Can you tie your problems up with particular mails from your logs ? I've found Clam is very greedy on big MIME mails, as it stores the entire mail in RAM whilst extracting the attachments.
The last few that have triggered this condition seem to be caused by large files. I will get a log like:
WARNING: ScanStream: Size limit reached ( max: 10485760)
Why doesn't clamav skip the file if it is larger than its max file size? After this, it throws a few hundred like the following within 1 second:
LibClamAV Error: cli_malloc(): Can't allocate memory (8 bytes). malloc_problem: Cannot allocate memory
Why does libclamav throw several hundred of these before actually dieing? Seems to me that ExitOnOOM should make it die immediately when one of these is thrown. Of course, I'm also not a devel. :P At any rate, those messasges are often followed by:
ERROR: ScanStream: Can't create temporary file.
That seems to be where clamd is choking. At any rate, I'm running without a softlimit right now so we will see what happens. Other avenues to persue would be helpful. Steve _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
