On 02/17/2011 05:04 AM, Udo Hortian wrote:
From time to time I see the following error in /var/log/exim4/paniclog:
2011-02-15 22:20:42 XXXX malware acl condition: clamd: ClamAV returned /var/spool/exim4/scan/XXXX/XXXX.eml: Can't create temporary directory ERROR
Hi Udo, That is quite strange especially since it only occurs sometimes. I can't say for sure but I suspect that this is most probably a ClamAV problem. Check to see if the clamd logs have any related entries that might yield a clue. I realize this is obvious but make sure that the Debian-exim user and clamav user both have read/write permission to the /var/spool/exim4/scan directory. It sounds like everything is running fine until some unusual convergence of events occur. I would also examine your clamd configuration file (/etc/clamd.conf). There are several parameters in clamd.conf that specify maximum allowable values such as MaxConnectionQueueLength, StreamMaxLength and MaxThreads. This mailing list post is for a similar situation: http://lists.exim.org/lurker/message/20050414.060700.734834f7.en.html The above link suggested that the user uncoment or add in the clamd.conf file: AllowSupplementaryGroups I also found this post for the exact same situation as you have encountered: http://www.directadmin.com/forum/showthread.php?t=30992 However, it did not offer a solution except for the following: "Changed some exim and clamd settings and voila my problem seems solved!" I checked the logs on my servers and have not yet seen this error message, however, I will continue to watch my logs closely especially for my relay domains. Let me know what you find when you figure it out. Gordon