Mailing List ecs-isp@2rosenthals.com Archived Message #623

Fra: "Massimo S." <ecs-isp@2rosenthals.com> Full Headers
Undecoded message
Emne: Re: [eCS-ISP] clamscan issue
Dato: Sat, 2 Dec 2023 10:20:41 +0100
Til: eCS ISP Mailing List <ecs-isp@2rosenthals.com>



Il 01/12/2023 20:17, Steven Levine ha scritto:
In <list-8580612@2rosenthals.com>, on 11/26/23
    at 10:16 PM, "Massimo S." <ecs-isp@2rosenthals.com> said:

Hi Massimo,

it seems that clamscan have some difficulties scanning dirs with a lot of
files inside:

you can see some of these:   cli_realloc(): Can't re-allocate memory to
25952256 bytes. and these:

Unfortunately, I don't have any sure fire solutions to prevent clamscan
from running out of memory.  We already know it is very memory intensive
and close to the limits of what OS/2 is capable of.

Increasing VIRTUALADDRESSLIMIT might help.  Another option is to shutdown
non-essential applications while clamscan is running.

on the 2nd MTA i've VAL to 3072 and clamscan don't give issues
but it's true also that it scan only 7 mail domains

(both on MTA1 and MTA2 servers clamscan scans only 1 mail domain then it exit,
there is a sleep of 2 seconds and after a new clamscan start for the
next mail domain etc. etc.)

anyway MTA1 is the one that has more load and more domains

Another is to do multiple clamscan runs where each run checks a subset of
your directories ir files.  The --exclude-dir=REGEX and --file-list=FILE
options may help you configure this kind of setup.

i already have some exclusions e.g. for msglist.dat, domain.tni, etc.
X:/weasel/MailRoot/mydomain.com/info/O9GTJ5.MSG: Can't read file ERROR (i
don't understand "can't read file error, since the file is there on the
f.sys and it can be read)

You are mixing apples and oranges, as we say.

When clamscan runs out of memory, it may fail in any number of different
ways.  Inability open files is one possible failure.

When clamscan runs out of memory it may or may not make the system
unstable.  If it doesn't, the rest of the system will continue to operate
normally.

Steven

in my experience VAL 3072 gives issues in some setups
is there another suggested value?
(more than 2560 and before 3072)

thanks

massimo

Abboner: Feed, Digest, Index.
Stopp abbonement
E-post til ListMaster