I was running into a an issue with what I thought were incorrectly calculated quota totals, but I have now discovered that it does appear correct, although the figures raises a few questions.
For a few email users on the system, the values shown on the "Edit Mail and FTP Users" page the values shown under "Quota used" appeared to me significantly higher than what it should have been. For example, checking the actual space in use for a particular user with a "du -ch" command suggested only 24MB was in use, yet 100MB was showing up as quota space in use. After searching the forums, I then checked for temp files and found a significant amount of space in use for this user that appears to relate to clamav. There were 3 directories for this user under /var/tmp which contained 34MB, 26MB and 16MB. Each directory had just a few files (main.db, main.hdb, main.info, main.mdb, COPYING), 3 of which were quite large.
Do you know why such directories/files are being created, and more importantly, why they're not being deleted?
Comments
Submitted by JamieCameron on Tue, 07/07/2009 - 11:20 Comment #1
There is a bug in ClamAV that can cause these files to be created sometimes. The best fix is to switch to running clamd, which also has the benefit of being much faster. You can see instructions on enabling it at http://www.virtualmin.com/documentation/id,spam_and_virus_scanning/ , in the section on Clamd.
Submitted by novoops on Tue, 07/07/2009 - 12:19 Comment #2
So I assume removing these temp files shouldn't cause any issues. I'll run ClamAV via clamd, which I prefer anyway (not sure why I wasn't doing that anyway). I'd prefer to be running Spamassassin that way too, but don't really want to lose the per domain configuration, so I have to run it as a standalone program.
As far as ClamAV, I had found some references to the bug you mentioned, but I thought is was for an earlier version of clamav; I guess they haven't resolved it yet.
Also, there doesn't seem to be a Webmin (or Virtualmin) module to configure clamav like there is for spamassassin. Is that something I'm just not seeing, or it (hopefully) a future addition? I ask, because although it should be easy enough to configure it directly, the more I use Virtualmin/Webmin, the more I'm really starting to appreciate how easy it is to manage the system with it :-)
Submitted by JamieCameron on Tue, 07/07/2009 - 13:29 Comment #3
Yes, you can safely delete those files.
There's no UI in Webmin or Virtualmin yet for ClamAV, mainly because it doesn't really need much configuration in typical use.
Submitted by novoops on Tue, 07/07/2009 - 13:38 Comment #4
That makes sense. I don't know much about ClamAV, hence I'm just letting Virtualmin manage it complete for me for now. Sounds like there's not much to do for it.
Does virtualmin manage updating the clamav virus database, or is that something we should setup a cron process for? (Might be a nice addition to Virtualmin if it doesn't currently do this).
Submitted by JamieCameron on Tue, 07/07/2009 - 14:40 Comment #5
There should be a cron job that is part of the clamav package that runs freshclam daily to update the virus DB.
Submitted by novoops on Tue, 07/07/2009 - 14:48 Comment #6
Doesn't seem to be listed as a scheduled cron job. Other than just running "freshclam", anything else you think needs to be setup? Any command line options you recommend?
Submitted by JamieCameron on Tue, 07/07/2009 - 17:58 Comment #7
All you should need to run is 'freshclam'. Check the files under /etc/cron* for one that already runs it though..
Submitted by novoops on Tue, 07/07/2009 - 19:08 Comment #8
I don't see any such files on my system, and cron related files don't seem to be a part of clamav install, at least not from the FreeBSD ports collection. Oh well. I'll just setup a cron job.
Would you have any good reasons to recommend against running it more often than daily? I was thinking perhaps once every 6 or 4 hours might even be good. Not much overhead to run, and might be better to get any updates quicker. According to the ClamAV database updating FAQ it is usually updated several times per week, typically within an hour of any new worm discoveries, and could (with the right config) be updated with freshclam as often as 4 times an hour.
Submitted by JamieCameron on Tue, 07/07/2009 - 19:13 Comment #9
The default on most systems is daily, but I can't see much harm in running it more often..
Submitted by Issues on Tue, 07/21/2009 - 19:18 Comment #10
Automatically closed -- issue fixed for 2 weeks with no activity.