Server Crash

Mon Mar 25 13:48:07 GMT 2002

Bit more info.

Ive taken the message and put on a different box with a fresh copy of mailscanner and can duplicate the problem.

I started in debug mode but it did not output any messages, looking at px it spend ages doing a cat 

"/bin/cat /var/spool/MailScanner/incomming/g2LC0jG18107.header /var/spool/mqueue.in/dfg2LC0jG18107"

Eventually this process becomes defunct.

Looking in /var/spool/MailScanner/incomming/g2LC0jG18107, hundreds of messages are created with filenames like msg-20434-1000.txt, each file contains the following text

The attached message could not be delivered due to the transmission error shown in the transcript below.

>220 cobalt100.fm.netbenefit.co.uk ESMTP Sendmail 8.10.2/8.10.2; Thu, 21 Mar 2002 11:39:50 GMT
EHLO helpdesq.co.uk
>250-cobalt100.fm.netbenefit.co.uk Hello host213-122-57-5.in-addr.btopenworld.com [213.122.57.5], pleased to meet you
>250-ENHANCEDSTATUSCODES
>250-8BITMIME
>250-SIZE 10485760
>250-DSN
>250-ONEX
>250-ETRN
>250-XUSR
>250-AUTH PLAIN
>250 HELP
MAIL FROM:<lloyd at helpdesq.co.uk>
>250 2.1.0 <lloyd at helpdesq.co.uk>... Sender ok
RCPT TO:<clareandlloyd at freenet.co.uk>
>550 5.7.1 <clareandlloyd at freenet.co.uk>... Relaying denied.  Please check your mail first.

I guess MailScanner has separated the attachments from the message and is creating the files to scan, so is doing everything it should, however due to the volume of attachments it falls over.

Paul

>>> paul_houselander at BRISTOL-CITY.GOV.UK 03/25 10:56 am >>>
I think the SSL/PAM stuff was as a result of the mailscanner problem

Ive got it running ok now, the first message in the /var/spool/mqueue.in was a bit strange, seemed that every 3 seconds it attempted to send a mail but got a relaying denied message (this was because pop before smtp was on), not sure why it was trying to do it every 3 seconds?

Anyway the resulting message was just over 1mb in size filled with the below errors

>250 HELP
MAIL FROM:<lloyd at helpdesq.co.uk>
>250 2.1.0 <lloyd at helpdesq.co.uk>... Sender ok
RCPT TO:<clareandlloyd at freenet.co.uk>
>550 5.7.1 <clareandlloyd at freenet.co.uk>... Relaying denied.  Please check your mail first.   

Seems consistent, as soon as I moved this message manually, mailscanner was fine.

Any ideals, I dont think this is likely to happen to often, but once is enough.

Paul

>>> brose at MED.WAYNE.EDU 03/22/02 19:17 PM >>>
It looks likes it's really between your ssl libcrypt library and PAM.
Is you pam db ok?

-----Original Message-----
From: Paul Houselander [mailto:paul_houselander at BRISTOL-CITY.GOV.UK] 
Sent: Friday, March 22, 2002 12:47 PM
To: MAILSCANNER at JISCMAIL.AC.UK 
Subject: Server Crash

I am running MailScanner on a cobalt box.

Has been running happily for over a week, yesterday the machine fell
over, and does so everytime I now start up mailscanner, their are
messages (75) in mqueue.in, 

I had signature/spam/custom headers defined in mailscanner.conf so have
defaulted back to the original installation, however everytime I start
mailscanner, after approx 3-4 mins the machine complains of being out of
memory and falls over.

Its a remote machine so takes a bit of time to get someone to go and
power cycle it.

When is back up im going to move the messages in mqueue.in into mqueue
and see how sendmail copes with them, in the meantime can anyone offer
any potential explanations? seems to have got itself into a loop but Im
not sure what action ive taken that has caused it. Extract of maillog
below.

Paul

Mar 21 16:01:02 cobalt100 mailscanner[2368]: MailScanner E-Mail Virus
Scanner version 3.12 starting. 
Mar 21 16:01:02 cobalt100 mailscanner[2368]: Configuring mailscanner for
sendmail... 
Mar 21 16:01:02 cobalt100 mailscanner[2371]: Startup: found 76 messages
waiting 
Mar 21 16:01:03 cobalt100 mailscanner[2371]: Forwarding 1 clean
messages, 1070 bytes 
Mar 21 16:01:03 cobalt100 mailscanner[2371]: Scanning 75 messages,
8624865 bytes 
Mar 21 16:01:05 cobalt100 sendmail[2447]: g2LFctm00950:
to=<liz.bishop at armida.co.uk>, delay=00:22:10, xdelay=00:00:00,
mailer=local, pri=120508, dsn=2.0.0, stat=Sent Mar 21 16:01:30 cobalt100
sendmail[2473]: g2LG1Tn02473: from=<tkimber at cityflyer.co.uk>, size=3912,
class=0, nrcpts=1, msgid=<sc99f426.096 at CFE_4.cityflyer.co.uk>,
proto=ESMTP, daemon=MTA, relay=anchor-post-33.mail.demon.net
[194.217.242.91] Mar 21 16:01:31 cobalt100 sendmail[2474]: g2LG1Tn02473:
to=<tracey.kimber at armida.co.uk>, delay=00:00:01, xdelay=00:00:01,
mailer=local, pri=32328, dsn=2.0.0, stat=Sent Mar 21 16:01:44 cobalt100
in.qpopper[2496]: (v?) POP login by user "admin" at (213.1.134.11)
213.1.134.11 Mar 21 16:01:44 cobalt100 in.qpopper[2495]: (v?) POP login
by user "4front1654" at (213.1.134.11) 213.1.134.11 Mar 21 16:01:53
cobalt100 sendmail[2500]: g2LG1qn02500:
from=<lawzonewire at lawzone.co.uk>, size=12187, class=0, nrcpts=1,
msgid=<200203211601.g2LG1qn02500 at cobalt100.fm.netbenefit.co.uk>,
proto=SMTP, daemon=MTA, relay=kryten.sift.co.uk [194.131.210.136] Mar 21
16:01:53 cobalt100 sendmail[2499]: g2LG1qn02499:
from=<lawzonewire at lawzone.co.uk>, size=12182, class=0, nrcpts=1,
msgid=<200203211601.g2LG1qn02499 at cobalt100.fm.netbenefit.co.uk>,
proto=SMTP, daemon=MTA, relay=kryten.sift.co.k [194.131.210.136] Mar 21
16:01:56 cobalt100 sendmail[2502]: g2LG1qn02500:
to=<tania.freezer at mithras-hr.co.uk>, delay=00:00:03, xdelay=00:00:01,
mailer=local, pri=41564, dsn=2.0.0, stat=Sent Mar 21 16:01:56 cobalt100
sendmail[2501]: g2LG1qn02499: to=<fiona.monson at armida.co.uk>,
delay=00:00:03, xdelay=00:00:01, mailer=local, pri=41564, dsn=2.0.0,
stat=Sent Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM unable to
dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:35 cobalt100
in.qpopper[2524]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill
pages: Cannot allocate memory] Mar 21 16:02:35 cobalt100
in.qpopper[2524]: PAM adding faulty module: /lib/security/pam_pwdb.so
Mar 21 16:02:45 cobalt100 in.qpopper[2524]: gtev4441 at 194.222.213.195
(194.222.213.195): -ERR [AUTH] PAM authentication failed for user
"gtev4441": Module is unknown (28) Mar 21 16:02:45 cobalt100
in.qpopper[2524]: [AUTH] Failed attempted login to gtev4441 from host
(194.222.213.195) 194.222.213.195 Mar 21 16:02:45 cobalt100
in.qpopper[2527]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21
16:02:45 cobalt100 in.qpopper[2527]: PAM [dlerror: libcrypt.so.1: cannot
map zero-fill pages: Cannot allocate memory] Mar 21 16:02:45 cobalt100
in.qpopper[2527]: PAM adding faulty module: /lib/security/pam_pwdb.so
Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM unable to
dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:45 cobalt100
in.qpopper[2529]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill
pages: Cannot allocate memory] Mar 21 16:02:45 cobalt100
in.qpopper[2529]: PAM adding faulty module: /lib/security/pam_pwdb.so
Mar 21 16:02:55 cobalt100 in.qpopper[2527]: 4front1654 at 213.1.134.11
(213.1.134.11): -ERR [AUTH] PAM authentication failed for user
"4front1654": Module is unknown (28) Mar 21 16:02:55 cobalt100
in.qpopper[2527]: [AUTH] Failed attempted login to 4front1654 from host
(213.1.134.11) 213.1.134.11 Mar 21 16:02:55 cobalt100 in.qpopper[2529]:
admin at 213.1.134.11 (213.1.134.11): -ERR [AUTH] PAM authentication
failed for user "admin": Module is unknown (28) Mar 21 16:02:55
cobalt100 in.qpopper[2529]: [AUTH] Failed attempted login to admin from
host (213.1.134.11) 213.1.134.11 Mar 21 16:03:10 cobalt100
sendmail[2548]: g2LG39n02548: SYSERR(root): Cannot open hash database
/etc/mail/popip.db: Cannot allocate memory Mar 21 16:03:10 cobalt100
sendmail[2533]: g2LG31n02533: SYSERR(root): SMTP-MAIL: died on signal 11
Mar 21 16:03:23 cobalt100 in.qpopper[2551]: I/O Error from  at
62.6.75.159 (62.6.75.159): [-1] 104 (Connection reset by peer); 0
(Success) Mar 21 16:03:23 cobalt100 in.qpopper[2551]: (null) at
62.6.75.159 (62.6.75.159): -ERR POP EOF or I/O Error: 104 (Connection
reset by peer); 0 (Success) Mar 21 16:03:26 cobalt100 sendmail[2552]:
g2LG3Qn02552: SYSERR(root): Cannot open hash database
/etc/mail/popip.db: Cannot allocate memory Mar 21 16:03:27 cobalt100
sendmail[2550]: g2LG3Jn02550: SYSERR(root): SMTP-MAIL: died on signal 11
Mar 21 16:04:34 cobalt100 sendmail[2583]: g2LG4Un02583: SYSERR(root):
Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar
21 16:05:17 cobalt100 sendmail[2583]: g2LG4Un02583: SYSERR(root): Cannot
open hash database /etc/mail/aliases.db: Cannot allocate memory Mar 21
16:59:45 cobalt100 sendmail[387]: alias database /etc/mail/aliases
rebuilt by root Mar 21 16:59:45 cobalt100 sendmail[387]:
/etc/mail/aliases: 26 aliases, longest 33 bytes, 473 bytes total