giant clamav - qmail-scanner involved?

i posted the following question over on the clamav mailing list, but 
the suggestion was that whatever is calling clamav, in my case 
qmail-scanner, was the likely place to look for a way to control 
this. but i'm not too clear on what i'm missing.

here's what i posted. thoughts?

Some of my business customers occasionally exchange very large 
messages, for example today, a message about 83MB in size. When such 
a message hits my clamd/spamassassin proxy server, clamd's size 
'explodes', and it start blocking the flow of other messages. for 
example, in top, the resident size may be as high as 190MB. when this 
occurs, i have to kill and restart clamd to restore normal 
functionality (i'm running 0.88 in freebsd). of course, since the 
huge message didn't go through, it sits on my MX, waiting to be 
requeued, and the process starts all over again, until i bypass the 
clam/spam proxy and just dump the message unscanned onto my popserver.

i'm unclear what exactly i'm doing wrong. here's my current clamd.conf:

Foreground
LogFile /var/log/clamd.log
LogFileMaxSize 25M
LogTime
LogSyslog
LogVerbose
LogFacility LOG_LOCAL6
PidFile /var/run/clamd/clamd.pid
LocalSocket /tmp/clamd
FixStaleSocket
MaxConnectionQueueLength 500
StreamMaxLength 100K
MaxThreads 500
ReadTimeout 1200
IdleTimeout 240
MaxDirectoryRecursion 25
SelfCheck 3600
ExitOnOOM
User qscand
ScanPE
ArchiveMaxCompressionRatio 0
ArchiveMaxFileSize 100K
ArchiveMaxRecursion 45
ArchiveMaxFiles 800

i run in foreground as i have it running supervised. i realize my 
maxconnectionqueuelength and maxthreads are absurdely high - those 
were just my latest stabs at trying to 'help' the message through. 
normally they are 1/10th that size. clamd is spawned via 
qmail-scanner-queue. i'd have thought that the archivemaxfilesize 
would cause the giant message to be bypassed by clamav; i realize 
that may be an utterly clueless conjecture.

thanks in advance for any clues.


Paul Theodoropoulos
http://www.anastrophe.com
http://www.smileglobal.com
http://www.forumgarden.com






-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642