sorry for the bad wrapping. not sure how to make yahoo do better than
that....
--- René Berber <[EMAIL PROTECTED]> wrote:
> email builder wrote:
> [snip]
> > Respectfully (you sound like you know a hell of a lot more than I do
> about
> > these things), the OP presumably (hopefully?) does more than look once at
> top
> > and send out emergency emails to this list. I personally watch system
> load
> > (just from "w" command as well as top) several times a day as well as
> watch
> > my overall mail queue sizes. And I think I can be pretty sure that the
> CPU
> > usage spikes from clam are not flukes -- while "top" may not be as useful
> as
> > prstat (which I am not familiar with but will research, thank you (anyone
> > have a favorite link for prstat?)), it *is* still surely of some use,
> > especially when watched regularly and in combination with seeing higher
> > average queue backups than when using clam .80
>
> prstat is a Solaris command, it doesn't exist anywere else AFAIK, my
> recomendation could be seen with top itself: many times top is one of the
> processes that uses most of the CPU.
Yep, that's obvious to anyone who stares at top with any regularity. That
doesn't mean that top is useless tho. :)
> Now the point of my remark has to do with statistics. A few data points
> don't
> lead to meaningful statistics; what you can do with top is limited,
> nevertheless
> if you or anybody sees high CPU usage that is interesting even if it
> doesn't
> tell you why, i.e. it could be high message load, it could be attachments
> in
> messages, it could be a combination of those or something else.
I understand and agree. But, as useful as looking at stats can be, it's not
the only way to gague system performance IMO. As even a novice admin, I
think you can watch CPU usage with top or system load with w on a regular
basis, and you *can* eyeball things to a certain extent, especially if you
can keep an eye on those things on a regular basis over a period of time and
if you can swap out software versions for comparison. Sure, virus explosions
could seriously warp stats, but I don't think when we saw .83 kill our CPU
and we rolled back to .80 and the CPU dropped off substantially that it was
due to some strange virus that happened to only attack us when we were
running .83. With enough diligence, subjective analysis isn't completely
invalid. But I'm not trying to start a fight. :)
> >>>Anyone have any suggestions with .80 or .84 CPU load issue.
> >>
> >>Tune up clamd. That means adjusting the MaxConnectionQueueLength,
> >>MaxThreads,
> >>ArchiveMaxFileSize, ArchiveLimitMemoryUsage options on clamd.conf taking
> >>into
> >>consideration that RAM is limited.
> >
> >
> > I hear that. Our situation is such that we see no swapping, but still
> lots
> > of CPU consumption. But I am willing to be educated on better clam
> settings,
> > since we haven't tweaked extensively in that regard.... but still, .80
> with
> > the same config was pretty quiet on our system.
>
> The OP has stated that RAM is not the problem. I'm just trying to guess
> the
> environment and that was a bad assumption.
>
> Now wrt 0.80 vs 0.85, my point about the benchmark is that if you don't
> compare
> them under similar conditions the comparison is invalid. Think about this,
> did
> 0.80 catch as many viri as 0.85 when you messured?
We rolled back to .80 and CPU went back to the low levels it was at
before....
> As for tunning, the main parameters are the number of threads and what to
> skip
> (I usually don't want really big messages scanned, viri come in around 50KB
> no
> need to check 2MB or more;
Where do you do that? Clam itself only has ArchiveMaxFileSize and
ClamukoMaxFileSize (but we don't use claumuko). I don't see anything obvious
in my amavis config (might be missing a default config somewhere else
though), and I don't know how to make Postfix skip a content filter based on
that kind of rule....?
> but this is from experience and recomendations,
> so
> it's really only an heuristic).
Thank you kindly.
__________________________________
Yahoo! Mail Mobile
Take Yahoo! Mail with you! Check email on your mobile phone.
http://mobile.yahoo.com/learn/mail
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
