Thomas Lamy wrote: > Ken Goods wrote: >> René Bellora wrote: >> <snip> >>> it *is* a MailScanner message. May be virus scanning took too much >>> time? >> > > Most definitely. And MailScanner seems to think from this, that the > email contains some zip-bomb. > >> Thanks Rene, >> That was helpful, I'll take this back to the MailScanner list. >> >> Kind regards, >> Ken > Look at your config file, and set (or add): > Virus Scanner Timeout 600 (the default is 300) > > Do you have the offending (raw) mail? Which version of clamav? > > Thomas
Thanks Thomas, Rene got me on the right track and I just increasing the timeout when I saw your post. It is now set to 600 as you suggested. Actually I'm getting these about every 7-9 minutes, doesn't seem to be related to a particular mail but I could be wrong there. It started a week ago Friday at about noon PST(US). I had not even logged on to the machine for a couple days and mail volume had not changed nor had virus nor spam volume. At the same time my load went from .2-.8 to 1-2 and is now hitting 3 on occasion. I'm really at a loss. I thought perhaps a cvd may have caused this since nothing else happens automatically on that box. (Well at least no other auto updates and such. So that made me look towards Clam. It is possible that we are getting hit with come kind of zip-bomb but it's so regular I just don't know. I checked my cron jobs just in case but they had not changed and I don't see anything happening near that often. I'm considering cleaning everything out and installing current versions of Clam, SA, and MS. Hopefully whatever is causing the slowdown will be eliminated. If not, at least I know I can look elsewhere. I'll let the higher timeout cook overnight and see what happens in the morning. Thanks for the tips, Ken _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
