tue Jun 29 09:42:11 2010 -> HTML support enabled.
Tue Jun 29 09:42:11 2010 -> Self checking every 600 seconds.
Tue Jun 29 09:52:24 2010 -> No stats for Database check - forcing reload
Tue Jun 29 09:52:25 2010 -> Reading databases from /var/clamav
Tue Jun 29 09:52:33 2010 -> Database correctly reloaded (1598260 signatures)
Tue Jun 29 10:04:46 2010 -> SelfCheck: Database status OK.

Thanks for any help

BerArt · **Posted:** Tue Jun 29, 2010 6:08 am

PAX is Closing Clam every 1-20 minutus or so

I have the same problem on several servers:

psmon message:

Code:

Command executed: /sbin/service clamd restart Exit value: 0 Signal number: 0 Dumped core?: 0

Stopping Clam AntiVirus Daemon: [FAILED] Starting Clam AntiVirus Daemon: [  OK  ]

message error log:

Code:

Jun 29 08:52:49 plesk4 kernel: PAX: From 193.173.47.73: execution attempt in: <anonymous mapping>, 707de5a97000-707de5b9b000 707de5a97000 
Jun 29 08:52:49 plesk4 kernel: PAX: terminating task: /usr/sbin/clamd(clamd):4760, uid/euid: 0/0, PC: 0000707de5ae36b0, SP: 00000000434986e8 
Jun 29 08:52:49 plesk4 kernel: PAX: bytes at PC: 48 83 ec 08 48 b8 40 35 ae e5 7d 70 00 00 ff d0 48 83 c4 08 Jun 29 08:52:49 plesk4 kernel: PAX: bytes at SP-8: 000000043498c40 0000707dfa66f963 0000000043498da0 0000707de5ae36b0 0000000043498c40 6b9e002631a8b846 0000000000000000 000000000063be50 0000000000060a3a 00000000434a18a0 6b9e002631a8b286 
Jun 29 08:53:24 plesk4 kernel: PAX: execution attempt in: <anonymous mapping>, 6c2a86dd7000-6c2a90089000 6c2a86dd7000 
Jun 29 08:53:24 plesk4 kernel: PAX: terminating task: /usr/sbin/clamd(clamd):5131, uid/euid: 0/0, PC: 00006c2a86dd86b0, SP: 0000000040be56e8 
Jun 29 08:53:24 plesk4 kernel: PAX: bytes at PC: 48 83 ec 08 48 b8 40 85 dd 86 2a 6c 00 00 ff d0 48 83 c4 08 Jun 29 08:53:24 plesk4 kernel: PAX: bytes at SP-8: 0000000040be5c40
00006c2a92724963 0000000040be5da0 00006c2a86dd86b0 0000000040be5c40 bbf7083f75ee7c0a 0000000000000000 000000000064bf60 00000000000679a9 0000000040bee8a0 bbf7083f75ee76ca Jun 29 09:13:46 plesk4 kernel: PAX: From 213.125.12.195: execution attempt in: 
<anonymous mapping>, 7553d725f000-7553d736d000 7553d725f000 Jun 29 09:13:46 plesk4 kernel: PAX: terminating task: 
/usr/sbin/clamd(clamd):10613, uid/euid: 0/0, PC: 00007553d72b56b0, SP: 
0000000041edf6e8
Jun 29 09:13:46 plesk4 kernel: PAX: bytes at PC: 48 83 ec 08 48 b8 40 55 2b d7 53
75 00 00 ff d0 48 83 c4 08
Jun 29 09:13:46 plesk4 kernel: PAX: bytes at SP-8: 0000000041edfc40
00007553ebc3e963 0000000041edfda0 00007553d72b56b0 0000000041edfc40
4de2085f3a88d014 0000000000000000 00000000006ed1b0 000000000006da73 0000000041ee88a0 4de2085f3a88dad4 Jun 29 09:15:14 plesk4 kernel: PAX: execution attempt in: <anonymous mapping>, 6d6fb4179000-6d6fbd42b000 6d6fb4179000 Jun 29 09:15:14 plesk4 kernel: PAX: terminating task: 
/usr/sbin/clamd(clamd):11164, uid/euid: 0/0, PC: 00006d6fb417a6b0, SP: 
00000000421fa6e8
Jun 29 09:15:14 plesk4 kernel: PAX: bytes at PC: 48 83 ec 08 48 b8 40 a5 17 b4 6f 6d 00 00 ff d0 48 83 c4 08 Jun 29 09:15:14 plesk4 kernel: PAX: bytes at SP-8: 00000000421fac40
00006d6fbfac6963 00000000421fada0 00006d6fb417a6b0 00000000421fac40
05c60a8836909592 0000000000000000 0000000000651a40 0000000000066329 00000000422038a0 05c60a8836909f52 Jun 29 09:17:18 plesk4 kernel: PAX: execution attempt in: <anonymous mapping>, 76de7f912000-76de88ce1000 76de7f912000 Jun 29 09:17:18 plesk4 kernel: PAX: terminating task: 
/usr/sbin/clamd(clamd):11619, uid/euid: 0/0, PC: 000076de7fa306b0, SP: 
0000000041ba86e8
Jun 29 09:17:18 plesk4 kernel: PAX: bytes at PC: 48 83 ec 08 48 b8 40 05 a3 7f de
76 00 00 ff d0 48 83 c4 08
Jun 29 09:17:18 plesk4 kernel: PAX: bytes at SP-8: 0000000041ba8c40
000076de8b37c963 0000000041ba8da0 000076de7fa306b0 0000000041ba8c40
dac30ac04e7a1aa8 0000000000000000 000000000064e6c0 0000000000067c1f 0000000041bb18a0 dac30ac04e7a1068 Jun 29 09:34:50 plesk4 kernel: PAX: From 194.109.160.221: execution attempt in: 
<anonymous mapping>, 6db60ccd9000-6db60cd91000 6db60ccd9000 Jun 29 09:34:50 plesk4 kernel: PAX: terminating task: 
/usr/sbin/clamd(clamd):15267, uid/euid: 0/0, PC: 00006db60ccd96b0, SP: 
00000000423d06e8
Jun 29 09:34:50 plesk4 kernel: PAX: bytes at PC: 48 83 ec 08 48 b8 40 95 cd 0c b6 6d 00 00 ff d0 48 83 c4 08 Jun 29 09:34:50 plesk4 kernel: PAX: bytes at SP-8: 00000000423d0c40
00006db621662963 00000000423d0da0 00006db60ccd96b0 00000000423d0c40 47940afb2efdd82c 0000000000000000 000000000067a5f0 000000000006498d 00000000423d98a0 47940afb2efdd2ec Jun 29 09:40:50 plesk4 kernel: PAX: From 194.109.160.221: execution attempt in: 
<anonymous mapping>, 6ab439f1d000-6ab4431cf000 6ab439f1d000 Jun 29 09:40:50 plesk4 kernel: PAX: terminating task: 
/usr/sbin/clamd(clamd):17395, uid/euid: 0/0, PC: 00006ab439f1e6b0, SP: 
00000000413ba6e8

Mail is also send to support@

BruceLee · **Posted:** Tue Jun 29, 2010 6:11 am

you are right. checked my logs again and found those entries too:

Code:

Jun 29 09:41:51 www kernel: PAX: From 84.60.152.85: execution attempt in: <anonymous mapping>, 68b26328d000-68b264000000 68b26328d000
Jun 29 09:41:51 www kernel: PAX: terminating task: /usr/sbin/clamd(clamd):18113, uid/euid: 0/0, PC: 000068b263f806b0, SP: 0000000042f484e8
Jun 29 09:41:51 www kernel: PAX: bytes at PC: 48 83 ec 08 48 b8 40 05 f8 63 b2 68 00 00 ff d0 48 83 c4 08 
Jun 29 09:41:51 www kernel: PAX: bytes at SP-8: 0000000042f48a40 000068b27cb54963 0000000042f48ba0 000068b263f806b0 0000000042f48a40 a55160cbbee2c554 0000000000000000 0000000000707620 0000000000073f59 0000000042f588a0 a55160cbbee2cb94 
Jun 29 09:41:54 www xinetd[2581]: EXIT: submission status=0 pid=17371 duration=249(sec)

Kalimari · **Posted:** Tue Jun 29, 2010 6:25 am

Just started receiving these psmon alerts (2 in last 5 minutes):

Code:

Command executed: /sbin/service clamd restart
Exit value: 0
Signal number: 0
Dumped core?: 0

Stopping Clam AntiVirus Daemon: [FAILED]
Starting Clam AntiVirus Daemon: [  OK  ]

Running 2.6.29.6-1.art.x86_64 due to all the recent issues (it the only one which allows the server to boot)

BerArt · **Posted:** Tue Jun 29, 2010 6:31 am

I am running Linux 2.6.32.15-1.art.x86_64 but still I have the same problems, 1000 emails from psmon per day, a log that is building, clam is stopping and starting

mikeshinn · **Posted:** Tue Jun 29, 2010 6:36 am

We're looking into this now. In each case above, you'll note there is an IP address - is that IP address a trusted IP or some unknown IP? The kernel will log the IP source of an action that triggers the kernel protections.

Short term, if you are sure this is not an attack and is a false positive, you can disable all the kernel protections for clamd with this command:

chpax -emrspx /usr/sbin/clamd

Some additional questions, are you all running additional signatures sets other than the core clamav sigs and the ASL sigs? And if so, what happens if you remove them?

Are any of you using the Clamuko (realtime AV) features of clamd?

Did anything else change on your system, such as upgrades to clam, kernel, qmail-scanner, etc.?

BruceLee · **Posted:** Tue Jun 29, 2010 6:45 am

My entries looked like this. The IP is not a trusted one.

Jun 29 09:41:51 www kernel: PAX: From 84.60.152.85: execution attempt in: <anonymous mapping>, 68b26328d000-68b264000000 68b26328d000
Jun 29 11:32:54 www kernel: PAX: execution attempt in: <anonymous mapping>, 6359e81f8000-6359e8a47000 6359e81f8000

I use no other signatures than the one ASL provides
I'm not using clamuko
No changes since last ASL update to 2.2.8

mikeshinn · **Posted:** Tue Jun 29, 2010 6:47 am

Interesting, this could actually be an attack then, but before we jump to that conclusion lets see if we can track down how this got triggered. First spot to look would be your maillogs, can you check your maillog to see if that IP shows up?

And if not maillog, check your FTP logs to see if this was an upload.

breun · **Posted:** Tue Jun 29, 2010 6:50 am

mikeshinn wrote:

In each case above, you'll note there is an IP address - is that IP address a trusted IP or some unknown IP? The kernel will log the IP source of an action that triggers the kernel protections.

On our servers not all cases have an IP address. Some of the messages that do have an IP address are from a trusted IP, some aren't.

Quote:

Some additional questions, are you all running additional signatures sets other than the core clamav sigs and the ASL sigs?

No.

Quote:

Are any of you using the Clamuko (realtime AV) features of clamd?

We're not.

Quote:

Did anything else change on your system, such as upgrades to clam, kernel, qmail-scanner, etc.?

Upgraded to MySQL 5.1 yesterday, that's all.

mikeshinn · **Posted:** Tue Jun 29, 2010 6:51 am

Another thought, just in case this is a bug, check your /var/clamav files to see if anything changed there around the time this started.

BerArt · **Posted:** Tue Jun 29, 2010 6:52 am

Mike, what Breun say's, same here!

prupert · **Posted:** Tue Jun 29, 2010 6:55 am

breun wrote:

mikeshinn wrote:

Did anything else change on your system, such as upgrades to clam, kernel, qmail-scanner, etc.?

Upgraded to MySQL 5.1 yesterday, that's all.

Please note that we are also seeing this problem on servers that have not yet been upgraded to MySQL 5.1.

psmon/webnic.xxxxx.com] Spawned 'clamd' with '/sbin/

Who is online