ClamAV "ERROR: Can't write to temporary directory"

  • christophera
  • 04/30/09
  • Offline
Posted: Sun, 2013-04-28 22:47

Setting up Virtualmin GPS on a new vps server and when I do the final check, I get:


The ClamAV program clamscan does not appear to be working properly :

ERROR: Can't write to temporary directory

----------- SCAN SUMMARY ----------- Known viruses: 2205557 Engine version: 0.97.6 Scanned directories: 0 Scanned files: 0 Infected files: 0 Data scanned: 0.00 MB Data read: 0.00 MB (ratio 0.00:1) Time: 6.477 sec (0 m 6 s)

. Either change the program on the spam and virus scanners page, or disable this feature.

Looking in clamd.conf (am I in the right file?) - it looks like the temporary directory is /var/tmp

and that directories permissions are: drwxrwxrwt

Any thoughts on how to fix this?

Thanks,

Chris


Howdy, What is the output of

  • andreychek
  • 01/05/09
  • Online Now
  • Mon, 2013-04-29 09:08

Howdy,

What is the output of these two commands:

mount
df -h


Hi, I've

  • christophera
  • 04/30/09
  • Offline
  • Mon, 2013-04-29 13:44

Hi, I've got:

# mount
/dev/sda on / type ext4 (rw,grpquota,errors=remount-ro,usrquota)
none on /dev/shm type tmpfs (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

and

# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda               20G  1.6G   18G   9% /
none                  246M     0  246M   0% /dev/shm


Formatting :) Always a

  • christophera
  • 04/30/09
  • Offline
  • Mon, 2013-04-29 13:46

Formatting :) Always a little different than expected here!


Just checking back in on this

  • christophera
  • 04/30/09
  • Offline
  • Tue, 2013-04-30 14:59

Just checking back in on this in case you have any thoughts -


Howdy, I don't see anything

  • andreychek
  • 01/05/09
  • Online Now
  • Tue, 2013-04-30 18:53

Howdy,

I don't see anything unusual with your drive, the mount flags, or the available space. And the permissions appear correct.

So it's tough to say what might be going wrong there...

As a test, you could always try changing the temporary directory to /tmp, restart ClamAV, and then see if that works properly.

-Eric


Hi Eric, Changed to /tmp and

  • christophera
  • 04/30/09
  • Offline
  • Wed, 2013-05-01 08:03

Hi Eric,

Changed to /tmp and rebooted but no difference.

This is on a brand new centOS 6 vps from digitalocean.com, an outfit I have never heard of before but was trying out because their prices look really good.

Would you like the address and root password to take a look? All that's been done with it is the CentOS and Virtualmin GPL install.

Up to you, just thought you might be curious. If you don't want to, perhaps I'll just delete it all and try installing again from scratch and see if the same thing happens.

Chris


hmm, just tried reinstalling

  • christophera
  • 04/30/09
  • Offline
  • Thu, 2013-05-02 10:04

hmm, just tried reinstalling from scratch with a new Centos 6.4 X64 image and same thing happened.


The same happens with Ubuntu

  • macaba
  • 05/03/13
  • Offline
  • Fri, 2013-05-03 18:11

The same happens with Ubuntu 12.04 LTS


That's all very strange! What

  • andreychek
  • 01/05/09
  • Online Now
  • Thu, 2013-05-02 14:10

That's all very strange! What output do you receive if you run this command:

rpm -qa | grep clam


I

  • christophera
  • 04/30/09
  • Offline
  • Thu, 2013-05-02 21:49

I get

clamav-db-0.97.6-1.el6.x86_64
clamd-0.97.6-1.el6.x86_64
clamav-0.97.6-1.el6.x86_64


That's all very odd! I

  • andreychek
  • 01/05/09
  • Online Now
  • Fri, 2013-05-03 22:20

That's all very odd! I haven't seen that behavior before.

In Email Messages -> Spam and Virus Scanning, what is "Virus scanning program" set to?

And I believe you mentioned using a VPS... do you know what type of VPS it is?

-Eric


When I installed Virtualmin

  • christophera
  • 04/30/09
  • Offline
  • Fri, 2013-05-03 23:25

When I installed Virtualmin this second time I left everything at the default settings. Currently "Virus scanning program" is set to: Standalone scanner (clamscan).


If I attempt to enable ClamAV

  • christophera
  • 04/30/09
  • Offline
  • Fri, 2013-05-03 23:28

If I attempt to enable ClamAV server, I get:

Configuring and enabling the ClamAV scanning server .. Starting ClamAV server and enabling at boot .. .. failed to start : Starting Clam AntiVirus Daemon: [FAILED] .. all done


I'm checking on the vps type,

  • christophera
  • 04/30/09
  • Offline
  • Fri, 2013-05-03 23:34

I'm checking on the vps type, let you know when I get an answer -


For vps type, DigitalOcean

  • christophera
  • 04/30/09
  • Offline
  • Sat, 2013-05-04 07:23

For vps type, DigitalOcean support says:: Linux KVM technology

Is that what you were asking for?

I told them I was having some trouble setting up Virtualmin and they asked for a "list of possible values?," but I'm not sure what they are looking for. Probably easier if we work it out here :)


Eric, would you like me to

  • christophera
  • 04/30/09
  • Offline
  • Mon, 2013-05-06 21:51

Eric, would you like me to send you a log in so you can take a look? If so, just let me know how to send it your way,

Chris


Howdy, If you look in

  • andreychek
  • 01/05/09
  • Online Now
  • Wed, 2013-05-08 20:01

Howdy,

If you look in /var/log/maillog and /var/log/messages after trying to start ClamAV, do you see any errors or unusual messages?

Also, does the command line scanner work when you run it manually?

You can determine that by running this command:

clamscan -v /etc/issue

-Eric


Hi Eric,I get:# clamscan

  • christophera
  • 04/30/09
  • Offline
  • Thu, 2013-05-09 15:42

Hi Eric,

I get:

# clamscan -v /etc/issue
Scanning /etc/issue
/etc/issue: OK
 
----------- SCAN SUMMARY -----------
Known viruses: 2268914
Engine version: 0.97.6
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 6.183 sec (0 m 6 s)

There's nothing that I see related in var/log/maillog,

but in var/log/messages, I'm getting:

May  9 20:23:46 jazz freshclam[24299]: ClamAV update process started at Thu May  9 20:23:46 2013
May  9 20:23:46 jazz freshclam[24299]: Your ClamAV installation is OUTDATED!
May  9 20:23:46 jazz freshclam[24299]: Local version: 0.97.6 Recommended version: 0.97.8
May  9 20:23:46 jazz freshclam[24299]: DON'T PANIC! Read http://www.clamav.net/support/faq
May  9 20:23:46 jazz freshclam[24299]: main.cvd is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven)
May  9 20:23:46 jazz freshclam[24299]: daily.cld is up to date (version: 17172, sigs: 1229899, f-level: 63, builder: jesler)
May  9 20:23:46 jazz freshclam[24299]: bytecode.cvd is up to date (version: 214, sigs: 41, f-level: 63, builder: neo)
May  9 20:25:10 jazz clamd[24430]: clamd daemon 0.97.6 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
May  9 20:25:10 jazz clamd[24430]: Running as user clam (UID 497, GID 498)
May  9 20:25:10 jazz clamd[24430]: Log file size limited to -1 bytes.
May  9 20:25:10 jazz clamd[24430]: Reading databases from /var/lib/clamav
May  9 20:25:10 jazz clamd[24430]: Not loading PUA signatures.
May  9 20:25:10 jazz clamd[24430]: Bytecode: Security mode set to "TrustSigned".
May  9 20:25:15 jazz clamd[24430]: Loaded 2268914 signatures.
May  9 20:25:16 jazz clamd[24430]: TCP: Bound to address 127.0.0.1 on port 3310
May  9 20:25:16 jazz clamd[24430]: TCP: Setting connection queue length to 30
May  9 20:25:16 jazz clamd[24430]: LOCAL: Unix socket file /var/run/clamav/clamd.sock
May  9 20:25:16 jazz clamd[24430]: LOCAL: Setting connection queue length to 30
May  9 20:25:16 jazz clamd[24430]: daemonize() failed: Cannot allocate memory
May  9 20:25:16 jazz clamd[24430]: Socket file removed.


Hmm, that "daemonize()

  • andreychek
  • 01/05/09
  • Online Now
  • Thu, 2013-05-09 22:23

Hmm, that "daemonize() failed: Cannot allocate memory" error is a bit troubling.

What output do you get if you run this command:

free -m


total used free

  • christophera
  • 04/30/09
  • Offline
  • Fri, 2013-05-10 01:00

             total       used       free     shared    buffers     cached
Mem:           490        358        132          0         32        167
-/+ buffers/cache:        158        332
Swap:            0          0          0


Aha, I think that might be a

  • andreychek
  • 01/05/09
  • Online Now
  • Fri, 2013-05-10 08:33

Aha, I think that might be a large part of the issue there. I don't think you have enough RAM to run the ClamAV process. You only have 490MB of RAM, and there isn't any swap on your system.

That's a fairly low-memory system there, I wouldn't recommend running any daemon/service that doesn't absolutely need to be running.

It does seem that ClamAV is able to run from the command line though when you're doing it manually.

I'm really not sure what might cause all that :-)

I'm doing some Googling on that though, I'll let you know what I come up with.

-Eric


Thank Eric, that was it. I

  • christophera
  • 04/30/09
  • Offline
  • Fri, 2013-05-10 11:06

Thank Eric, that was it.

I thought it met the min requirements - but it most have been that I just needed more RAM. I resized the server up to 1GB and retried and it loaded everything right up.

Thanks again, glad that is resolved. I had planed to resize it anyway, but was using this smaller server as a test one,

Chris


Super, I'm glad that's

  • andreychek
  • 01/05/09
  • Online Now
  • Fri, 2013-05-10 12:45

Super, I'm glad that's working now!

-Eric


Standalone clamscan and procmail filtering

  • imcdona
  • 10/02/13
  • Offline
  • Mon, 2013-10-07 19:04

I'm having a similar issue on a Digital Ocean VPS running CentOS 6.4 32bit with 512mb of ram. However, in this instance, I'm getting the same error The selected virus scanning command does not work : ERROR: Can't write to temporary directory even though I don't have the daemon mode selected. It's set to standalone.

If I set Allow mailbox users to create mail filters? to no, I'm able to save the changes on the Spam and Virus Scanning preferences page and everything works correctly (even virus scanning) albeit procmail filtering is disabled. The issue seems to revolve around the mail filtering option somehow.

Is there a way I could enable the mail filtering option outside of the "Spam and Virus Scanning" page to avoid this issue?

Thanks


I got it working by upgrading memory

  • imcdona
  • 10/02/13
  • Offline
  • Fri, 2013-10-11 18:12

I got it working by adding additional memory for a total 1gb of RAM. I was thinking I could drop back down to 512mb after enabling the option to allow users to create mail filters but figured I didn't want to push my luck.

In short, if you're having this problem, adding additional memory will solve the issue. Whether or not you can then drop the memory back down after enabling the mail filter option and not break anything is unknown.