--On 23 August 2006 14:50 -0400 Craig Green <[EMAIL PROTECTED]> wrote:
Karl Pielorz wrote:
We've narrowed this down a bit - and it doesn't look like it's just an
issue with 0.88.4 - we backed the server down to 0.88.1 and the same
thing happened...
As has been noted on this list, the 0.8x series is 'old' code. As such,
you may wish to try out clamav-devel from ports--it's (currently) a
snapshot from CVS from early(ish) August.
Hi,
0.88 (and therefore 0.88.4) may be old, but they're still the ones plugged
on the website as the current 'stable' release - just as with FreeBSD we
tend to shy away from running cvs/snapshots on production servers...
The real kicker is this system has been running fine for months, tracking
0.88.x - it's only the last couple of weeks or so (initially when we first
moved to 0.88.4) that clamd would baloon, and die.
I've checked through all the logs on the system, I can't see any nefarious
zips, or attachments (or overly large attachments for that matter) that the
systems having to scan - everything is still 'average' just as it was a
couple of weeks ago :( Unless anything changed with the pattern files
(apart from the obvious updates?)
Even if you don't have dedicated scanning servers, if you have multiple
SMTP servers, then running clamd in TCP mode bound to an external
interface (appropriately firewalled, of course) and setting up
clamav-milter to talk to the local clamd as well as the clamds on the
other SMTP servers would allow scanning to continue in the event of any
local failure.
The only issue we'd have with that is that currently, clam fails in hours -
and if we restrict it's memory to something sensible to avoid swapping the
machine to death, it'll fail even quicker. If we don't restrict it (and
pack out the machine with RAM) - from the rate of expansion whats to say it
won't hit the process limit, and then the address space limit :(
You don't mention what version of FreeBSD you're running; it may not
matter, but the SMTP and scanning servers we run are 6.1-STABLE.
Same here.
-Karl
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
