On Thu, 2007-10-11 at 12:47 +0100, mark wrote: > Does anyone have any experiences similar to this or ideas as to how to go > about debugging the problem? It didn't appear in the lab with 40 > simultaneous connections, and only appears during the peak hours, so it's a > bit difficult to reproduce but I'll carry on trying. >
I would probably start by checking the following: 1. Check you aren't running out of ephemeral ports. Try and monitor the number and state of your IP ports. 2. Check what files clamd is scanning, which you can do through /proc 3. Check clamd isn't doing a DB reload during this time. 4. Remove the sanesecurity sigs and see if the problem goes away. 5. strace clamd during the 'hang' to see what clamd is doing. 6. Use tcpdump to see what is happening on the network. -trog
signature.asc
Description: This is a digitally signed message part
_______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
