Re: [Clamav-users] clamd missed

On Wed, 30 Jun 2010 12:11:06 +0100 (BST)
"G.W. Haywood" <ged@jubileegroup.co.uk> wrote:

> Hi there,
>
> On Wed, 30 Jun 2010 hook wrote:
>
> > I am using last ClamAv in FreeBSD 8.
> > I did install as normal, from .tar
> >
> > After some time, by external issue,
>
> External issue?
>
> > my server was rebooted by the ?button?, ie hard way.
>
> Who did that? Why? Was there no alternative? (Such as using
> CTRL-ALT-DEL or one of the other keyboard interrupts, logging
> in via a serial port, logging in over the network with ssh...)
>
> > After that, the clamd file is missing....
>
> Incorrect. It is not missing. You can see the directory entry.
>
> > zero lenght!
>
> The directory listing tells you it has zero length. This may be true
> or it may not. The filesystem has been damaged and requires repair.

Journaling filesystems are supposed to prevent these kind of issues.
I would understand getting a file that you just wrote to damaged if you
hard reboot, getting some random file in /usr damaged sounds like a bug
in the filesystem's design.

What filesystem are you using? Is it a journaling FS? Do you have the
journal turned on?

Linux usually runs a journal recovery when mounting a filesystem that
was not cleanly unmounted. I don't know if FreeBSD does that.

>
> Did you run a filesystem checking tool after the abnormal shutdown?
> If not, then you should. It is possible that the filesystem damage
> was serious, and that you cannot rely on it now.

Agreed.

> I do not know how
> often FreeBSD 'syncs' its filesystems; if it is infrequent you might
> want to consider a crontab entry to do that every few minutes so that
> in the case of a system crash, a power failure or a hard reset there
> is less risk of changes which are cached in RAM failing to be written
> to disc.
>
> > Previous ?clean? reboots did not affect the behaviour.
>
> No surprise there. :)
>
> > After new install, all ok.
>
> Did you only reinstall ClamAV? If so I do not believe that you know
> that all is OK. Under these circumstances, I would not know.
>
> > Tested a second ?hard reboot?, and same problem!
>

Did you run 'sync' after reinstalling ClamAV? (or wait long enough so
the system does this)

> No more surprising than the first time. :(
>
> > What can I do to prevent it ...
>
> It is a _very_ bad idea to shut down a modern operating system the
> hard way unless the installation has been designed with that in mind.
> You are probably starting to understand why. One way of preventing
> filesystem damage under these circumstances is to mount it read only.
> In that case you would need to re-structure your directory hierarchy.
> You might also want to consider more extreme measures such as using
> read-only media like CD-R or DVD-R to store the files. Performance
> can become an issue so you can load the files into a RAM filesystem
> for the actual operation each time the system boots. But I have to
> say that all this should be completely unnecessary. Something is
> wrong with the way your system is installed and/or operated and the
> damage to a single file like the clamd binary is going to be just a
> tip of one of many icebergs. You really need to fix your system and
> your methods of working, not just try to hide the symptoms.
>
> Patient: Doctor, doctor, it hurts when I do this...
> Doctor: Then don't do it!
>
> --
>
> 73,
> Ged.
> _______________________________________________
> Help us build a comprehensive ClamAV guide: visit
> http://wiki.clamav.net http://www.clamav.net/support/ml

_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml

• This message: [ Message body ]
• Next message: Jerry: "Re: [Clamav-users] clamd missed"
• Previous message: Hook: "Re: [Clamav-users] clamd missed"
• In reply to: G.W. Haywood: "Re: [Clamav-users] clamd missed"

• Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ]