I noticed that clamd.conf isn't read if I use clamscan, so I can't adjust clamd.conf parameters. Now I updated the clamav plugin from CVS and replaced that clamav line in config/plugins as follow:
clamav clamscan_path=/usr/local/bin/clamscan action=reject max_size=3048576 That seems to work for me, now messages larger than 3048576 bytes are not scanned by clamav and no hangs seems to happen. However, I noticed that if I send a big bogus file and a virus file (eicar_com.zip) attachments, those both gets delivered to the mailbox. Do you guys see this as a bug as the tiny eicar_com.zip didn't get scanned by clamav? Timo "Bob" <[EMAIL PROTECTED]> kirjoitti viestiss�:[EMAIL PROTECTED] > Guillaume Filion wrote: > >> Timo wrote: >> >>> Hi, >>> I'm using the latest stable release of Qpsmtpd (0.28, with a minor >>> tweak on the clamav plugin, --max-ratio=500) and there seems to be a >>> problem if Clamav (version 0.82) can't successfuly check a file. >>> I copied the following snippet from the log: >>> >>> 17000 running plugin clamav >>> 17000 clamav plugin: Running: /usr/local/bin/clamscan --stdout -i >>> --max-recursion=50 --max-ratio=500 --disable-summ$... >>> 17000 clamav plugin: clamscan results: LibClamAV Error: cli_malloc(): >>> Can't allocate memory (78 bytes). >>> malloc_problem: Cannot allocate memory >>> LibClamAV Error: cli_malloc(): Can't allocate memory (78 bytes). >>> malloc_problem: Cannot allocate memory >>> LibClamAV Error: messageAddStr: out of memory >>> 17000 clamav plugin: clamscan exited with signal: 11 >>> 17000 running plugin queue::qmail_2dqueue >>> tcpserver: end 17000 status 14 >>> >>> So the message gets delivered to the users mailbox correctly, but >>> Qpsmtpd doesn't reply that "250 Queued!..." to the sending server and >>> I guess the sending server thinks that there were problems sending >>> the mail and retries after a while (it seems to send the message >>> about 4 times a day). >>> >>> Have any of you guys seen such behavior? Would this have been solved >>> in CVS version? >> >> >> Yes, I had a similar problem a couple of days ago. >> >> One of my users sent a 10 MB file (the godaddy superbowl ad in MPG) to >> a list of his buddies, one of them bounced. Clamav was crashing when >> trying to scan the bounce, leaving the 10 MB temp file in /tmp, with >> qpsmtpd giving error "451 Queuing declined or disabled; try again >> later". Since it's a temporary error, the other server kept trying to >> send the bounce, with clamav crashing and leaving another 10 MB file >> in /tmp, again and again. It ended up filling my quota with identical >> 10 MB files and qpsmtpd started rejecting every message because there >> was not space left on the HD. Hopefuly, a rm /tmp solved the problem >> temporarely. >> >> You can see the effect as a huge black spike in my stats page: >> http://stats.logidac.com/qpsmtpd.shtml >> >> I tought that the solution would be to implement a file size limit for >> clamav (allready present in CVS), but your clamav seem to crash on a >> 78 bytes file, so the problem might be somewhere else... >> >> I know it's not very helpful, but at least you're not alone with this >> problem. >> >> Here's the log I was getting: >> ----- >> @40000000420c46600888324c 20459 running plugin clamav >> @40000000420c46621439bdf4 20459 clamav plugin: Running: >> /usr/local/bin/clamscan --stdout --mbox -i --max-recursion=50 >> --disable-summary /tmp/zYztfsDmTS 2>&1 >> @40000000420c466e1d17132c 20459 FATAL PLUGIN ERROR: Out of memory >> during "large" request for 67112960 bytes, total sbrk() is 38549504 >> bytes at ./plugins/cla$ >> @40000000420c466e1d173a3c >> @40000000420c466e1d1c2024 20459 running plugin queue::qmail_2dqueue >> @40000000420c466e1dbd9fe4 20459 FATAL PLUGIN ERROR: Out of memory >> during "large" request for 16781312 bytes, total sbrk() is 38549504 >> bytes at /usr/local/li$ >> @40000000420c466e1dbdc30c >> @40000000420c466e1ddcff24 20767 queue::qmail_2dqueue plugin: Queuing >> to /var/qmail/bin/qmail-queue >> @40000000420c466e1e626394 20459 451 Queuing declined or disabled; try >> again later >> ----- >> >> GFK's > > /etc/clamav/clamd.conf has these two that might relate-- > > StreamMaxLength > > ArchiveMaxFileSize > > What are the relevent params on config/plugins line for virus/clamav now? > > -Bob > >
