| Greg Helledy on 9 Mar 2017 09:19:30 -0800 |
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
| [PLUG] Error when clamscan runs as cron job |
When I run the scan manually through the cPanel GUI, it seems to run ok.When it runs as a cron job, it does seem to run, but throws off several errors, which I get emailed about.
One is this:
ERROR: Can't create temporary directory /usr/local/cpanel/3rdparty/share/clamav/clamav-30dbd4701847fcf97fcfca4946ac8d5d.tmp
Although it seems to still run, as the following lines are like this:
/home/grais40/mail/gra-inc.com/[user]/cur/1464705718.H422761P48248.grainc.arvixevps.com,S=21081:2,Sc: Heuristics.Phishing.Email.SSL-Spoof FOUND /home/grais40/mail/gra-inc.com/[user]/cur/1437927501.H455459P5273.grainc.arvixevps.com,S=37616:2,Sc: Heuristics.Phishing.Email.SpoofedDomain FOUND /home/grais40/mail/gra-inc.com/[user]/cur/1471109872.M229124P64818.grainc.arvixevps.com,S=20386,W=20645:2,S: Heuristics.Phishing.Email.SSL-Spoof FOUND
Here's the directory listing:
root@grainc [/usr/local/cpanel/3rdparty/share]# ll|grep clamav drwxrwxr-x 3 clamav clamav 4096 Mar 9 08:15 clamav/ root@grainc [/usr/local/cpanel/3rdparty/share]# cd clamav root@grainc [/usr/local/cpanel/3rdparty/share/clamav]# ll total 229440 drwxrwxr-x 3 clamav clamav 4096 Mar 9 08:15 ./ drwxr-xr-x 81 root root 4096 Jan 31 02:30 ../ -rw-r--r-- 1 clamav clamav 524800 Jan 26 21:57 bytecode.cld -rwxr-xr-x 1 root root 14905 Feb 6 08:07 copyright* -rw-r--r-- 1 clamav clamav 125229568 Mar 9 08:15 daily.cld drwxr-xr-x 2 clamav clamav 4096 Feb 6 08:07 .first-install/ -rw-r--r-- 1 clamav clamav 109143933 Mar 17 2016 main.cvd -rw------- 1 clamav clamav 1248 Mar 9 08:15 mirrors.dat
Does that look right? Why would the cron job be unable to create a temporary directory there?
I also get this in separate emails (many of them):
Out of memory: The process “clamscan” was terminated because the system is low on memory. In order to avoid a system crash due to low memory, the kernel terminated the process named “clamscan” with the PID “4329”. Server grainc.arvixevps.com Primary IP Address 198.252.67.98 Process Name clamscan Event Time Sunday, March 5, 2017 at 9:49:23 AM UTC PID 4329 Process UID 505 Process Username grais40 Process Total Virtual Memory 664648kB Process Anonymous Resident Set Size 162700kB Process File Resident Set Size 556kB Process OOM Score 87 Status Out of Memory ⚠ Memory Information Used 2.32 GB Available 507 MB Installed 2.81 GB Load Information 9.52 9.78 9.75 Uptime 25 days, 10 hours, 8 minutes, and 17 seconds IOStat Information avg-cpu: %user %nice %system %iowait %steal %idle 1.33 0.08 1.11 0.12 0.00 97.37 Device: tps Blk_read/s Blk_wrtn/s Blk_read Blk_wrtn sda 12.88 517.75 184.35 1137245548 404926808 Top Processes PID Owner CPU % Memory % Command 5275 grais40 82.43 17.04 /usr/local/bin/clamscan --recursive --no-summary --infected --remove /home/grais40/mail 5338 grais40 69.97 16.53 /usr/local/bin/clamscan --recursive --no-summary --infected --remove /home/grais40/mail 5147 grais40 84.49 10.72 /usr/local/bin/clamscan --recursive --no-summary --infected --remove /home/grais40/mail 5056 grais40 82.02 5.17 /usr/local/bin/clamscan --recursive --no-summary --infected --remove /home/grais40/mail 3841 grais40 76.15 4.54 /usr/local/bin/clamscan --recursive --no-summary --infected --remove /home/grais40/mail For addtional details, see the attached dmesg log dump. Preview of “oom_dmesg.txt” [2196240.669189] [ 5023] 0 5023 56032 24007 3 0 0 spamd child [2196240.669192] [ 5050] 505 5050 35470 142 5 0 0 crond [2196240.669194] [ 5052] 505 5052 26517 92 2 0 0 bash [2196240.669197] [ 5055] 47 5055 18181 295 5 0 0 exim [2196240.669200] [ 5056] 505 5056 142264 114177 1 0 0 clamscan [2196240.669204] [ 5071] 32003 5071 34538 266 0 0 0 cpanel_php_fpm [2196240.669206] [ 5078] 0 5078 25878 358 0 0 0 sshd [2196240.669209] [ 5079] 74 5079 16895 251 2 0 0 sshd [2196240.669212] Out of memory: Kill process 4329 (clamscan) score 87 or sacrifice child [2196240.671762] Killed process 4329, UID 505, (clamscan) total-vm:664648kB, anon-rss:162700kB, file-rss:556kB
I don't understand why there are five (or more) processes triggered by this one cron job with two commands. Is there something wrong with this? If it is right, the only thing I could do is break it up into smaller jobs I guess? Like, users starting with A-D on Sundays, E-H on Mondays, etc.?
Minute Hour Day Month Weekday Command Actions * 1 * * 0 /usr/local/bin/freshclam --quiet; /usr/local/bin/clamscan --recursive --no-summary --infected --remove /home/grais40/mail 2>/dev/null
I'm probably doing something dumb, but don't know what it is. I asked tech support and they ran it by clicking the button in cPanel, and said "works for me".
Any advice appreciated. -- Greg Helledy GRA, Incorporated P: +1 215-884-7500 F: +1 215-884-1385 www.gra.aero ___________________________________________________________________________ Philadelphia Linux Users Group -- http://www.phillylinux.org Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug