[EMAIL PROTECTED] wrote: > At 12:58 PM 2/2/2006, Jason Haar wrote: >> > my softlimit's at 200MB. >> That will be your problem then. Don't forget - just because a message is >> 90M doesn't mean clamd needs 90M of RAM. It's all up to what kind of >> file it is scanning (e.g. zip archive), what the config details are, >> etc. BTW - you made no mention of the details about the message in >> question. Is it a zip attachment that causes the problem or what? > > actually, i don't know what kind of message it was - i just rerouted > directly the pop server when i saw there was a message that size, so > it could have been a pdf, zip, dunno. should have checked, i know. >
It would have been spelt out in the qmail-queue.log debug file... >> So as you say clamd grows to 190M, I'm going to guess what is actually >> happening is that it's wanting to grow to +200M - but softlimit is >> stopping it, and it gets into a bad state. You have ExitonOOM set - is >> that triggering? > > yes, it does appear to, i have it set to send me an alert when it's > restarted, and i get them sporadically during the day. The memory issue seems strange. Under Linux 2.6 our clamd processes hover at <60M Don't forget: you can always get rid of the sotflimit calls completely. It may be "good practice", but loosing service due to some weird memory management issue within clamd could be justifiable as a reason to turn it off... After all - they're your boxes - you make the call :-) > >> Increase softlimit to 300000000 and see if that fixes your problem. If >> you don't like the idea of such large memory usage, then the question >> should be asked as to why you don't limit/stop such large messages being >> accepted by your Qmail system (i.e. /var/qmail/control/databytes) > > i've no problem with that much memory usage in the bigger scheme of > things, though i probably should think about adding more ram to the box. > Yes. If clamd does actually need to grow to over 200M in order to handle such messages, then obviously having that much memory available is necessary. However, no reason it can't be your swap... That's what it's there for :-) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642 _______________________________________________ Qmail-scanner-general mailing list Qmail-scanner-general@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
