<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3395" name=GENERATOR></HEAD>
<BODY text=#000099 bgColor=#ffffff>
<DIV dir=ltr align=left><SPAN class=599511115-23102008><FONT face=Verdana
color=#0000ff size=2>This would probably be best done as a client-side test,
launched externally from the standard Hobbit client functions. It is
pretty easy to integrate custom tests with the Hobbit
infrastructure.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=599511115-23102008><FONT face=Verdana
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=599511115-23102008><FONT face=Verdana
color=#0000ff size=2>GLH</FONT></SPAN></DIV><BR>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Jon Boede [mailto:jon@shadowsoft.com]
<BR><B>Sent:</B> Thursday, October 23, 2008 9:44 AM<BR><B>To:</B>
hobbit@hswn.dk<BR><B>Subject:</B> Re: [hobbit] clamd
monitoring<BR></FONT><BR></DIV>
<DIV></DIV>While we're on the topic...<BR><BR>It seems that the clamd
monitoring just checks to see if clamd is answering the phone.
<BR><BR>Is there a way to check that clamd is, well, happy as a clam?
This is to say, up to date, hasn't found anything,
etc.?<BR><BR>Thanks,<BR>Jon<BR><BR>Bill Arlofski wrote:
<BLOCKQUOTE cite=mid:48FFAA7F.7000900@revpol.com type="cite"><PRE wrap="">Hanrahan, Kevin wrote:
</PRE>
<BLOCKQUOTE type="cite"><PRE wrap="">Hi all,
I am having trouble monitoring clamAV. As in the docs, I put "clamd" in the bb-hosts file for my monitored host but I get the following result:
Service clamd on server.domain.com is not OK : Service unavailable (No route to host)
The server is reachable so there really IS a route to the host.
any ideas?
kh
</PRE></BLOCKQUOTE><PRE wrap=""><!---->
Just a guess, but I bet that clamd on the server is either listening on
127.0.0.1:3310/TCP or only on a local socket, either of which would render it
it inaccessible from a remote monitoring server.
Usually this is the desired configuration since then only the mail server
itself can "use" the clamd service. From the /etc/clamd.conf file:
--[snip]--
# TCP port address.
# Default: no
TCPSocket 3310
# TCP address.
# By default we bind to INADDR_ANY, probably not wise.
# Enable the following to provide some degree of protection
# from the outside world.
# Default: no
#TCPAddr 127.0.0.1
--[snip]--
You'll have to find your clamd config file and tell it to bind to all IP
addresses by commenting out that TCPAddr line and then either secure it with
iptables on the local host or recompile it with tcpwrappers support.
Oh and check this option too --> "LocalSocket". It may be enabled on your
installation:
--[snip]--
# The daemon works in a local OR a network mode. Due to security reasons we
# recommend the local mode.
# Path to a local socket file the daemon will listen on.
# Default: disabled (must be specified by a user)
# LocalSocket /var/run/clamav/clamav.sock
--[snip]--
--
Bill Arlofski
Reverse Polarity, LLC
<A class=moz-txt-link-freetext href="http://www.revpol.com/">http://www.revpol.com/</A>
* Stop the NSA from illegally eavesdropping on your personal email *
Learn about PGP and start encrypting your email today
<A class=moz-txt-link-freetext href="http://gnupg.org">http://gnupg.org</A> or <A class=moz-txt-link-freetext href="http://www.pgp.com">http://www.pgp.com</A>
To unsubscribe from the hobbit list, send an e-mail to
<A class=moz-txt-link-abbreviated href="mailto:hobbit-unsubscribe@hswn.dk">hobbit-unsubscribe@hswn.dk</A>
</PRE></BLOCKQUOTE><BR></BLOCKQUOTE></BODY></HTML>