Broken pipe in _clamav_scan_via_daemon() [#1807940]

Hello,

Thank you for module. I'm using it on linode server with pretty standard nginx / php-cgi / apc configuration and it works fine except some notices found in watchdog:

Notice: stream_copy_to_stream(): send of 8192 bytes failed with errno=32 Broken pipe in _clamav_scan_via_daemon() (line 100 of /public_html/sites/all/modules/clamav/clamav.inc).

Could you please advice?

Thanks.

br,
yg

Comments

Comment #1

manarth commented 10 October 2012 at 08:50

Hmm, that sounds like the output stream (php to ClamAV) is failing intermittently. If that happened, I'd expect the scan to go unchecked, and to see an error in Watchdog, reporting 'Uploaded file %filename could not be scanned. Clamscan reported:<br />@error_string'. Can you see any other ClamAV errors in Drupal (or in ClamAV's own logs)?

Comment #2

yurg commented 18 October 2012 at 20:49

No, no error messages in Drupal Watchdog since. Issue was probably caused by user's attempt to upload relatively big file (~60Mb).

Comment #3

yurg commented 24 October 2012 at 15:04

Hello again,

I was able to reproduce same issue on test server (uploading ~70Mb .ZIP-file) and Watchdog logs were captured. So, in order of appearance:

1. Notice: stream_copy_to_stream(): send of 8192 bytes failed with errno=32 Broken pipe in _clamav_scan_via_daemon() (line 100 of /public_html/sites/all/modules/clamav/clamav.inc).
2. Notice: fwrite(): send of 4 bytes failed with errno=32 Broken pipe in _clamav_scan_via_daemon() (line 103 of /public_html/sites/all/modules/clamav/clamav.inc).
3. Notice: Undefined offset: 1 in _clamav_scan_via_daemon() (line 134 of /public_html/sites/all/modules/clamav/clamav.inc).
4. Uploaded file Heartless-Sound-Vol2.zip could not be scanned. Clamscan reported: (nothing goes after colon).

Think it may be caused by filesizes and/or length the queue of pending connections at clamd.conf:

MaxScanSize = "104857600"
MaxFileSize = "26214400"
MaxConnectionQueueLength 30

I'll try to increase above values and see how it works. Just in case if issue caused by clamav restrictions: would it be possible to print some kind of "clamav scanning filesize restrictions was reached") to Watchdog?

Thank you.

br,
yg

Comment #4

yurg commented 25 October 2012 at 17:28

Status:

Active

» Closed (fixed)

Update: indeed changing StreamMaxLength parameter in /etc/clamav/clamd.conf from default 25M to 250M did the trick. Issue closed.

Comment #5

yurg commented 2 January 2013 at 17:15

Status:

Closed (fixed)

» Active

Hello,

Spoke too soon unfortunately: after upgrading nginx to most recent version plus adding FileField Nginx Progress module&dependencies ( http://drupal.org/project/filefield_nginx_progress ) same error appears again along with ERROR: INSTREAM: Can't write to temporary file. notice in clamav.log.

/tmp folder permissions were checked and path to /tmp folder was manually added to clamd.conf, as well as StreamMaxLength increased up to 450M but all these changes made no difference at all, error still there. I made some experience and discovered that 50Mb file was scanned successfully while 90Mb file scan was failed. So I think that may be there is some kind of file size restrictions in clamav configs or module I just can't find still. Google search brought no results so far. But I found this issue: http://drupal.org/node/1571596 which may (or may not) be connected with instream error mentioned in clamav.log.

So, walking in circles for days, I'd appreciate any advice. Thank you!

Comment #6

calebtr commented 20 June 2013 at 17:58

Is the _clamav_scan_via_daemon() issue separate from the nginx "INSTREAM: Can't write to temporary file" issue?

I had the first issue, _clamav_scan_via_daemon(), and changing StreamMaxLength in clamav.conf to match my maximum in PHP/Drupal did the trick, after restarting clamd.