On Tue, 3 May 2011, smallrat wrote:
John Hardin wrote:
Trivial answer: don't put messages that large into your corpus.
Are you sure it's frozen? What's your CPU usage? How long did you wait?
Did your box start swapping?
If you're going to feed messages >1.5MB or so to SA, assuming your box has
the oomph to handle them at all, you'll simply have to be patient while it
scans them.
I need the messages to be processed with mass-check. And yes, the computer
doesn't go any further, so I am pretty sure it's frozen (I waited over one
hour to see if it goes on).
What was the CPU usage and swap activity during that time?
The last thing it wrote was an report "Plugin eval failed" and I have read
somewhere, that it could be caused by insufficient RAM size. Could it be
also my case?
I actually run that computer only as virtual machine with 512 MB of ram, so
I supose it can be caused by this, can't it?
It wouldn't surprise me one bit.
Is there any possibility of pruning the size of those messages down? Do
they have large attachments of a type that SA isn't going to scan anyway,
that could be deleted (or, if you still want the effects of SA scanning
the MIME attachment headers, that could have the majority of their base64
removed)?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
A sword is never a killer, it is but a tool in the killer's hands.
-- Lucius Annaeus Seneca (Martial) 4BC-65AD
-----------------------------------------------------------------------
5 days until the 66th anniversary of VE day
