Restarting SmarterMail Service and ClamAV
Question asked by Rod Strumbel - 2/19/2019 at 11:32 AM
So I was forced to restart the SmarterMail service today due to the system being unresponsive as a result of running a Message Archive Query (not good folks, this needs fixing).   I had inadvertantly entered 2/19/0019 as the starting date (and the system took it as gospel... again, not good).  Anyway that made the system scan ALL Archive indexes on the machine and it ran and ran and ran.  Which was SUPER slow too, far far slower than prior to updating to the 100.whatever the latest version is.

During that time the CPU was locked at about 90 to 95% and made the the spool backup, users unable to login, and even in the admin I could barely navigate around.

So... Made a judgement call and restarted the SM service.   
That fixed the CPU issue, but introduced a new issue.

Following SM coming back online, the ClamAV stopped communicating with the requests from SM to process messages.   Normally i have maybe 10 to 15 failed connections to ClamAV an hour... now there were THOUSANDS.  And NO successful (aka New) connections (monitored through the charting).   Looking in the ClamAV logs it was something about not loading the PUA files.

After fiddling with the AV processing settings and bumping up the timeout to 120 sec and the count to failure to 40 (saw that recommended here somewhere)... then stopping and restarting the "Enable ClamAV" setting in SM.   After doing that several times, it finally seemed to take effect and start working again.   However, I noticed that even when the setting in SM was "Enable ClamAV" OFF, I would still see the clamd.exe hopping around in the Process list of Task Manager.

So... the question...
If you MUST restart SM Service, what is the proper method and sequence of doing so so that you do not lose your communication with ClamAV?   Or does the entire server need to be restarted instead of just the SM service for that to all sync up correctly?


3 Replies

Reply to Thread
echoDreamz Replied
After all our years and years and years of using SM, we just restart the entire server. Makes sure that everything is starting fresh and clean. Not only that, our server is running on SSDs, so Windows boots in like 8 seconds. Same with updates. We stop SM, uninstall, reboot, install the new version.
Matt Petty Replied
Employee Post
If you turn off ClamAV and it was already running SmarterMail will not kill it. Same could be said if it were previously running and you rebooted SM, the ClamAV is never stopped by SmarterMail except when we do a "freshclam" update.

However, restarting your service even if ClamAV was not restarted should still function. SmarterMail would see it's already running and try to connect to it. So to answer your question you shouldn't have to worry about rebooting ClamAV when restarting SmarterMail, you will lose communication with ClamAV but on boot it should reconnect. It will only do this reconnection when it goes to scan an email, so if you don't see it immediately reconnect it could be that it has not yet started processing a message.
Matt Petty Software Developer SmarterTools Inc. www.smartertools.com
Rod Strumbel Replied
Thanks Matt, I understand the theory, but in reality that is not what happened.   Following the restart of the SM service today, I had the following message repeat over and over until I finally "shook it loose" with what I described above:

Monitoring the ClamAV report, I saw thousands of "Failed Connections" during the time the ClamAV log was displaying that stuff in the log... and NO successful "New Connections".  Once it all shook loose, that switched up and now (as is normally the case) I see ALL "New Connections" and next to no "Failed Connections".

Reply to Thread