From: Kevin (kkadowgmail.com)
Date: Mon Nov 01 2004 - 22:36:10 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Mon, 1 Nov 2004 22:47:52 -0500, Adam <suckmy-balls.com> wrote:
>Uh, read the part of my mail you snipped out. I explicitly said it
>doesn't hang, only crashes, and much less often than vexira. It was
>good enough that I put up with running it supervised, but not stable.
>Stable means you don't have to have anything watching it in case it
>crashes.

I can't argue with this. AV software, from any vendor, on any
platform, is not known for stability.

If you are no longer using ClamAV, are you free to talk about what you
have to replace it?

On Mon, 1 Nov 2004 22:56:46 -0500, Adam <suckmy-balls.com> wrote:
> On Mon, Nov 01, 2004 at 09:22:30PM -0600, Kevin wrote:
> > On Tue, 02 Nov 2004 10:53:32 +0800, Lars Hansson <larsunet.net.ph> wrote:
> > > Adam wrote:
> > > > This would definately lead me to believe you don't know what high volume
> > > > mail is. ClamAV is also not stable on OpenBSD under heavy mail loads,
> >
> > Please tell us what you mean by "high volume" mail. 20K? 200K? 2M?
>
> Per what? I don't know what it did per day, probably not too much. It
> was 20k per hour during peak times though.

I seldom see peaks like this on my personal server, however I have the
clam filter as the second stage behind a rate-limited anti-spam smtpd
listener, which cuts down on the spikes in concurrent mail processing.

> And every couple of days
> it would segfault, always during peak hours like first thing in the
> morning when everyone was replying to all their mail.
>
> > What are you using to interface SMTP to clamd? milter?
>
> Milter.
>
> > > Maybe you define heavy differently but I've put 20k+ mails/day
> > > thru clamd for more than a year and it has not once caused any problems.
> > > Of course, I run it supervised so it might have crashed now and then
> > > but it has not *ever* hung.
> >
> > Same experience here.
> > I run 'clamd' supervised and systrace'd, and while clamd consumes
> > quite a bit of memory, I have yet to see it hang. Usually 'clamd'
> > runs until I upgrade ClamAV (the engine, not the signatures, freshclam
> > gets those once a day)
>
> Clamd itself, and the milter would both occasionally crash. I am not
> the only person to have seen this, in fact if you search the archives,
> you should find a patch someone worked on to clean up some of the mess
> in the clamav code to make it more stable. It may or may not have been
> fixed since I last used it however, as they did seem to release new
> version fairly often. Last I used was 0.74, and all the 0.7x versions
> had this problem, much worse in the earlier versions.

For what it's worth, these same sort of problems (and worse) occur
with commercial AV products. I've seen TrendMicro hang, or fail in
unusual ways, usually at around 50K messages/hour.

Kevin

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]