On Fri, 2007-08-03 at 16:18 -0500, Daniel J McDonald wrote:
> I've had really good success with clamav for a few years now, but I've
> had a message stuck in my queue for a week:
> Aug 3 14:54:08 sa postfix/lmtp[25237]: 9A1381196:
> to=<[EMAIL PROTECTED]>, relay=127.0.0.1[127.0.0.1]:10025,
> delay=363983, delays=363554/0.02/0/428, dsn=4.5.0, status=deferred (host
> 127.0.0.1[127.0.0.1] said: 451 4.5.0 Error in processing, id=25448-06,
> virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamd
> av-scanner FAILED: CODE(0x804bbac) Exceeded allowed time at (eval 50)
> line 309. at (eval 50) line 511.; ClamAV-clamscan av-scanner
> FAILED: /usr/bin/clamscan collect_results - reading aborted: timed out
> at /usr/sbin/amavisd line 2812. at (eval 50) line 511. (in reply to end
> of DATA command))
[...]
> The message contains a pdf:
> []$ sudo postcat -q 9A1381196 | grep Content-Type:
> Content-Type: multipart/mixed;
> Content-Type: multipart/alternative;
> Content-Type: text/plain;
> Content-Type: text/html;
> Content-Type: application/pdf;
>
>
> It appears to be rather large:
> []$ sudo postcat -q 9A1381196 | wc
> 118520 118856 9113939
>
> And it takes a long time when run interactively:
> []$ sudo postcat -q 9A1381196 | clamscan -
> stdin: OK
>
> ----------- SCAN SUMMARY -----------
> Known viruses: 142140
> Engine version: 0.91.1
> Scanned directories: 0
> Scanned files: 1
> Infected files: 0
> Data scanned: 25.20 MB
> Time: 488.716 sec (8 m 8 s)
Yes, the message indeed appears to be rather large... ;)
> from the content, it appears to be marketing anyway, so it's not
> critical, but advice on what to do with it would be appreciated.
Limit the size of mails for scanning in whatever calls ClamAV?
Scanning huge messages takes a long time (scales worth than linear,
AFAIK), and that's why you get a timeout.
guenther
--
char *t="[EMAIL PROTECTED]";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
