Mysterious MailScanner hangs

[Michael Janssen]

On Fri, 11 Jul 2003, Eric McClelland wrote:

> Hi All,
>
> I have a sporadic problem where MailScanner mysteriously stops picking
> up inbound MTA spool files.  A 'service MailScanner restart' temporarily
> clears the problem for the most part (inbound MTA queue, normally 0-10,
> still hovers between 30-95 afterwards).  When the problem occurs, there
> is invariably one MailScanner process taking >90% of the CPU (load
> usually 1-3), and the problem persists until I intervene (i.e.
> MailScanner does not kill and restart itself periodically as it normally
> does).  I've poked around the MTA and MailScanner queues, but noticed
> nothing amiss with any of the messages (except that some appear never to
> get processed), nor do any log entries provide a clue.

[I work with exim but nevertheless]

In which state the MS-process hangs? E.G. the last logline *for this pid*
might be "Virus and Content Scanning: Starting". This *might* indicate a
problem while scanning (but there is a default 300sec timeout for the
scanner). Is there a scanner process? More likly its indicate a problem
with MS-postfix (especially with "Deliver in Background = no" or "Delivery
Method" on some values).

The really good thing is, that you can inspect the hanging MS-process with
"strace": "strace -p [process-pid]" will plug into the running proces and
shows all the system calls it does. On our system this is often
"wait4([pid of a exim-process], " for hanged or delayed MS-processes.
"wait4" means the process is (possibly innocently) waiting for another
process to complete. This information can also be seen via some output
formats of "ps" providing the waitchannel abbrv "WCHAN":
ps -C MailScanner o pid,wchan # with GNU-ps

Note that "strace" can damage running processes in rare cases - you will
need to check after stracing that the process has survived.


As already said, I work with exim but last logline and strace should give
some important informations to solve this problem.

Michael