Mailscanner leaves two running processes when restarting

Julian Field mailscanner at
Mon May 19 10:31:06 IST 2003

At 10:08 19/05/2003, you wrote:
>Hello Mailscanner gurus

I have just discovered from the bottom of your message that you are still 
running 3.27. This is at least a year old now, and it's about time Debian 
updated their distribution.

>I have used mailscanner (with exim) for some time and I have been very
>content about it doing a good job.
>Now I have just set it up on another site - and where it worked just
>flawlessly before, I now have troubles...
>Mailscanner starts and does it's job good. However it restarts every
>hour (curiously - it is configured to restart every 14400 seconds)
>  -
>and it does not kill the previous process:
>root at carlsberg:~# ps axu|grep mailscanner
>mail     11612  0.1  9.8 23272 12624 ?       S    09:00   0:06 [mailscanner]
>mail     13598  0.6 15.8 23212 20284 ?       S    10:00   0:04 [mailscanner]
>root     13952  0.0  0.4  1620  564 pts/2    S    10:12   0:00 grep 
>root at carlsberg:~#
>This results in the two running mailscanners trying to scan messages
>at the same time:

The output of the "ps" command changed completely with a recent glibc 
upgrade. As a result, check_mailscanner (called by an hourly cron job) 
totally fails, and attempts to start another MailScanner process. If you 
want to see how to do it these days, take a look in any recent version of 
MailScanner and transplant the guts of the current check_mailscanner into 
your old version.

If Debian won't/can't keep their distribution even vaguely up to date, 
there's not much I can do. Their current release is at least a year old, 
and no longer works properly with the rest of their distribution. I always 
believed they were fanatical about back-porting compatibility fixes so that 
everything kept working, but clearly not in this case :-( If someone else 
fancies taking over the Debian distribution, and can keep it up to date, 
then I would welcome it.

>May 19 09:12:40 carlsberg mailscanner[11612]: Scanning 1 messages, 5280 bytes
>May 19 09:12:40 carlsberg mailscanner[11612]: Cannot parse 
>/var/spool/mailscanner/incoming/19Hep2-00036o-00.header and 
>/var/spool/exim_incoming/input/19Hep2-00036o-00-D, write-open 
>/var/spool/mailscanner/incoming/19Hep2-00036o-00/msg-11612-3.txt: No such 
>file or directory at /usr/share/perl5/MIME/ line 414, <_GEN_2> line 64.
>May 19 09:12:40 carlsberg mailscanner[9980]: Scanning 1 messages, 5280 bytes
>May 19 09:12:40 carlsberg mailscanner[11612]: Scanned 1 messages, 5280 
>bytes in 0 seconds
>The message is delivered normally - but the sender (if local) is sent
>a virus message ("Your email was infected with virus: Could not parse
>message") as well as the administrator.

Do you still have a cron job in place that is trying to start version 3 at 
the same time as version 4 is running? That's the most common cause of this 

>Disabling spamassassin entirely (Use SpamAssassin = no) does not help.
>I have tried searching the archives; google, google groups etc. - I
>can't seem to find anybody else having this problem...
>I am at loss; I cannot seem to figure out, what is wrong. Any gurus
>out there, who have an idea?
>The system:
>Debian Woody, i386. Relevant packages installed (these are the same
>version as the well-working mailscanner machine):
>ii  mailscanner                 3.27.1-1                    An email virus 
>scanner and spam tagger.
>ii  exim                        3.35-1                      An MTA (Mail 
>Transport Agent)
>ii  perl                        5.6.1-8.2                   Larry Wall's 
>Practical Extraction and Report Language.
>ii  libio-stringy-perl          2.108-1                     Perl5 modules 
>for IO from scalars and arrays
>ii  libmime-base64-perl         2.12-4                      MIME/Base64 
>decoding for Perl
>ii  libmailtools-perl           1.44-1                      Manipulate 
>email in perl programs
>ii  libmime-perl                5.411-2                     Perl5 modules 
>for MIME-compliant messages (MIME-tools)
>ii  spamassassin                2.53-1                      Perl-based 
>spam filter using text analysis
>ii  libmail-audit-perl          2.0-4                       Perl library 
>for creating easy mail filters
>I use F-prot (small business):
>Program version: 3.13
>Engine version: 3.13.1
>In /usr/share/mailscanner/ line 414 is changed from:
>to make mailscanner able to parse the f-prot output.
>MS Config:
>Run As User = mail
>Run As Group = mail
>Max Safe   Messages Per Scan = 500
>Max Unsafe Messages Per Scan = 100
>Max Safe   Bytes Per Scan = 100000000
>Max Unsafe Bytes Per Scan = 50000000
>Restart Every = 14400 # 4 hours
>Host name          =
>Mail Header = X-MailScanner:
>Clean Header       = Found to be clean
>Infected Header    = Found to be infected
>Disinfected Header = Disinfected
>Incoming Work Dir  = /var/spool/mailscanner/incoming
>Quarantine Dir     = /var/spool/mailscanner/quarantine
>Pid File           = /var/run/mailscanner/
>Filename Rules     = /etc/mailscanner/filename.rules.conf
>Log Permitted Filenames = no
>Stored Virus Message Report  = /etc/mailscanner/stored.virus.message.txt
>Stored Bad Filename Message Report  = 
>Deleted Virus Message Report = /etc/mailscanner/deleted.virus.message.txt
>Deleted Bad Filename Message Report = 
>Disinfected Report = /etc/mailscanner/
>Hide Incoming Work Dir = yes
>Incoming Queue Dir = /var/spool/exim_incoming/input
>Outgoing Queue Dir = /var/spool/exim/input
>MTA                = exim
>Sendmail           = /usr/sbin/exim
>Sendmail2          = /usr/sbin/exim -C /etc/exim/exim_outgoing.conf
>Log Facility = mail
>Virus Scanning     = yes
>Virus Scanner = f-prot
>Sweep = /usr/bin/f-prot
>Virus Scanner Timeout = 300
>Expand TNEF        = yes
>TNEF Expander      = /usr/bin/tnef --maxsize=100000000
>TNEF Timeout       = 120
>Attachment Warning Filename = VirusWarning.txt
>Warning Is Attachment = yes
>Scan All Messages = yes
>Deliver To Recipients = yes
>Virus Modify Subject = yes
>Virus Subject Text = {VIRUS?}
>Deliver From Local Domains = yes
>Notify Senders = local
>Sender Virus Report        = /etc/mailscanner/
>Sender Bad Filename Report = /etc/mailscanner/
>Sender Error Report        = /etc/mailscanner/
>Notify Local Postmaster = yes
>Postmaster Gets Full Headers = yes
>Local Postmaster = postmaster at
>Action = keep
>Quarantine Whole Message = no
>Deliver Disinfected Files = yes
>Local Domains =
>Viruses To Quietly Delete = /etc/mailscanner/
>Still Deliver Quietly Deleted Viruses = yes
>Allow IFrame Tags = no
>Allow Object Codebase Tags = no
>Mark Infected Messages = yes
>Inline Text Warning = Warning: This message has had one or more 
>attachments removed.
>Inline Text Warning = Warning: Please read the "VirusWarning.txt" 
>attachment(s) for more information.
>Inline HTML Warning = <P><B><FONT SIZE="+1" COLOR="red">Warning: 
></FONT>This message has had one or more attachments removed. Please read 
>the "VirusWarning.txt" attachment(s) for more information.</B><BR></P>
>Sign Clean Messages = no
>Inline Text Signature = --
>Inline Text Signature = This message has been scanned for viruses and
>Inline Text Signature = dangerous content by MailScanner, and is
>Inline Text Signature = believed to be clean.
>Inline HTML Signature = <BR>--
>Inline HTML Signature = <BR>This message has been scanned for viruses and
>Inline HTML Signature = <BR>dangerous content by
>Inline HTML Signature = <A 
>Inline HTML Signature = and is<BR>believed to be clean.
>Sign Messages Already Processed = no
>Archive Mail = no
>Archive Mail Dir = /var/spool/mailscanner/archive
>Scanning By Domain = no
>Domains To Scan = /etc/mailscanner/
>Sign Unscanned Messages = yes
>Unscanned Header = not scanned: please contact your email provider for details
>Spam Checks = no
>Spam Header = X-MailScanner-SpamCheck:
>Spam Modify Subject = yes
>Spam Subject Text = {SPAM?}
>Spam Action = deliver
>Log Spam = no
>Use SpamAssassin = yes
>Max SpamAssassin Size = 50000
>SpamAssassin Timeout = 10
>Max SpamAssassin Timeouts = 10
>SpamAssassin Prefs File = /etc/mailscanner/spam.assassin.prefs.conf
>SpamAssassin Auto Whitelist = yes
>Compile SpamAssassin Once = yes
>Always Include SpamAssassin Report = no
>Spam List = ORDB-RBL,
>Spam List Timeout = 5
>Max Spam List Timeouts = 7
>Debug = 0
>Delivery Method = batch
>Lock File Dir = /tmp
>Multiple Headers = append
>Deliver Unparsable TNEF = no
>Deliver In Background = yes
>Minimum Code Status = supported
>-- [ Rasmus "Møffe" Bøg Hansen ] ---------------------------------------
>Programming is a race between programmers, who try and make more and
>more idiot-proof software, and universe, which produces more and more
>remarkable idiots.
>Until now, universe leads the race.
>                                                            - R. Cooka
>----------------------------------[ moffe at amagerkollegiet dot dk ] --

Julian Field
Professional Support Services at
MailScanner thanks transtec Computers for their support

More information about the MailScanner mailing list