Clamav suggestions

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Arto wrote:
> Richard Frovarp wrote:
>> Fabio Pedretti wrote:
>>>
>>> 3) Support for clamd trough clamdscan is nice, however, best would 
>>> be to connect to clamd directly to its socket (or network socket) 
>>> from MailScanner, without call clamdscan, and fallback to clamscan 
>>> if clamd is not working. 
>>
>> Why not just run clamavmodule? From my understanding, the support for 
>> clamd was added so that those that didn't want to keep up with the 
>> Perl module required for clamavmodule would have something faster 
>> than clamscan. Any direct call to clamd from MailScanner would 
>> require a Perl module, so at that point you're losing the 
>> requirements benefit of running clamd.
>
> FYI, we have used all of those during last three weeks. First clamav 
> (indeed about two year before this period), then clamavmodule and 
> during this week clamd.
>
> Our MX server passes normally about 10k mails/day (MS, postgrey, 
> postfix and SA) and clamd is IMHO the most comfortable as regards 
> load, memory and swap. The server is a vmware client (CentOS4.4 ) with 
> 2 x 2,4 GHz and 775 Mb memory reserved to client. After start the swap 
> is with clamd under 40 Mb and it will remain there. With clamavmodule 
> and clamav the swap varies from 40 to 400 Mb and the load can be even 
> over 20 with clamav.
With 2 CPU's I would recommend 2Gb of RAM and not just 775Mb. With that 
little, it's bound to swap. And swapping in a VM is very slow. Either 
give your VM a lot more RAM or decrease Max Children by quite a bit.

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGPGoAEfZZRxQVtlQRArjuAJ0TLXKwPWs13OpgD7ZjNc2ZSiIqMACeIK9m
pR2Q7BOP/jy6kF/JJgDxpCY=
=Ypaq
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk