Chuck Swiger wrote: > On Jun 18, 2007, at 12:19 PM, jef moskot wrote: >> On Mon, 18 Jun 2007, Dennis Peterson wrote: >>> Clamscan is a terrible tool to use in real time with email. >> I would recommend it for low volume servers with cycles to burn, given >> that the other option is a daemon that can potentially fail. >> Neither is >> entirely ideal, but we should take the wide variety of environments >> into >> account. >> >> Maybe the default recommendation should be clamdscan, but clamscan >> is not >> an unreasonable choice in certain circumstances. > > Note that some of the systems which interface between ClamAV and the > MTA, such as Amavisd-new, will use a connection to clamd by > preference, but will fall back to invoking clamscan as a secondary > scanner if the primary connection to clamd ever fails. > > In general, the machines which I am running ClamAV on seem to have no > problems keeping both clamd and freshclam up and running for months > at a time, so if you are experiencing clamd failing often, it's > possibly a sign of hardware issues like bad RAM, poor cooling, or a > dying/marginal power-supply unit.... >
Actually, it is most commonly found to be (in my experience) corrupt or mishandled 3rd party pattern files. Clamd will die a cold black death if there is any error in a pattern file, and it will die that some choking death if you use non-atomic file transfers when putting those files in the working directory right at a time when clamd is re-reading them. There are work-arounds available to solve the problem. dp _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
