[EMAIL PROTECTED] wrote: > At 06:02 AM 2/2/2006, you wrote: >> Have you tried increasing your softlimit value? >> >> http://qmail-scanner.sourceforge.net/FAQ.php >> (See Resource Issues) >> >> Blaine > > my softlimit's at 200MB. That will be your problem then. Don't forget - just because a message is 90M doesn't mean clamd needs 90M of RAM. It's all up to what kind of file it is scanning (e.g. zip archive), what the config details are, etc. BTW - you made no mention of the details about the message in question. Is it a zip attachment that causes the problem or what?
So as you say clamd grows to 190M, I'm going to guess what is actually happening is that it's wanting to grow to +200M - but softlimit is stopping it, and it gets into a bad state. You have ExitonOOM set - is that triggering? Increase softlimit to 300000000 and see if that fixes your problem. If you don't like the idea of such large memory usage, then the question should be asked as to why you don't limit/stop such large messages being accepted by your Qmail system (i.e. /var/qmail/control/databytes) I must say that the option of Qmail-Scanner specifically not calling AV on files greater than some size does have some merit. I'll think about it. I am worried that people would make that number too low. e.g. Everyone has DSL+ these days: what's to stop a virus writer just generating 20M viruses - so as to get around AVs that have limits of 10M? I'm already getting spam that's >1M in size (which bypasses our SpamAssassin setup) It's strange: clamd.conf refers to ArchiveMaxFileSize as a way of limiting what max archive file size it will scan - but I see no "MaxFileSize" option - to stop it scanning 300M TIFF files for example. I can't see why it has one option and not the other. -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642 _______________________________________________ Qmail-scanner-general mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
