clamd 0.85.1 has been running pretty smoothly for a while, ever since
install the day after it was released. the last few days though, i've
been running into an odd problem -
first off, this is freebsd 5.2.1 release. dual PIII 1GHZ server,
895MB ram. the server does *only* spam and virus scanning. mail comes
in to MX servers, then goes to the AS/AV server via artificial
smtproute. all servers running qmail. clam and spamassassin called
via qmail-scanner. clamd built with gcc 4.0.0/binutils 2.16.
typically, over the course of a few days, my clamd process will grow
in size to be pretty large - 300 to 400MB in size. not a problem,
there's still adequate free ram for normal processing without
swapping/paging to any significant degree.
the last four or five days though, the server will be humming along,
then it will get hit with a load of inbound junk - mostly collateral
spam (is that the term? huge volume of bounce messages coming from
other servers that have been hit with joe-job attacks using fake
return addresses at one of my domains). after a short while under
this load, clamd will seem to 'throttle' - it'll still be running,
but the overall server load average will drop down to very low levels
for the anticipated volume, and messages start trickling through,
rather than flying through like normal. usually a restart of clamd
does the trick, although yesterday even that didn't seem to do the
trick - after restart of clamd the message woudl still trickle, so i
rebooted the server, and everything returned to normal...
anybody else experience this? thoughts?
Paul Theodoropoulos
http://www.anastrophe.com
http://www.smileglobal.com
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
