Another FreeBSD Avast issue

[gillsr]

Well, it seems I'm now stuck at another interesting place with Avast... I was hoping someone on this list might have some ideas.

This time, the command-line scanner is having a hard time allocating enough memory to scan:

# truss /usr/bin/avast -c -t A -n /tmp/exe/x.exe
...

open("/etc/avastengine.conf",0x0,00)             = 5 (0x5)
fcntl(0x5,0x3,0x0)                               = 0 (0x0)
fcntl(0x5,0x4,0x4)                               = 0 (0x0)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057,0x1)                         = 1 (0x1)
read(0x5,0xbfbff057avast: can not initialize avast! engine: Cannot allocate memory
Profiling time alarm

Does anyone know how much memory I need to have free in order for this to work properly?  It appears to do the same thing with other executables.  The program was running fine previously and the only thing I can think of is that I'm presently running a gzip process in the background.

What's funny is I have plenty of memory on this system and a 'vmstat 1' doesn't show me getting close to any limits.  A few avastd processes were running so I've killed them all and restarted avastd.

This time, truss shows the following:

...
read(0x5,0xbfbff077,0x1)                         = 1 (0x1)
read(0x5,0xbfbff077,0x1)                         = 1 (0x1)
fstat(5,0xbfbfefec)                              = 0 (0x0)
fcntl(0x5,0x3,0x0)                               = 4 (0x4)
fcntl(0x5,0x4,0x0)                               = 0 (0x0)
close(5)                                         = 0 (0x0)
break(0x8071000)                                 = 0 (0x0)
lstat("/var/lib/avast4/400.vps",0xbfbff334)      = 0 (0x0)
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
semsys(0x1,0x5000bd67,0x3,0x7b6,0x2825c048)      = 1850081280 (0x6e460000)
semsys(0x2,0x6e460000,0xbfbff484,0x3,0x0)        = 0 (0x0)
semsys(0x0,0x6e460000,0x0,0x2,0xbfbff3d8)        = 0 (0x0)
semsys(0x2,0x6e460000,0xbfbff474,0x1,0x0)        = 0 (0x0)
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x7300bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x6100bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x7000bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x6d00bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x6900bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x6e00bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x6400bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x6600bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x7400bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x7500bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x7600bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x7200bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(0x3,0x6500bd67,0x0,0x0)                   ERR#2 'No such file or directory'
stat("/var/lib/avast4/400.vps",0xbfbff37c)       = 0 (0x0)
shmsys(avast: can not initialize avast! engine: Cannot allocate memory
Profiling time alarm

Yet:

# ls -la /var/lib/avast4/400.vps
-rw-r--r--  1 root  wheel  2010304 Mar 30 14:33 /var/lib/avast4/400.vps

Odd.  Trying to fire up avastd or avast again, and I get the same out of memory issues.

From avastd logfile:

Apr 01 05:38:30 avastd[23206]: error: 'avast4file[23208]': can't initialize avast! engine: Cannot allocate memory
Apr 01 05:38:30 avastd[23206]: info: 'avast4file[23208]': closing process
Apr 01 05:38:30 avastd[23206]: info: avast! server: closing avast! server '/var/run/avast4filescanner.sock'
Apr 01 05:38:30 avastd[23206]: info: Quitting avast! daemon

It sounds like I may need some  more tweaking :/.

[gillsr]

Well, it appears it was shared memory related afterall.  Thankfully in this case I didn't need to tweak any kernel paremeters to increase the amount of allowable shared memory.  I found a script called shmfree.pl that does a pretty good job of removing unused shared memory with the system ipcs and ipcrm commands.

[gillsr]

Another small update...

avastd appears to hang on to shared memory segments over time and not let them go.   the commandline scanner fails after a time once avastd begins to complain.  I can get around this by running them shmfree.pl tool to clear up the shared memory, but I'm wondering if others have run into this or have other suggestions as to how to make avastd more stable.  I can get by with just the commandline scanner but I'd rather use the daemon for improved performance as well.

[gillsr]

Has support come out with a fix for this yet?

I'd like to run postgres and avast on the same box, but as soon as I re-enable postgres I start to run into the same memory issues as before.  Avast just hangs and never recovers without an external Kill -9.

semsys(0x1,0x4e00bebf,0x3,0x7a4,0x6)             ERR#28 'No space left on device'
mmap(0xbfaef000,65536,0x3,0x400,-1,0x0)          = -1079054336 (0xbfaef000)
setitimer(0x2,0xbfbfea38,0x0)                    = 0 (0x0)
mmap(0xbfade000,65536,0x3,0x400,-1,0x0)          = -1079123968 (0xbfade000)
__sysctl(0xbfafeef4,0x2,0xbfafeee4,0xbfafeef0,0x0,0x0) = 0 (0x0)
gettimeofday(0xbfafeedc,0x0)                     = 0 (0x0)
__sysctl(0xbfafee54,0x2,0xbfafee44,0xbfafee50,0x0,0x0) = 0 (0x0)
gettimeofday(0xbfafee3c,0x0)                     = 0 (0x0)
__sysctl(0xbfafee54,0x2,0xbfafee44,0xbfafee50,0x0,0x0) = 0 (0x0)
gettimeofday(0xbfafee3c,0x0)                     = 0 (0x0)
SIGNAL 27
SIGNAL 27
clock_gettime(0x0,0xbfaedfa4)                    = 0 (0x0)
gettimeofday(0x28108748,0x0)                     = 0 (0x0)
sigprocmask(0x3,0x281087b8,0x0)                  = 0 (0x0)
sigreturn(0xbfaedddc)                            = 0 (0x0)
lstat("/var/lib/avast4/400.vps",0xbfbfe8f0)      = 0 (0x0)
stat("/var/lib/avast4/400.vps",0xbfbfe938)       = 0 (0x0)
semsys(0x1,0x5000bebf,0x3,0x7b6,0x6)             ERR#28 'No space left on device'
lstat("/var/lib/avast4/400.vps",0xbfbfe900)      = 0 (0x0)
stat("/var/lib/avast4/400.vps",0xbfbfe948)       = 0 (0x0)
shmsys(0x3,0x6c00bebf,0x0,0x0)                   = 13565970 (0xcf0012)
shmsys(0x4,0xcf0012,0x2,0xbfbfe9d0)              = 0 (0x0)
shmsys(0x0,0xcf0012,0x0,0x1000)                  = 805601280 (0x30048000)
shmsys(0x2,0x30048000,0xbfbfe9b8,0x280a4150)     = 0 (0x0)
getuid()                                         = 0 (0x0)

[Dublin]

Has been fixed in the 2.0.0 version. Thank you very much for your help, Steve.