mailscanner dying

[Julian Field]

At 16:48 24/01/2002, you wrote:
>Mailscanner slowed down again today
>
>/var/spool/mqueue.in had 60 messages and below is what was running.
>
>Is this normal?

You should have a perl process running MailScanner as well, though you
might have to "ps -fe | grep perl" to find it as sometimes the path can be
too long for "ps -fe" to show the actual word "mailscanner".


>root at www:/var/spool/mqueue.in]# ps -ef | grep mail
>root      7473     1  0 Jan23 ?        00:00:00 sendmail: accepting
>connections
>root      7476     1  0 Jan23 ?        00:00:00 /usr/sbin/sendmail -q15m
>root     29446 24734  0 11:38 ?        00:00:00 sendmail: ./g0OGc7a29439
>ecarsbb
>root     29762 29741  0 11:46 pts/2    00:00:00 tail -f /var/log/maillog
>root     29767  7476  0 11:47 ?        00:00:00 sendmail: ./g0MK0I503474
>databya
>root     29794 24548  0 11:48 pts/1    00:00:00 grep mail
>
>after about 5 min the /var/spool/mqueue.in immediately cleared?

In which case it is almost certainly slow DNS lookups causing the problem.
Try switching off the spam detection and see if things improve.

>On Thu, 2002-01-24 at 09:32, Darrin Powell wrote:
> > On Thu, 2002-01-24 at 04:08, Julian Field wrote:
> > > At 22:41 23/01/2002, you wrote:
> > > >I have been having problems with mailscanner right after I installed the
> > > >latest RPM mailscanner-3.03-1.i386.rpm. I also installed the latest
> > > >Sophos tar file sweep version
> > > >
> > > >sweep -v
> > > >
> > > >Product version           : 3.53
> > > >Engine version            : 2.6
> > > >User interface version    : 2.03.079
> > > >Platform                  : Linux/Intel
> > > >Released                  : 07 January 2002
> > > >Total viruses (with IDEs) : 71192
> > > >
> > > >Redhat 7.1 with all the updates
> > >
> > > What was printed in your logs before it died? Has MailScanner been
> putting
> > > anything in your logs? (If not, please read the Installation FAQ).
> >
> > Yes mailscanner is logging it starts like this
> >
> > Jan 20 05:03:05 www mailscanner[30942]: MailScanner E-Mail Virus Scanner
> > version 3.03 starting.
> > Jan 20 05:03:05 www mailscanner[30942]: Configuring mailscanner for
> > sendmail...
> > Jan 20 05:03:05 www mailscanner[3863]: Startup: found 1 messages waiting
> > Jan 20 05:03:05 www mailscanner[3863]: Forwarding 1 clean messages, 2262
> > bytes
> > Jan 20 05:03:05 www mailscanner[3863]: About to deliver 1 messages
> >
> > There is no actual indication that it dies in the logs. The mqueue.in
> > fills up and won't empty until I
> >
> > /etc/rc.d/init.d/mailscanner restart.
> >
> > One thing I will check if it happens again is if mailscanner is still
> > running.
> >
> > [root at www:/var/spool]# ps -ef | grep mail
> > root      7473     1  0 Jan23 ?        00:00:00 sendmail: accepting
> > connections
> > root      7476     1  0 Jan23 ?        00:00:00 /usr/sbin/sendmail -q15m
> >
> > Would I be correct if /usr/sbin/sendmail -q15m was not running that
> > mailscanner died?
> >
> >
> >
> >
> > >
> > > The "/" has nothing to do with Sophos.
> > >
> > > >The /var/spool/mqueue.in the last couple of mornings has been full and
> > > >it takes restarting mailscanner to clear them out. I also turned off
> > > >spam thinking this was the problem. I see below that Julian added "/" to
> > > >the main source to fix the problem with mail scanner dying. So maybe my
> > > >problem is not related, but this seemed the closest email to my problem.
> > > >I have modified my mailscanner.conf to Delivery Method = batch and to
> > > >not do spam everything else is defualt. One thing I did notice on
> > > >install is /usr/local/Sophos/bin was not in my path.
> > >
> > > Doesn't need to be. But the /usr/local/Sophos/bin/sophoswrapper
> script does
> > > need to point to your installation of Sophos, so take a look at the
> wrapper
> > > script and check that it does.
> > The /usr/local/Sophos/bin/sophoswrapper does point to the correct
> > installation.
> >
> >
> > PackageDir=/usr/local/Sophos
> > prog=sweep # `basename $0`
> >
> > SAV_IDE=$PackageDir/ide
> > LD_LIBRARY_PATH=$PackageDir/lib
> > export SAV_IDE
> > export LD_LIBRARY_PATH
> >
> > exec ${PackageDir}/bin/$prog "$@"
> >
> >
> >
> > >
> > > >  I don't remember
> > > >this error showing up on earlier installs and for the life of me I cant
> > > >get the path to stay. The root shell is korn. So I continued with the
> > > >install.Any help would be greatly appreciated. I also wanted to say good
> > > >job to Julian this has been a great security tool.
> > >
> > > Glad you like it!
> >
> > Thanks again for all your help.
> >
> >
> > > --
> > > Julian Field                Teaching Systems Manager
> > > jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
> > > Tel. 023 8059 2817          University of Southampton
> > >                              Southampton SO17 1BJ
> > --
> > Darrin Powell
> > System Administrator
> > LSSi, Corp.
> > (919) 466-6803
>--
>Darrin Powell
>System Administrator
>LSSi, Corp.
>(919) 466-6803

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ