Mailscanner leaves two running processes when restarting

Mon May 19 10:08:45 IST 2003

Hello Mailscanner gurus

I have used mailscanner (with exim) for some time and I have been very
content about it doing a good job.

Now I have just set it up on another site - and where it worked just
flawlessly before, I now have troubles...

Mailscanner starts and does it's job good. However it restarts every
hour (curiously - it is configured to restart every 14400 seconds) -
and it does not kill the previous process:

root at carlsberg:~# ps axu|grep mailscanner
mail     11612  0.1  9.8 23272 12624 ?       S    09:00   0:06 [mailscanner]
mail     13598  0.6 15.8 23212 20284 ?       S    10:00   0:04 [mailscanner]
root     13952  0.0  0.4  1620  564 pts/2    S    10:12   0:00 grep mailscanner
root at carlsberg:~#

This results in the two running mailscanners trying to scan messages
at the same time:

May 19 09:12:40 carlsberg mailscanner[11612]: Scanning 1 messages, 5280 bytes
May 19 09:12:40 carlsberg mailscanner[11612]: Cannot parse /var/spool/mailscanner/incoming/19Hep2-00036o-00.header and /var/spool/exim_incoming/input/19Hep2-00036o-00-D, write-open /var/spool/mailscanner/incoming/19Hep2-00036o-00/msg-11612-3.txt: No such file or directory at /usr/share/perl5/MIME/Body.pm line 414, <_GEN_2> line 64.
May 19 09:12:40 carlsberg mailscanner[9980]: Scanning 1 messages, 5280 bytes
May 19 09:12:40 carlsberg mailscanner[11612]: Scanned 1 messages, 5280 bytes in 0 seconds

The message is delivered normally - but the sender (if local) is sent
a virus message ("Your email was infected with virus: Could not parse
message") as well as the administrator.

Disabling spamassassin entirely (Use SpamAssassin = no) does not help.

I have tried searching the archives; google, google groups etc. - I
can't seem to find anybody else having this problem...

I am at loss; I cannot seem to figure out, what is wrong. Any gurus
out there, who have an idea?

The system:

Debian Woody, i386. Relevant packages installed (these are the same
version as the well-working mailscanner machine):

ii  mailscanner                 3.27.1-1                    An email virus scanner and spam tagger.
ii  exim                        3.35-1                      An MTA (Mail Transport Agent)
ii  perl                        5.6.1-8.2                   Larry Wall's Practical Extraction and Report Language.
ii  libio-stringy-perl          2.108-1                     Perl5 modules for IO from scalars and arrays
ii  libmime-base64-perl         2.12-4                      MIME/Base64 decoding for Perl
ii  libmailtools-perl           1.44-1                      Manipulate email in perl programs
ii  libmime-perl                5.411-2                     Perl5 modules for MIME-compliant messages (MIME-tools)
ii  spamassassin                2.53-1                      Perl-based spam filter using text analysis
ii  libmail-audit-perl          2.0-4                       Perl library for creating easy mail filters

I use F-prot (small business):

F-PROT ANTIVIRUS
Program version: 3.13
Engine version: 3.13.1

In /usr/share/mailscanner/sweep.pl line 414 is changed from:

$fprot_InCruft=(-3);

to:

$fprot_InCruft=(-4);

to make mailscanner able to parse the f-prot output.

MS Config:

Run As User = mail
Run As Group = mail
Max Safe Messages Per Scan = 500
Max Unsafe Messages Per Scan = 100
Max Safe Bytes Per Scan = 100000000
Max Unsafe Bytes Per Scan = 50000000
Restart Every = 14400 # 4 hours
Host name = carlsberg.amagerkollegiet.dk
Mail Header = X-MailScanner:
Clean Header = Found to be clean
Infected Header = Found to be infected
Disinfected Header = Disinfected
Incoming Work Dir = /var/spool/mailscanner/incoming
Quarantine Dir = /var/spool/mailscanner/quarantine
Pid File = /var/run/mailscanner/mailscanner.pid
Filename Rules = /etc/mailscanner/filename.rules.conf
Log Permitted Filenames = no
Stored Virus Message Report = /etc/mailscanner/stored.virus.message.txt
Stored Bad Filename Message Report = /etc/mailscanner/stored.filename.message.txt
Deleted Virus Message Report = /etc/mailscanner/deleted.virus.message.txt
Deleted Bad Filename Message Report = /etc/mailscanner/deleted.filename.message.txt
Disinfected Report = /etc/mailscanner/disinfected.report.txt
Hide Incoming Work Dir = yes
Incoming Queue Dir = /var/spool/exim_incoming/input
Outgoing Queue Dir = /var/spool/exim/input
MTA = exim
Sendmail = /usr/sbin/exim
Sendmail2 = /usr/sbin/exim -C /etc/exim/exim_outgoing.conf
Log Facility = mail
Virus Scanning = yes
Virus Scanner = f-prot
Sweep = /usr/bin/f-prot
Virus Scanner Timeout = 300
Expand TNEF = yes
TNEF Expander = /usr/bin/tnef --maxsize=100000000
TNEF Timeout = 120
Attachment Warning Filename = VirusWarning.txt
Warning Is Attachment = yes
Scan All Messages = yes
Deliver To Recipients = yes
Virus Modify Subject = yes
Virus Subject Text = {VIRUS?}
Deliver From Local Domains = yes
Notify Senders = local
Sender Virus Report = /etc/mailscanner/sender.virus.report.txt
Sender Bad Filename Report = /etc/mailscanner/sender.filename.report.txt
Sender Error Report = /etc/mailscanner/sender.error.report.txt
Notify Local Postmaster = yes
Postmaster Gets Full Headers = yes
Local Postmaster = postmaster at amagerkollegiet.dk
Action = keep
Quarantine Whole Message = no
Deliver Disinfected Files = yes
Local Domains = amagerkollegiet.dk
Viruses To Quietly Delete = /etc/mailscanner/viruses.to.delete.conf
Still Deliver Quietly Deleted Viruses = yes
Allow IFrame Tags = no
Allow Object Codebase Tags = no
Mark Infected Messages = yes
Inline Text Warning = Warning: This message has had one or more attachments removed.
Inline Text Warning = Warning: Please read the "VirusWarning.txt" attachment(s) for more information.
Inline HTML Warning = Warning: This message has had one or more attachments removed. Please read the "VirusWarning.txt" attachment(s) for more information. 
Sign Clean Messages = no
Inline Text Signature = -- 
Inline Text Signature = This message has been scanned for viruses and
Inline Text Signature = dangerous content by MailScanner, and is
Inline Text Signature = believed to be clean.
Inline HTML Signature = -- 
Inline HTML Signature = This message has been scanned for viruses and
Inline HTML Signature = dangerous content by
Inline HTML Signature = <A HREF="http://www.mailscanner.info/">MailScanner</A>,
Inline HTML Signature = and is believed to be clean.
Sign Messages Already Processed = no
Archive Mail = no
Archive Mail Dir = /var/spool/mailscanner/archive
Scanning By Domain = no
Domains To Scan = /etc/mailscanner/domains.to.scan.conf
Sign Unscanned Messages = yes
Unscanned Header = not scanned: please contact your email provider for details
Spam Checks = no
Spam Header = X-MailScanner-SpamCheck:
Spam Modify Subject = yes
Spam Subject Text = {SPAM?}
Spam Action = deliver
Log Spam = no
Use SpamAssassin = yes
Max SpamAssassin Size = 50000
SpamAssassin Timeout = 10
Max SpamAssassin Timeouts = 10
SpamAssassin Prefs File = /etc/mailscanner/spam.assassin.prefs.conf
SpamAssassin Auto Whitelist = yes
Compile SpamAssassin Once = yes
Always Include SpamAssassin Report = no
Spam List = ORDB-RBL, relays.ordb.org.
Spam List Timeout = 5
Max Spam List Timeouts = 7
Debug = 0
Delivery Method = batch
Lock File Dir = /tmp
Multiple Headers = append
Deliver Unparsable TNEF = no
Deliver In Background = yes
Minimum Code Status = supported

TIA
/Rasmus

-- 
-- [ Rasmus "Møffe" Bøg Hansen ] ---------------------------------------
Programming is a race between programmers, who try and make more and
more idiot-proof software, and universe, which produces more and more
remarkable idiots.
Until now, universe leads the race.
                                                           - R. Cooka
----------------------------------[ moffe at amagerkollegiet dot dk ] --