MailScanner issue with postfix

Sun Jun 29 17:51:06 IST 2003

Have you set something odd at all in your Postfix configuration files?
 From what you report, there is no "hashing" going on at all in your queue
directories, they are totally flat which is something I didn't think
Postfix ever did. For example, I would expect to find message 4E0D35B818 to
be in one of
         /var/spool/postfix.in/deferred/4/4E0D35B818
         /var/spool/postfix.in/deferred/4/E/4E0D35B818
whereas yours doesn't have the "4" or the "E" directories at all.

Aha! Have just searched Postfix docs, and they mention this:

19980729-31
         Feature: hashed queues. Rewrote parts of the mail queue
         API.  Configuration parameters: "hash_queue_names" specifies
         what queue directories will be hashed (default: the defer
         log directory), "hash_queue_depth" specifies the number of
         subdirectories used for hashing (default 2).

Please can you set your Postfix to hash the incoming and deferred queues
with a hashing depth of 1 or 2.

The current MailScanner code doesn't support a hashing depth of 0, as I
didn't know it was possible. It also can't detect this state very easily,
as a lack of hashing directories could signify that no messages have
arrived yet as the hashing directories are only created when they are needed.

And if someone could add this to the FAQ-o-matic that would be really handy!

At 16:40 27/06/2003, you wrote:
>I've uploaded the postfix.pm file...
>
>No changes in /var/log/info :
>
>Jun 27 17:35:22 intranet postfix-script: starting the Postfix mail system
>Jun 27 17:35:22 intranet postfix/master[3470]: daemon started
>Jun 27 17:35:22 intranet postfix/qmgr[3472]: 4E0D35B818:
>from=<si01 at intranet.ville-pontoise.fr>, size=1961 (queue active)
>Jun 27 17:35:22 intranet postfix/qmgr[3472]: 4E0D35B818:
>to=<si01 at intranet.ville-pontoise.fr>, relay=none, delay=82754,
>status=deferred (deferred transport)
>Jun 27 17:35:22 intranet postfix/qmgr[3472]: 9BBD15B81E:
>from=<si01 at intranet.ville-pontoise.fr>, size=3143 (queue active)
>Jun 27 17:35:22 intranet postfix/qmgr[3472]: 9BBD15B81E: to=<smedeot at ville-
>pontoise.fr>, relay=none, delay=82516, status=deferred (deferred transport)
>Jun 27 17:35:54 intranet ipop3d[3477]: pop3 service init from 130.0.10.1
>Jun 27 17:35:54 intranet ipop3d[3477]: Login user=si01 host=si01.inf.ville-
>pontoise.fr [130.0.10.1] nmsgs=0/0
>Jun 27 17:35:54 intranet ipop3d[3477]: Logout user=si01 host=si01.inf.ville-
>pontoise.fr [130.0.10.1] nmsgs=0 ndele=0
>Jun 27 17:36:17 intranet postfix-script: starting the Postfix mail system
>Jun 27 17:36:17 intranet postfix/master[3504]: daemon started
>Jun 27 17:36:35 intranet MailScanner[3524]: MailScanner E-Mail Virus
>Scanner version 4.21-9 starting...
>Jun 27 17:36:35 intranet MailScanner[3524]: Using locktype = flock
>Jun 27 17:36:45 intranet MailScanner[3526]: MailScanner E-Mail Virus
>Scanner version 4.21-9 starting...
>Jun 27 17:36:45 intranet MailScanner[3526]: Using locktype = flock
>Jun 27 17:36:55 intranet MailScanner[3527]: MailScanner E-Mail Virus
>Scanner version 4.21-9 starting...
>Jun 27 17:36:55 intranet MailScanner[3527]: Using locktype = flock
>Jun 27 17:37:05 intranet MailScanner[3529]: MailScanner E-Mail Virus
>Scanner version 4.21-9 starting...
>Jun 27 17:37:05 intranet MailScanner[3529]: Using locktype = flock
>Jun 27 17:37:15 intranet MailScanner[3530]: MailScanner E-Mail Virus
>Scanner version 4.21-9 starting...
>Jun 27 17:37:15 intranet MailScanner[3530]: Using locktype = flock
>Jun 27 17:37:15 intranet postfix/smtpd[3531]: connect from si01.inf.ville-
>pontoise.fr[130.0.10.1]
>Jun 27 17:37:15 intranet postfix/smtpd[3531]: 40B635B814:
>client=si01.inf.ville-pontoise.fr[130.0.10.1]
>Jun 27 17:37:15 intranet postfix/cleanup[3532]: 40B635B814: message-
>id=<001801c33cc2$00e7d060$010a0082 at PCSI01>
>Jun 27 17:37:15 intranet postfix/smtpd[3531]: disconnect from
>si01.inf.ville-pontoise.fr[130.0.10.1]
>Jun 27 17:37:15 intranet postfix/qmgr[3472]: 40B635B814:
>from=<si01 at intranet.ville-pontoise.fr>, size=1446 (queue active)
>Jun 27 17:37:15 intranet postfix/qmgr[3472]: 40B635B814:
>to=<si01 at intranet.ville-pontoise.fr>, relay=none, delay=0, status=deferred
>(deferred transport)
>Jun 27 17:37:22 intranet postfix/smtpd[3531]: connect from
>localhost.localdomain[127.0.0.1]
>Jun 27 17:37:22 intranet postfix/smtpd[3531]: disconnect from
>localhost.localdomain[127.0.0.1]
>Jun 27 17:37:35 intranet postfix/smtpd[3531]: connect from si01.inf.ville-
>pontoise.fr[130.0.10.1]
>Jun 27 17:37:35 intranet postfix/smtpd[3531]: 933315B815:
>client=si01.inf.ville-pontoise.fr[130.0.10.1]
>Jun 27 17:37:35 intranet postfix/cleanup[3532]: 933315B815: message-
>id=<002201c33cc2$0d08d330$010a0082 at PCSI01>
>Jun 27 17:37:35 intranet postfix/smtpd[3531]: disconnect from
>si01.inf.ville-pontoise.fr[130.0.10.1]
>Jun 27 17:37:35 intranet postfix/qmgr[3472]: 933315B815:
>from=<si01 at intranet.ville-pontoise.fr>, size=1959 (queue active)
>Jun 27 17:37:35 intranet postfix/qmgr[3472]: 933315B815:
>to=<si01 at intranet.ville-pontoise.fr>, relay=none, delay=0, status=deferred
>(deferred transport)
>Jun 27 17:37:42 intranet ipop3d[3539]: pop3 service init from 130.0.10.1
>Jun 27 17:37:42 intranet ipop3d[3539]: Login user=si01 host=si01.inf.ville-
>pontoise.fr [130.0.10.1] nmsgs=0/0
>Jun 27 17:37:42 intranet ipop3d[3539]: Logout user=si01 host=si01.inf.ville-
>pontoise.fr [130.0.10.1] nmsgs=0 ndele=0
>Jun 27 17:37:43 intranet ipop3d[3540]: pop3 service init from 130.0.0.22
>Jun 27 17:37:45 intranet ipop3d[3540]: Login user=amy host=rh07.rh.ville-
>pontoise.fr [130.0.15.7] nmsgs=0/0
>Jun 27 17:37:47 intranet ipop3d[3540]: Logout user=amy host=rh07.rh.ville-
>pontoise.fr [130.0.15.7] nmsgs=0 ndele=0
>Jun 27 17:37:54 intranet ipop3d[3541]: pop3 service init from 130.0.10.1
>Jun 27 17:37:54 intranet ipop3d[3541]: Login user=si01 host=si01.inf.ville-
>pontoise.fr [130.0.10.1] nmsgs=0/0
>Jun 27 17:37:54 intranet ipop3d[3541]: Logout user=si01 host=si01.inf.ville-
>pontoise.fr [130.0.10.1] nmsgs=0 ndele=0
>Jun 27 17:38:22 intranet postfix/qmgr[3472]: 40B635B814:
>from=<si01 at intranet.ville-pontoise.fr>, size=1446 (queue active)
>Jun 27 17:38:22 intranet postfix/qmgr[3472]: 40B635B814:
>to=<si01 at intranet.ville-pontoise.fr>, relay=none, delay=67, status=deferred
>(deferred transport)
>Jun 27 17:38:30 intranet ipop3d[3545]: pop3 service init from 130.0.30.5
>Jun 27 17:38:32 intranet ipop3d[3545]: Login user=adupaquier
>host=elus.cm.ville-pontoise.fr [130.0.30.5] nmsgs=9/9
>Jun 27 17:38:35 intranet ipop3d[3545]: Logout user=adupaquier
>host=elus.cm.ville-pontoise.fr [130.0.30.5] nmsgs=0 ndele=9
>Jun 27 17:39:22 intranet postfix/qmgr[3472]: 933315B815:
>from=<si01 at intranet.ville-pontoise.fr>, size=1959 (queue active)
>Jun 27 17:39:22 intranet postfix/qmgr[3472]: 933315B815:
>to=<si01 at intranet.ville-pontoise.fr>, relay=none, delay=107,
>status=deferred (deferred transport)
>
>But something new /var/log/warnings
>
>Jun 27 17:40:00 intranet MailScanner[3529]: JKF: Reading 933315B815 from
>dir .
>Jun 27 17:40:00 intranet MailScanner[3527]: JKF: Reading . from dir .
>Jun 27 17:40:00 intranet MailScanner[3527]: JKF: Reading .. from dir .
>Jun 27 17:40:00 intranet MailScanner[3527]: JKF: Reading 4E0D35B818 from
>dir .
>Jun 27 17:40:00 intranet MailScanner[3527]: JKF: Reading 9BBD15B81E from
>dir .
>Jun 27 17:40:00 intranet MailScanner[3527]: JKF: Reading 40B635B814 from
>dir .
>Jun 27 17:40:00 intranet MailScanner[3527]: JKF: Reading 933315B815 from
>dir .
>Jun 27 17:40:00 intranet MailScanner[3526]: JKF: Reading . from dir .
>Jun 27 17:40:00 intranet MailScanner[3526]: JKF: Reading .. from dir .
>Jun 27 17:40:00 intranet MailScanner[3526]: JKF: Reading 4E0D35B818 from
>dir .
>Jun 27 17:40:00 intranet MailScanner[3526]: JKF: Reading 9BBD15B81E from
>dir .
>Jun 27 17:40:00 intranet MailScanner[3526]: JKF: Reading 40B635B814 from
>dir .
>Jun 27 17:40:00 intranet MailScanner[3526]: JKF: Reading 933315B815 from
>dir .
>Jun 27 17:40:00 intranet MailScanner[3524]: JKF: Reading . from dir .
>Jun 27 17:40:00 intranet MailScanner[3524]: JKF: Reading .. from dir .
>Jun 27 17:40:00 intranet MailScanner[3524]: JKF: Reading 4E0D35B818 from
>dir .
>Jun 27 17:40:00 intranet MailScanner[3524]: JKF: Reading 9BBD15B81E from
>dir .
>Jun 27 17:40:00 intranet MailScanner[3524]: JKF: Reading 40B635B814 from
>dir .
>Jun 27 17:40:00 intranet MailScanner[3524]: JKF: Reading 933315B815 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3530]: JKF: Reading . from dir .
>Jun 27 17:40:05 intranet MailScanner[3530]: JKF: Reading .. from dir .
>Jun 27 17:40:05 intranet MailScanner[3530]: JKF: Reading 4E0D35B818 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3530]: JKF: Reading 9BBD15B81E from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3530]: JKF: Reading 40B635B814 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3530]: JKF: Reading 933315B815 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3529]: JKF: Reading . from dir .
>Jun 27 17:40:05 intranet MailScanner[3529]: JKF: Reading .. from dir .
>Jun 27 17:40:05 intranet MailScanner[3529]: JKF: Reading 4E0D35B818 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3529]: JKF: Reading 9BBD15B81E from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3529]: JKF: Reading 40B635B814 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3529]: JKF: Reading 933315B815 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3527]: JKF: Reading . from dir .
>Jun 27 17:40:05 intranet MailScanner[3527]: JKF: Reading .. from dir .
>Jun 27 17:40:05 intranet MailScanner[3527]: JKF: Reading 4E0D35B818 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3527]: JKF: Reading 9BBD15B81E from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3527]: JKF: Reading 40B635B814 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3527]: JKF: Reading 933315B815 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3526]: JKF: Reading . from dir .
>Jun 27 17:40:05 intranet MailScanner[3526]: JKF: Reading .. from dir .
>Jun 27 17:40:05 intranet MailScanner[3526]: JKF: Reading 4E0D35B818 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3526]: JKF: Reading 9BBD15B81E from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3526]: JKF: Reading 40B635B814 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3526]: JKF: Reading 933315B815 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3524]: JKF: Reading . from dir .
>Jun 27 17:40:05 intranet MailScanner[3524]: JKF: Reading .. from dir .
>Jun 27 17:40:05 intranet MailScanner[3524]: JKF: Reading 4E0D35B818 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3524]: JKF: Reading 9BBD15B81E from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3524]: JKF: Reading 40B635B814 from
>dir .
>Jun 27 17:40:05 intranet MailScanner[3524]: JKF: Reading 933315B815 from
>dir .
>
>
>Does it help ?

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support