Clamav replacement for FreeBSD+postfix?

[Francisco Reyes]

Oliver Brandmueller writes:

> We're using clamav (clamd, together with exim) in our setup. Our setup 
> consisting of currently four servers assigned to this task is processing 
> around one million deliveries per day, around 3.5 million rejects in the 

:-)
You get less spam than we do.
We also get around 4 Million emails per day, but only about 500K are 
accepted. (last I checked.. may be more volume now)


> clamd processes, but for several months this setup is quite stable now. 

I had one machine that had been stable for months. Yesterday it just simply 
stopped working. Upgraded to the latest clamav. Even worse. Copied another 
version (older) from another machine. Working again.

> We're using FreeBSD 6, amd64. Servers have 4 GB of RAM, we needed to 

We are using FreeBSD 6 i386.
Do you see better perfomance on the amd64 branch for this type of work?

> tune a bit in the config files of clamd so that it's leveld fine with 
> our load.

Hm.. that config file is not that big. What variables did you set that were 
helpfull? In particular no matter what I do I never see more than 4 threads 
running.

>  Also we use it successfully with libthr instead of libpthred 
> (through libmap.conf).

What was the procedure for that? Any pointers to docs appreciated.
I am looking at /etc/libmap.conf, is it just an entry there?
Wouldn't that be global? So all programs in the machine will use libthr 
instead of libpthred?

> At least for a recent 6-STABLE, recent clamav and the given configs I 
> cannot agree with you on missing stability.

Only thing I have not tried is amd64 and libthr.

However I am wondering if a process based virus scanner exists.
Going over ports I see a handfull of virus scanners. I guess I will have to 
setup a test machine and try them.

I suspsect the issue is FreeBSD's thread support, so your suggested thread 
library  change may help until we find a process based antivirus (if there 
is one that works well with FreeBSD).