From: "Massimo S." <ecs-isp@2rosenthals.com>
Reply-To: ml@ecomstation.it
Subject: Re: [eCS-ISP] clamscan issue
To: eCS ISP Mailing List <ecs-isp@2rosenthals.com>
References: <list-8650624@2rosenthals.com>
Organization: eComStation dot it
Message-ID: <19cff600-013f-5abd-4a4f-c13a8721835d@ecomstation.it>
Date: Sat, 2 Dec 2023 10:20:41 +0100
User-Agent: Mozilla/5.0 (OS/2; U; Warp 4.5; it-IT; rv:1.7.13) Gecko/20060424
 Thunderbird/1.0.8 Mnenhy/0.7.4.0
MIME-Version: 1.0
In-Reply-To: <list-8650624@2rosenthals.com>
Content-Type: text/plain; charset=iso-8859-15; format=flowed
Content-Language: it-IT
Content-Transfer-Encoding: 7bit



Il 01/12/2023 20:17, Steven Levine ha scritto:
> In <list-8580612@2rosenthals.com>, on 11/26/23
>     at 10:16 PM, "Massimo S." <ecs-isp@2rosenthals.com> said:
> 
> Hi Massimo,
> 
>> it seems that clamscan have some difficulties scanning dirs with a lot of
>> files inside:
> 
>> you can see some of these:   cli_realloc(): Can't re-allocate memory to
>> 25952256 bytes. and these:
> 
> Unfortunately, I don't have any sure fire solutions to prevent clamscan
> from running out of memory.  We already know it is very memory intensive
> and close to the limits of what OS/2 is capable of.
> 
> Increasing VIRTUALADDRESSLIMIT might help.  Another option is to shutdown
> non-essential applications while clamscan is running.

on the 2nd MTA i've VAL to 3072 and clamscan don't give issues
but it's true also that it scan only 7 mail domains

(both on MTA1 and MTA2 servers clamscan scans only 1 mail domain then it exit,
there is a sleep of 2 seconds and after a new clamscan start for the
next mail domain etc. etc.)

anyway MTA1 is the one that has more load and more domains

> Another is to do multiple clamscan runs where each run checks a subset of
> your directories ir files.  The --exclude-dir=REGEX and --file-list=FILE
> options may help you configure this kind of setup.

i already have some exclusions e.g. for msglist.dat, domain.tni, etc.
>> X:/weasel/MailRoot/mydomain.com/info/O9GTJ5.MSG: Can't read file ERROR (i
>> don't understand "can't read file error, since the file is there on the
>> f.sys and it can be read)
> 
> You are mixing apples and oranges, as we say.
> 
> When clamscan runs out of memory, it may fail in any number of different
> ways.  Inability open files is one possible failure.
> 
> When clamscan runs out of memory it may or may not make the system
> unstable.  If it doesn't, the rest of the system will continue to operate
> normally.
> 
> Steven

in my experience VAL 3072 gives issues in some setups
is there another suggested value?
(more than 2560 and before 3072)

thanks

massimo