At 12:58 PM 2/2/2006, Jason Haar wrote:
> > my softlimit's at 200MB.
>That will be your problem then. Don't forget - just because a message is
>90M doesn't mean clamd needs 90M of RAM. It's all up to what kind of
>file it is scanning (e.g. zip archive), what the config details are,
>etc. BTW - you made no mention of the details about the message in
>question. Is it a zip attachment that causes the problem or what?
actually, i don't know what kind of message it was - i just rerouted
directly the pop server when i saw there was a message that size, so
it could have been a pdf, zip, dunno. should have checked, i know.
>So as you say clamd grows to 190M, I'm going to guess what is actually
>happening is that it's wanting to grow to +200M - but softlimit is
>stopping it, and it gets into a bad state. You have ExitonOOM set - is
>that triggering?
yes, it does appear to, i have it set to send me an alert when it's
restarted, and i get them sporadically during the day.
>Increase softlimit to 300000000 and see if that fixes your problem. If
>you don't like the idea of such large memory usage, then the question
>should be asked as to why you don't limit/stop such large messages being
>accepted by your Qmail system (i.e. /var/qmail/control/databytes)
i've no problem with that much memory usage in the bigger scheme of
things, though i probably should think about adding more ram to the box.
>I must say that the option of Qmail-Scanner specifically not calling AV
>on files greater than some size does have some merit. I'll think about
>it. I am worried that people would make that number too low. e.g.
>Everyone has DSL+ these days: what's to stop a virus writer just
>generating 20M viruses - so as to get around AVs that have limits of
>10M? I'm already getting spam that's >1M in size (which bypasses our
>SpamAssassin setup)
yeah, it's always possible the scumbags\\\\\\viruswriters could just
up the arms race. as fat pipes become ever more the norm, it's probably likely.
>It's strange: clamd.conf refers to ArchiveMaxFileSize as a way of
>limiting what max archive file size it will scan - but I see no
>"MaxFileSize" option - to stop it scanning 300M TIFF files for example.
>I can't see why it has one option and not the other.
same here. but not being a programmer myself, i've no clue whether
there's some particular difficulty in implementing something like that.
Paul Theodoropoulos
http://www.anastrophe.com
http://www.smileglobal.com
http://www.forumgarden.com
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.