[EMAIL PROTECTED] wrote:
> At 06:02 AM 2/2/2006, you wrote:
>> Have you tried increasing your softlimit value?
>>
>> http://qmail-scanner.sourceforge.net/FAQ.php
>> (See Resource Issues)
>>
>> Blaine
>
> my softlimit's at 200MB.
That will be your problem then. Don't forget - just because a message is
90M doesn't mean clamd needs 90M of RAM. It's all up to what kind of
file it is scanning (e.g. zip archive), what the config details are,
etc. BTW - you made no mention of the details about the message in
question. Is it a zip attachment that causes the problem or what?

So as you say clamd grows to 190M, I'm going to guess what is actually
happening is that it's wanting to grow to +200M - but softlimit is
stopping it, and it gets into a bad state. You have ExitonOOM set - is
that triggering?

Increase softlimit to 300000000 and see if that fixes your problem. If
you don't like the idea of such large memory usage, then the question
should be asked as to why you don't limit/stop such large messages being
accepted by your Qmail system (i.e. /var/qmail/control/databytes)

I must say that the option of Qmail-Scanner specifically not calling AV
on files greater than some size does have some merit. I'll think about
it. I am worried that people would make that number too low. e.g.
Everyone has DSL+ these days: what's to stop a virus writer just
generating 20M viruses - so as to get around AVs that have limits of
10M? I'm already getting spam that's >1M in size (which bypasses our
SpamAssassin setup)

It's strange: clamd.conf refers to ArchiveMaxFileSize as a way of
limiting what max archive file size it will scan - but I see no
"MaxFileSize" option - to stop it scanning 300M TIFF files for example.
I can't see why it has one option and not the other.

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Qmail-scanner-general mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general

Reply via email to