ClamAV timeouts - ORF Forums

Hello kcit,

I see that you left a message in the other clamav thread yesterday (https://vamsoft.com/forum/topic/759/clamav-error) so I assume you have already added the "TCPAddr 127.0.0.1" line to the clamd.conf file.

To answer question, 20-30 seconds should be plenty for a scan to finish. If you see the timeout error logged occasionally, I guess it is nothing to worry about, however, if you see this logged for all emails, I recommend testing clamdscan.exe from command line using an EML file. You can download a test EML from the following location, it contains an Eicar antivirus test file:

http://blog.vamsoft.com/wp-content/eicar.zip

password: virustest

Extract the EML file to the same folder where clamdscan resides (c:\clamav\ by default, if you followed the instructions in our article at http://vamsoft.com/r?clamav-article) and issue the following command from a command line:

clamdscan.exe --no-summary --stdout --config-file="c:\clamav\clamd.conf" eicar.eml

Does it time out this way?

In any case, I would suggest that you take a look at the ClamAV logs to see if you can find any explanation for the lengthy scan times. If logging is not enabled in your ClamAV installation, it must be enabled first in the clamd.conf file. For the clamd configuration options, please consult the following article: http://linux.die.net/man/5/clamd.conf. Look for the commands starting with ‘Log’ for the logging options.

I hope this helps.

Do you have any antivirus installed on the ORF server? If so, you should double-check that the path configured for temporary email files (ORF Administration Tool: Blacklists > External Agents > "Path for temporary email files") is excluded from virus checking, otherwise the antivirus may lock/delete the file before ClamAV could scan it.

If you want to find out what is causing the timeout errors, I recommend enabling detailed logging in both ORF and ClamAV. Please follow the steps below:

1) Mark the "Include email file name in messages" checkbox enabled on the "Logging" tab in the External Agents properties window (ORF Administration Tool: Blacklists > External Agents > ClamAV for Windows > Logging)

2) Save the ORF configuration to apply the new settings (Ctrl + S)

3) Edit the clamd.conf file in the ClamAV program directory (default: c:\clamav) and add the following lines to enable logging:

LogFile c:\clamav\clamd.log
LogFileUnlock true
LogTime true
LogClean true
LogVerbose true

4) Save the clamd.conf file

5) Restart the "ClamWin Free Antivirus Scanner Service" (Run > services.msc)

Once you have done the above, you just have to wait for a timeout event. Then you should open the clamd.log file and look for the line with the filename that was logged in the ORF timeout error message (e.g. sce-3659C64098CDCCD1AD71A8E73BB2181C.eml) to see whether ClamAV could process the email without any issues. If so, it might have spent too much time checking the email against all the virus databases - can happen if your server's resources were tied down at the time of arrival.

Receiving 1-10 timeout error a day can be normal, especially if you receive hundreds or thousands of emails par day.

@shooker: Never heard about ClamAV corrupting PDFs, this sounds more like an Outlook/Office365 issue. There are plenty of posts about this on the internet.

By the way, I tend to receive ClamAV timeout errors on ORF lab servers when an email arrives and the clamd service is busy reading updated database files from the c:\clamav\db folder - which can take up to ~60 seconds. In those cases ClamAV fails to scan the incoming email. Here is the log excerpt of such an event:

Wed Jul 31 12:18:09 2019 -> SelfCheck: Database modification detected. Forcing reload.
Wed Jul 31 12:18:11 2019 -> Reading databases from c:\clamav\db
Wed Jul 31 12:19:13 2019 -> Database correctly reloaded (6401020 signatures)
Wed Jul 31 12:19:13 2019 -> WARNING: lstat() failed on: \\?\C:\ORF\email-temp\sce-089191E5AA550FD62761FB314DC0D54A.eml

The "lstat() failed" warning means that ClamAV could not read the temporary .eml file, which - in this case - is because ORF stopped waiting for ClamAV to respond and deleted the file. You could increase the external agent's timeout value to 60-80+ seconds to avoid this, but I would not recommend that honestly - some mail servers may not wait minutes for your mail server to confirm the receipt of the email. Just keep in mind that the ClamAV agent is not the only one that can timeout and those 8-20 seconds add up... If you do this anyway, make sure your other External Agents do not have excessive timeout values and lower the DNS timeout setting of ORF to 4-6 seconds (System > DNS > DNS Settings > Advanced).

If you want to experiment, you can control the frequency of the signature database "selfchecks" and more via the clamd.conf and freshclam.conf files. You may find the related man pages below:

https://linux.die.net/man/5/clamd.conf
https://linux.die.net/man/5/freshclam.conf

@shooker: I am glad to hear that :)

@kcit: You can always edit the "C:\clamav\sigupdate\signames.txt" file to remove signature sources that you do not need. This way you can lower the database reload time if necessary.