Hi there, On Fri, 23 Sep 2005 R. Steven Rainwater wrote:
> On Thu, 2005-09-22 at 17:16, Todd Lyons wrote: > > > Pick up the max children setting. See if that makes a difference. > > Watch as the number of processes build up. > > Thanks Todd, this was the first thing I've tried that helped. [snip] > > I still find it odd that 0.87 seems so broken. All the previous versions > we've run on this machine have been very stable. And I take it this is > not a problem anyone else is seeing [snip] I think I may have seen it a few times here, but it's been so rare that I haven't mentioned it. I have a client company which often sends and receives mails of several megabytes, just ocasionally more than 20Mb. Like Steve I'm using clamav-milter + sendmail (not clamd) in this client's installation although I'm still using clamav 0.86.1 (I like things to settle down a bit before I upgrade:). The number of emails at the client site is small, roughly twenty or thirty per day. I use ReadTimeout 600. About a month ago I upgraded the mail-server from 500MHz AMD K6 to 2.8GHz Intel P4 and set a limit of 30Mbytes on all mail, incoming or outgoing. I haven't seen a hung clamav-milter daemon since then but I guess that doesn't mean very much. I'll shout (on-list) if I see any more. > I think that certain emails are crashing clamav-milter or clamd when > it reads them, causing the processes to hang. Agreed - except I'm not using clamd of course. > We occasional get emails that take an hour or so to receive and process. Yikes! > Prior to 0.87, you'd see a sendmail process along with the associated > clamav-milter and spamass-milter processes hanging out Hmmm. I'm not using the milter version of SpamAssassin. > question now is how can determine for sure if it's a specifically > formatted email that's causing the clamav crashes FWIW I think it's as likely to be the size of the mail (or rather, the processing time) as the content. > if so, how can I capture one of the emails? Set up a procmail rule to copy all incoming mail someplace, prune it after some period of time or when it gets to a certain size. As soon as you see a hung process, grab the file - it's in there somewhere. > > Also check dmesg to see if it's reporting weird things such as NMI > > errors (ie bad memory);. > > I checked this and nothing unusual is being reported. I don't think this is likely to be the problem, or we'd be seeing other problems elsewhere too. 73, Ged. PS: My own mail has some pretty unforgiving anti-spam measures, so please reply only on-list (unless you're prepared for mail not to reach me.:) _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
