<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";
color:black;}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
pre
{margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.EmailStyle17
{mso-style-type:personal;
font-family:Arial;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=white lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Hi,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Thanks for all the fast responses, a bit of further
testing using clamscan at the command line on very small files takes a very
long time and we will look at changing either to clamd or the clamavmodule. Is
it possible to use the clamavmodule without installing new packages other than
the vendors distributions / new versions the reason I ask is that we manage all
software packages centrally with a strict policy on what’s installed. I
guess that I would need to modify the virus.scanners.conf and create a wrapper as
the path for clamavmodule is currently /bin/conf whilst all others are paths to
the av wrapper file or does the clamavmodule when defined in the main config
get called in a different way.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Thanks again<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Al<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
color=black face="Times New Roman"><span style='font-size:12.0pt;color:windowtext'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 color=black face=Tahoma><span
style='font-size:10.0pt;font-family:Tahoma;color:windowtext;font-weight:bold'>From:</span></font></b><font
size=2 color=black face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma;
color:windowtext'> mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] <b><span style='font-weight:
bold'>On Behalf Of </span></b>Julian Field<br>
<b><span style='font-weight:bold'>Sent:</span></b> 26 June 2007 10:00<br>
<b><span style='font-weight:bold'>To:</span></b> MailScanner discussion<br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: Mailscanner message
delays / load issue</span></font><font color=black><span style='color:windowtext'><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt'>My best advice would be to upgrade to 4.61.3 and use
the direct clamd support. If you don't want to upgrade then use clamavmodule.
Download my clam+SA package and install it, just tell it not to install ClamAV
when it asks you. This will install the support for clamavmodule.<br>
<br>
The current version of Clam is *very* slow at starting up, while it loads the
virus database.<br>
<br>
Alistair Carmichael wrote: <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN-GB
style='font-size:10.0pt;font-family:Arial'>Hi,<u1:p></u1:p></span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN-GB
style='font-size:10.0pt;font-family:Arial'><u1:p> </u1:p></span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN-GB
style='font-size:10.0pt;font-family:Arial'>Over the past few months we have
noticed a steady increase in the load on our 2 mail scanner servers and in the
last few days messages have been substantially delayed between being collected
from the inbound mailqueue to the outbound mailqueue. We are running
mailscanner version mailscanner-4.53.8-1 on centos running linux kernel
2.6.9-55 and using sendmail 8.13 as the MTA and clamav as the anti-virus
software and spamassassin as the anti spam software.<u1:p></u1:p></span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN-GB
style='font-size:10.0pt;font-family:Arial'>We receive approximately 30,000
messages each day which are handled by a cluster of 2 servers via DNS round
robin, the load on both machines is steadily at about 5,5,5 with clamscan
processes constantly being at the top of the process list in terms of cpu
usage. We are also seeing log entries similar to this constantly appearing in
the maillog.<u1:p></u1:p></span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN-GB
style='font-size:10.0pt;font-family:Arial'>MailScanner[31171]: Commercial
scanner clamav timed out!<u1:p></u1:p></span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN-GB
style='font-size:10.0pt;font-family:Arial'>MailScanner[31171]: Virus Scanning:
Denial Of Service attack is in message l5Q7bntD008994<u1:p></u1:p></span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN-GB
style='font-size:10.0pt;font-family:Arial'>Both servers are high powered
machines only running the mailscanner software (xeon 2.8 cpu and 2gb ram in
each machine)<u1:p></u1:p></span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN-GB
style='font-size:10.0pt;font-family:Arial'>Is there a reason that the load
would be so high as there’s not a huge quantity of email going through
the servers for what I would expect them to handle, or if there are any
configuration tuning that can be done in mailscanner to resolve this
(we’ve fine tuned the time out settings in sendmail to minimise message
delays but this hasn’t lowered the load or message delivery time)<u1:p></u1:p></span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN-GB
style='font-size:10.0pt;font-family:Arial'><u1:p> </u1:p></span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN-GB
style='font-size:10.0pt;font-family:Arial'>Thanks for any help<u1:p></u1:p></span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN-GB
style='font-size:10.0pt;font-family:Arial'>Al<u1:p></u1:p></span></font><o:p></o:p></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial'><u1:p> </u1:p></span></font><o:p></o:p></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt'><br>
This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed. If
you have received this email in error please notify the system manager. This
message contains confidential information and is intended only for the
individual named. If you are not the named addressee you should not
disseminate, distribute or copy this e-mail.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt'><br>
<br>
<o:p></o:p></span></font></p>
<pre><font size=2 color=black face="Courier New"><span style='font-size:10.0pt'>Jules<o:p></o:p></span></font></pre><pre><font
size=2 color=black face="Courier New"><span style='font-size:10.0pt'><o:p> </o:p></span></font></pre><pre><font
size=2 color=black face="Courier New"><span style='font-size:10.0pt'>-- <o:p></o:p></span></font></pre><pre><font
size=2 color=black face="Courier New"><span style='font-size:10.0pt'>Julian Field MEng CITP<o:p></o:p></span></font></pre><pre><font
size=2 color=black face="Courier New"><span style='font-size:10.0pt'><a
href="http://www.MailScanner.info">www.MailScanner.info</a><o:p></o:p></span></font></pre><pre><font
size=2 color=black face="Courier New"><span style='font-size:10.0pt'>Buy the MailScanner book at <a
href="http://www.MailScanner.info/store">www.MailScanner.info/store</a><o:p></o:p></span></font></pre><pre><font
size=2 color=black face="Courier New"><span style='font-size:10.0pt'><o:p> </o:p></span></font></pre><pre><font
size=2 color=black face="Courier New"><span style='font-size:10.0pt'>MailScanner customisation, or any advanced system administration help?<o:p></o:p></span></font></pre><pre><font
size=2 color=black face="Courier New"><span style='font-size:10.0pt'>Contact me at <a
href="mailto:Jules@Jules.FM">Jules@Jules.FM</a><o:p></o:p></span></font></pre><pre><font
size=2 color=black face="Courier New"><span style='font-size:10.0pt'><o:p> </o:p></span></font></pre><pre><font
size=2 color=black face="Courier New"><span style='font-size:10.0pt'>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654<o:p></o:p></span></font></pre><pre><font
size=2 color=black face="Courier New"><span style='font-size:10.0pt'>For all your IT requirements visit <a
href="http://www.transtec.co.uk">www.transtec.co.uk</a><o:p></o:p></span></font></pre>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt'><br>
This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed. If
you have received this email in error please notify the system manager. This
message contains confidential information and is intended only for the
individual named. If you are not the named addressee you should not
disseminate, distribute or copy this e-mail.<o:p></o:p></span></font></p>
</div>
<br>This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail.</body>
</html>