Some of my business customers occasionally exchange very large
messages, for example today, a message about 83MB in size. When such
a message hits my clamd/spamassassin proxy server, clamd's size
'explodes', and it start blocking the flow of other messages. for
example, in top, the resident size may be as high as 190MB. when this
occurs, i have to kill and restart clamd to restore normal
functionality (i'm running 0.88 in freebsd). of course, since the
huge message didn't go through, it sits on my MX, waiting to be
requeued, and the process starts all over again, until i bypass the
clam/spam proxy and just dump the message unscanned onto my popserver.
i'm unclear what exactly i'm doing wrong. here's my current clamd.conf:
Foreground
LogFile /var/log/clamd.log
LogFileMaxSize 25M
LogTime
LogSyslog
LogVerbose
LogFacility LOG_LOCAL6
PidFile /var/run/clamd/clamd.pid
LocalSocket /tmp/clamd
FixStaleSocket
MaxConnectionQueueLength 500
StreamMaxLength 100K
MaxThreads 500
ReadTimeout 1200
IdleTimeout 240
MaxDirectoryRecursion 25
SelfCheck 3600
ExitOnOOM
User qscand
ScanPE
ArchiveMaxCompressionRatio 0
ArchiveMaxFileSize 100K
ArchiveMaxRecursion 45
ArchiveMaxFiles 800
i run in foreground as i have it running supervised. i realize my
maxconnectionqueuelength and maxthreads are absurdely high - those
were just my latest stabs at trying to 'help' the message through.
normally they are 1/10th that size. clamd is spawned via
qmail-scanner-queue. i'd have thought that the archivemaxfilesize
would cause the giant message to be bypassed by clamav; i realize
that may be an utterly clueless conjecture.
thanks in advance for any clues.
Paul Theodoropoulos
http://www.anastrophe.com
http://www.smileglobal.com
http://www.forumgarden.com
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
