Mailscanner leaves two running processes when restarting
Julian Field
mailscanner at ecs.soton.ac.uk
Mon May 19 10:31:06 IST 2003
At 10:08 19/05/2003, you wrote:
>Hello Mailscanner gurus
I have just discovered from the bottom of your message that you are still
running 3.27. This is at least a year old now, and it's about time Debian
updated their distribution.
>I have used mailscanner (with exim) for some time and I have been very
>content about it doing a good job.
>
>Now I have just set it up on another site - and where it worked just
>flawlessly before, I now have troubles...
>
>Mailscanner starts and does it's job good. However it restarts every
>hour (curiously - it is configured to restart every 14400 seconds)
> -
>and it does not kill the previous process:
>
>root at carlsberg:~# ps axu|grep mailscanner
>mail 11612 0.1 9.8 23272 12624 ? S 09:00 0:06 [mailscanner]
>mail 13598 0.6 15.8 23212 20284 ? S 10:00 0:04 [mailscanner]
>root 13952 0.0 0.4 1620 564 pts/2 S 10:12 0:00 grep
>mailscanner
>root at carlsberg:~#
>
>This results in the two running mailscanners trying to scan messages
>at the same time:
The output of the "ps" command changed completely with a recent glibc
upgrade. As a result, check_mailscanner (called by an hourly cron job)
totally fails, and attempts to start another MailScanner process. If you
want to see how to do it these days, take a look in any recent version of
MailScanner and transplant the guts of the current check_mailscanner into
your old version.
If Debian won't/can't keep their distribution even vaguely up to date,
there's not much I can do. Their current release is at least a year old,
and no longer works properly with the rest of their distribution. I always
believed they were fanatical about back-porting compatibility fixes so that
everything kept working, but clearly not in this case :-( If someone else
fancies taking over the Debian distribution, and can keep it up to date,
then I would welcome it.
>May 19 09:12:40 carlsberg mailscanner[11612]: Scanning 1 messages, 5280 bytes
>May 19 09:12:40 carlsberg mailscanner[11612]: Cannot parse
>/var/spool/mailscanner/incoming/19Hep2-00036o-00.header and
>/var/spool/exim_incoming/input/19Hep2-00036o-00-D, write-open
>/var/spool/mailscanner/incoming/19Hep2-00036o-00/msg-11612-3.txt: No such
>file or directory at /usr/share/perl5/MIME/Body.pm line 414, <_GEN_2> line 64.
>May 19 09:12:40 carlsberg mailscanner[9980]: Scanning 1 messages, 5280 bytes
>May 19 09:12:40 carlsberg mailscanner[11612]: Scanned 1 messages, 5280
>bytes in 0 seconds
>
>The message is delivered normally - but the sender (if local) is sent
>a virus message ("Your email was infected with virus: Could not parse
>message") as well as the administrator.
Do you still have a cron job in place that is trying to start version 3 at
the same time as version 4 is running? That's the most common cause of this
problem.
>Disabling spamassassin entirely (Use SpamAssassin = no) does not help.
>
>I have tried searching the archives; google, google groups etc. - I
>can't seem to find anybody else having this problem...
>
>I am at loss; I cannot seem to figure out, what is wrong. Any gurus
>out there, who have an idea?
>
>The system:
>
>Debian Woody, i386. Relevant packages installed (these are the same
>version as the well-working mailscanner machine):
>
>ii mailscanner 3.27.1-1 An email virus
>scanner and spam tagger.
>ii exim 3.35-1 An MTA (Mail
>Transport Agent)
>ii perl 5.6.1-8.2 Larry Wall's
>Practical Extraction and Report Language.
>ii libio-stringy-perl 2.108-1 Perl5 modules
>for IO from scalars and arrays
>ii libmime-base64-perl 2.12-4 MIME/Base64
>decoding for Perl
>ii libmailtools-perl 1.44-1 Manipulate
>email in perl programs
>ii libmime-perl 5.411-2 Perl5 modules
>for MIME-compliant messages (MIME-tools)
>ii spamassassin 2.53-1 Perl-based
>spam filter using text analysis
>ii libmail-audit-perl 2.0-4 Perl library
>for creating easy mail filters
>
>I use F-prot (small business):
>
>F-PROT ANTIVIRUS
>Program version: 3.13
>Engine version: 3.13.1
>
>In /usr/share/mailscanner/sweep.pl line 414 is changed from:
>
>$fprot_InCruft=(-3);
>
>to:
>
>$fprot_InCruft=(-4);
>
>to make mailscanner able to parse the f-prot output.
>
>MS Config:
>
>Run As User = mail
>Run As Group = mail
>Max Safe Messages Per Scan = 500
>Max Unsafe Messages Per Scan = 100
>Max Safe Bytes Per Scan = 100000000
>Max Unsafe Bytes Per Scan = 50000000
>Restart Every = 14400 # 4 hours
>Host name = carlsberg.amagerkollegiet.dk
>Mail Header = X-MailScanner:
>Clean Header = Found to be clean
>Infected Header = Found to be infected
>Disinfected Header = Disinfected
>Incoming Work Dir = /var/spool/mailscanner/incoming
>Quarantine Dir = /var/spool/mailscanner/quarantine
>Pid File = /var/run/mailscanner/mailscanner.pid
>Filename Rules = /etc/mailscanner/filename.rules.conf
>Log Permitted Filenames = no
>Stored Virus Message Report = /etc/mailscanner/stored.virus.message.txt
>Stored Bad Filename Message Report =
>/etc/mailscanner/stored.filename.message.txt
>Deleted Virus Message Report = /etc/mailscanner/deleted.virus.message.txt
>Deleted Bad Filename Message Report =
>/etc/mailscanner/deleted.filename.message.txt
>Disinfected Report = /etc/mailscanner/disinfected.report.txt
>Hide Incoming Work Dir = yes
>Incoming Queue Dir = /var/spool/exim_incoming/input
>Outgoing Queue Dir = /var/spool/exim/input
>MTA = exim
>Sendmail = /usr/sbin/exim
>Sendmail2 = /usr/sbin/exim -C /etc/exim/exim_outgoing.conf
>Log Facility = mail
>Virus Scanning = yes
>Virus Scanner = f-prot
>Sweep = /usr/bin/f-prot
>Virus Scanner Timeout = 300
>Expand TNEF = yes
>TNEF Expander = /usr/bin/tnef --maxsize=100000000
>TNEF Timeout = 120
>Attachment Warning Filename = VirusWarning.txt
>Warning Is Attachment = yes
>Scan All Messages = yes
>Deliver To Recipients = yes
>Virus Modify Subject = yes
>Virus Subject Text = {VIRUS?}
>Deliver From Local Domains = yes
>Notify Senders = local
>Sender Virus Report = /etc/mailscanner/sender.virus.report.txt
>Sender Bad Filename Report = /etc/mailscanner/sender.filename.report.txt
>Sender Error Report = /etc/mailscanner/sender.error.report.txt
>Notify Local Postmaster = yes
>Postmaster Gets Full Headers = yes
>Local Postmaster = postmaster at amagerkollegiet.dk
>Action = keep
>Quarantine Whole Message = no
>Deliver Disinfected Files = yes
>Local Domains = amagerkollegiet.dk
>Viruses To Quietly Delete = /etc/mailscanner/viruses.to.delete.conf
>Still Deliver Quietly Deleted Viruses = yes
>Allow IFrame Tags = no
>Allow Object Codebase Tags = no
>Mark Infected Messages = yes
>Inline Text Warning = Warning: This message has had one or more
>attachments removed.
>Inline Text Warning = Warning: Please read the "VirusWarning.txt"
>attachment(s) for more information.
>Inline HTML Warning = <P><B><FONT SIZE="+1" COLOR="red">Warning:
></FONT>This message has had one or more attachments removed. Please read
>the "VirusWarning.txt" attachment(s) for more information.</B><BR></P>
>Sign Clean Messages = no
>Inline Text Signature = --
>Inline Text Signature = This message has been scanned for viruses and
>Inline Text Signature = dangerous content by MailScanner, and is
>Inline Text Signature = believed to be clean.
>Inline HTML Signature = <BR>--
>Inline HTML Signature = <BR>This message has been scanned for viruses and
>Inline HTML Signature = <BR>dangerous content by
>Inline HTML Signature = <A
>HREF="http://www.mailscanner.info/"><B>MailScanner</B></A>,
>Inline HTML Signature = and is<BR>believed to be clean.
>Sign Messages Already Processed = no
>Archive Mail = no
>Archive Mail Dir = /var/spool/mailscanner/archive
>Scanning By Domain = no
>Domains To Scan = /etc/mailscanner/domains.to.scan.conf
>Sign Unscanned Messages = yes
>Unscanned Header = not scanned: please contact your email provider for details
>Spam Checks = no
>Spam Header = X-MailScanner-SpamCheck:
>Spam Modify Subject = yes
>Spam Subject Text = {SPAM?}
>Spam Action = deliver
>Log Spam = no
>Use SpamAssassin = yes
>Max SpamAssassin Size = 50000
>SpamAssassin Timeout = 10
>Max SpamAssassin Timeouts = 10
>SpamAssassin Prefs File = /etc/mailscanner/spam.assassin.prefs.conf
>SpamAssassin Auto Whitelist = yes
>Compile SpamAssassin Once = yes
>Always Include SpamAssassin Report = no
>Spam List = ORDB-RBL, relays.ordb.org.
>Spam List Timeout = 5
>Max Spam List Timeouts = 7
>Debug = 0
>Delivery Method = batch
>Lock File Dir = /tmp
>Multiple Headers = append
>Deliver Unparsable TNEF = no
>Deliver In Background = yes
>Minimum Code Status = supported
>
>TIA
>/Rasmus
>
>--
>-- [ Rasmus "Møffe" Bøg Hansen ] ---------------------------------------
>Programming is a race between programmers, who try and make more and
>more idiot-proof software, and universe, which produces more and more
>remarkable idiots.
>Until now, universe leads the race.
> - R. Cooka
>----------------------------------[ moffe at amagerkollegiet dot dk ] --
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
More information about the MailScanner
mailing list