At 12:58 PM 2/2/2006, Jason Haar wrote:
> my softlimit's at 200MB. That will be your problem then. Don't forget - just because a message is 90M doesn't mean clamd needs 90M of RAM. It's all up to what kind of file it is scanning (e.g. zip archive), what the config details are, etc. BTW - you made no mention of the details about the message in question. Is it a zip attachment that causes the problem or what?
actually, i don't know what kind of message it was - i just rerouted directly the pop server when i saw there was a message that size, so it could have been a pdf, zip, dunno. should have checked, i know.
So as you say clamd grows to 190M, I'm going to guess what is actually happening is that it's wanting to grow to +200M - but softlimit is stopping it, and it gets into a bad state. You have ExitonOOM set - is that triggering?
yes, it does appear to, i have it set to send me an alert when it's restarted, and i get them sporadically during the day.
Increase softlimit to 300000000 and see if that fixes your problem. If you don't like the idea of such large memory usage, then the question should be asked as to why you don't limit/stop such large messages being accepted by your Qmail system (i.e. /var/qmail/control/databytes)
i've no problem with that much memory usage in the bigger scheme of things, though i probably should think about adding more ram to the box.
I must say that the option of Qmail-Scanner specifically not calling AV on files greater than some size does have some merit. I'll think about it. I am worried that people would make that number too low. e.g. Everyone has DSL+ these days: what's to stop a virus writer just generating 20M viruses - so as to get around AVs that have limits of 10M? I'm already getting spam that's >1M in size (which bypasses our SpamAssassin setup)
yeah, it's always possible the scumbags\\\\\\viruswriters could just up the arms race. as fat pipes become ever more the norm, it's probably likely.
It's strange: clamd.conf refers to ArchiveMaxFileSize as a way of limiting what max archive file size it will scan - but I see no "MaxFileSize" option - to stop it scanning 300M TIFF files for example. I can't see why it has one option and not the other.
same here. but not being a programmer myself, i've no clue whether there's some particular difficulty in implementing something like that.
Paul Theodoropoulos http://www.anastrophe.com http://www.smileglobal.com http://www.forumgarden.com ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642 _______________________________________________ Qmail-scanner-general mailing list Qmail-scanner-general@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
