On Mar 4, 2004, at 15:02, Doug Hardie wrote:
I am trying to use clamav to scan mail on a prduction mail server that has fairly high volume of mail and quite a large volume of viruses being receivied. The only version of clamd I can run for any duration is clamav-devel-20040209. That version runs for 4 to 5 days on my production mail server before dying. Everything since then can't last over an hour. I am trying clamav-devel-20040304 right now and it has managed to last an hour twice and 44 minutes once. What happens is that clamd runs using less than 3% of the cpu until it nears the end. Then it takes over all the available cpu running idle to zero. It continues to function this way for a couple minutes and then quits responding at all to clamav-milter. Then it goes away quietly. The only messages associated with it are notes from sendmail that it is unable to malloc more memory. I have submitted debug logs etc. but heard nothing back.
One possibility is that this is a thread issue. Perhaps the clamav.conf settings are not optimal for this volume. However, I don't see anyway to determine the thread usage. If it used processes the standard unix tools would let me see what is going on. I don't see anything similar for threads. The appropriate entries are:
StreamSaveToDisk StreamMaxLength 5M MaxThreads 200 #ThreadTimeout 500
I just uncommented the thread timeout the last time I restarted clamd a couple minutes ago so I don't know what effect that will have.
Running on FreeBSD 4.6 with sendmail clamd / ClamAV version devel-20040304, clamav-milter version 0.67j
I really don't want to have to go back to the old version as the volume of encrypted zip files is quite large.
Here is some more information: After running with the timeout set to 500, clamd no longer dies. It chugs along for quite awhile (about 10 minutes) at full cpu usage and then returns to normal use. I don't see anything different in the load between the periods. However a ktrace of clamd shows a significant difference. Normally clamd shows nothing much when idle and it shows the messages being received (read) when processing a message. However, when its running at full cpu utilization, ktrace shows thousands of sequences like:
8313 clamd PSIG SIGPROF caught handler=0x28116228 mask=0x0 code=0x0
8313 clamd CALL gettimeofday(0x2815fe4c,0)
8313 clamd RET gettimeofday 0
8313 clamd CALL sigprocmask(0x3,0x2815fed8,0)
8313 clamd RET sigprocmask 0
8313 clamd CALL sigaltstack(0x2817c000,0)
8313 clamd RET sigaltstack 0
8313 clamd CALL poll(0x806f000,0x1,0)
8313 clamd RET poll 0
8313 clamd CALL sigreturn(0x808ac64)
8313 clamd RET sigreturn JUSTRETURN
and then there will be one message processed and then back to a few more thousand of those sequences.
------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
