Topic: amavis & larger emails

[Hardijs]

I have a [bunch of] SME 5.6 with all the updates.


as a precaution I do have a clam+amavis ng on all of them (a good thing - each day they catch a bunch of those pesky worms)

It seems that there is a limit the email can have before it is "frosen" into
the problems directory.

the error in each log has the same description:
  Dec  4 17:41:54 sargs amavis[3251]: Unpacking message in /var/spool/amavis-ng/amavis-unpack-3fcf55bb-0cb3                            
Dec  4 17:41:54 sargs amavis[3251]: AMAVIS: Determined 00000000 to be type message/rfc822                                            
Dec  4 17:41:54 sargs amavis[3251]: Attempting to unpack 00000000 as MIME compliant message                                          
Dec  4 17:41:59 sargs amavis[3251]: AMAVIS::Extract::Mail: Unpacking takes too much space                                            
Dec  4 17:41:59 sargs amavis[3251]: AMAVIS: Error while unpacking 00000000 as message/rfc822                                          
Dec  4 17:41:59 sargs amavis[3251]: AMAVIS: Giving up                                                                                
Dec  4 17:41:59 sargs amavis[3251]: AMAVIS: Error while unpacking message                                                            
Dec  4 17:41:59 sargs amavis[3251]: AMAVIS::MTA::Qmail: Freezing message                                                              


/etc/amavis-ng/amavis.conf has:
                                                                                                                                   
;; Ignore MIME message extracting errors?                                                                                            
                                                                                                                                     
ignore errors = yes                                                                                                                  

;; What to do if such error occues?                                                                                                  
;; freeze      - default behaviour, message will be frozen                                                                            
;; drop+notify - drop message, notify sender                                                                                          
                                                                                                                                     
; error action = freeze                                                                                                              


where neither freese (the current default action) nor drop and notify will be good.

The system mostly concerned is an 1.7 athlon / 512 MB RAM /10 GB HD @46% full - in theory hardware is not the fault here.

I do not see where can something else been edited for larger "buffers"

P.S. I know that I have to educate my users  not to send large emails and use some storage place instead - more asier would be getting some quad processor system through accounting for mail server than make any of them change mind for more than a day.

[Nathan Price]

I too had an issue with this.  Both /etc/clamav.conf and /etc/amavis-ng/amavis.conf have settings for max archive size.  Increasing those may help with your problem.

Good luck.

-N

[Hardijs]

well ...

in /etc/clamav.conf

enabled (was comented)
# When activated, input stream (see STREAM command) will be saved to disk before                                        
# scanning - this allows scanning within archives.                                                                      
StreamSaveToDisk                                                                                                        

# Close the connection if this limit is exceeded.                                                                        
StreamMaxLength 100M  
(was 10)

# Thread (scanner - single task) will be stopped after this time (seconds).                                              
# Default is 180. Value of 0 disables the timeout. SECURITY HINT: Increase the                                          
# timeout instead of disabling it.                                                                                      
ThreadTimeout 600
(was 100 and commented)

saved and rebooted
does not work.

[Nathan Price]

I am not sure what vesions of clamav and amavis you are using but I have posted excerpts of the conf files that were applicable to my problem which seems very similar to yours.

-N


In /etc/clamav.conf....

##
## Archive support
##


# Comment this line to disable scanning of the archives.
ScanArchive

# Options below protect your system against Denial of Service attacks
# with archive bombs.

# Files in archives larger than this limit won't be scanned.
# Value of 0 disables the limit.
# WARNING: Due to the unrarlib im[security]




In /etc/amavis-ng/amavis.conf.....

;; Resource limits for unpacking each message

;; How many levels of unpacking do we do?
maxlevels = 20
;; How many files do we want to write?
maxfiles = 1000
;; How much diskspace do we want to consume?
maxspace = 30M
plementation, whole files (one by one) in RAR
#          archives are decompressed to the memory. That's why never disable
#          this limit (but you may increase it of course!)
ArchiveMaxFileSize 10M