Goner-A problems - false alarm

Nick Phillips nwp at LEMON-COMPUTING.COM
Fri Dec 7 18:23:52 GMT 2001


On Fri, Dec 07, 2001 at 04:45:47PM -0000, brandon pearson (BITS) wrote:
> Our mailhub with mailscanner 2.42/sophos appears to have let some goner
> viruses through.

> Dec  5 11:32:24 mhub2.bbsrc.ac.uk mailscanner[22339]: Failed to lock
> /exim/exim_incoming/input/16BaF0-0003aY-04-D: Resource temporarily
> unavailable
>
> We get a lot of these errors and I have read on this list that they can be
> ignored. The mail hub was busy at the time and mailscanner was running flat
> out processing 100 mails at a time.
>
> Any ideas?

You're still running exim over the incoming queue, probably from a cronjob.

You should probably have a look at the updated version of the installation
instructions for exim -- we've found a better way of preventing delivery
now than would have been listed when 2.4x versions of mailscanner were
current.

You should probably also have a look in /etc/crontab, /etc/cron.d/exim, and
any other cron bits you may have lying around (are you running Debian by
any chance)...

...if you're running Debian, you will find that even if you have exim set up
to run the queue as a daemon, it will *also* be started from cron at 8 and
38 minutes past the hour.

Which I noticed the other day after a client who doesn't use mailscanner
started sending goner-a out. There were about 700 messages in the queue,
so I did /etc/init.d/exim stop immediately. By the time I got on site, all
but about 100 messages had gone thanks to the f***ing cron job.

Oops.

Anyway, I'd recommend updating the default exim config to be a bit firmer
about refusing to deliver, as contained in the new updated and altogether
more wonderful Exim instructions of the mailscanner web site.


Cheers,


Nick

P.S. You will find that most messages most of the time have been getting
scanned, as chances are that mailscanner gets there first. But every 30
minutes, anything in the queue will have been getting chucked straight
out by the flipping cronjob. Assuming I've guessed your situation correctly.
--
Nick Phillips -- nwp at lemon-computing.com
You will be surprised by a loud noise.



More information about the MailScanner mailing list