Hello,
I installed ClamAV 0.95 from the atomic repository, and now I see this in my logwatch email:

lstat() failed on: /var/spool/qscan/tmp/host.tld123879626679212033
lstat() failed on: /var/spool/qscan/tmp/host.tld123879681779212278
lstat() failed on: /var/spool/qscan/tmp/host.tld123879682279212300
lstat() failed on: /var/spool/qscan/tmp/host.tld123879740679212594
lstat() failed on: /var/spool/qscan/tmp/host.tld123879751079212695
lstat() failed on: /var/spool/qscan/tmp/host.tld123879752379212716
lstat() failed on: /var/spool/qscan/tmp/host.tld123879754079212738
lstat() failed on: /var/spool/qscan/tmp/host.tld123879763379212809

What can I do to correct this problem (which doesn't seem to block any email)?
Could it be an access problem to /var/spool/qscan/tmp/ by clamd?
Thanks!

That means that clamd cant read the file, its generally permissions related.

Okay, I chmoded /var/spool/qscan/tmp/ to 777 (not so clean) and everything works fine again!

This is an older thread but for people looking for a solution to the problem try this:

It may be as easy as restarting clamd. It was in my case. To be sure though go through these steps:

Look at the first column. If the user is clamd and not qscand then check the clamd conf file for the line "User qscand":

If it says "User clamd" then change it to "User qscand". Either way, restart clamd afterwards.

Verify that the process is now owned by qscand:

Then verify that /var/spool/qscan/tmp is owned by qscand:

If it's not, then change it:


This was based on Centos 5.3 with the following packages:
clamd-0.95.2-1.el5.art
qmail-scanner-2.06-1.el5.art