Weird files in /var/spool/postfix/maildrop

[Jason Balicki]

The issue below has been solved.  I was able to correlate
some entries in the logs and come up with a solution.

I don't know why, but every time MailScanner would come
across a message containing a form, it would generate a
"foundform" error and it would drop a seemingly unrelated
file into /var/spool/postfix/maildrop that would just sit
there until I deleted it.  The files are named via message
ID and the message ID for the message containing the form
was unrelated to the message ID MailScanner generated for
the file placed in the maildrop directory.

Log entries like this one:

/var/log/mail.log.6.gz:Oct  6 15:41:54 mail MailScanner[25571]: Looked up
unknown string foundform in language translation file
/opt/MailScanner/etc/reports/en/languages.conf

tipped me off to the "foundform" thing.

Looking in /opt/MailScanner/etc/reports/en/languages.conf
there was a "FoundForm" entry.  I simply copied the entry
and made a "foundform" entry:

FoundForm = Found a form in HTML message
foundform = Found a form in HTML message

After that, MailScanner stopped complaining and the
weird files stopped showing up in the maildrop
directory.

I'm sure that this is directly related to the wacky
way I upgraded MailScanner this last time.

I'm posting this only so someone can find it if they
search the archives.

--J(K)

>-----Original Message-----
>From: MailScanner mailing list
>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Jason Balicki
>Sent: Friday, September 26, 2003 9:32 AM
>To: MAILSCANNER at JISCMAIL.AC.UK
>Subject: Weird files in /var/spool/postfix/maildrop
>
>
>I asked about this once before, but the problem seemed like a fluke
>so I didn't push the issue.  Well, it's back.
>
>I'm getting some weird files popping up in /var/spool/postfix/maildrop
>which is the delivery queue:
>
>mail maildrop # pwd
>/var/spool/postfix/maildrop
>mail maildrop # ls -l
>total 40
>-rwxr--r--    1 postfix  postdrop       36 Sep 26 04:01 067762EC19B
>-rwxr--r--    1 postfix  postdrop       36 Sep 26 03:32 0DFA72EC19A
>-rwxr--r--    1 postfix  postdrop       36 Sep 25 15:47 143D32EC195
>-rwxr--r--    1 postfix  postdrop       36 Sep 24 21:15 63F912EC191
>-rwxr--r--    1 postfix  postdrop       36 Sep 24 17:40 6F18F2EC18F
>-rwxr--r--    1 postfix  postdrop       36 Sep 25 17:48 76BD02EC197
>-rwxr--r--    1 postfix  postdrop       36 Sep 25 16:46 B9CB12EC196
>-rwxr--r--    1 postfix  postdrop       36 Sep 24 21:28 C62BA2EC192
>-rwxr--r--    1 postfix  postdrop       36 Sep 25 19:47 CA4B22EC198
>-rwxr--r--    1 postfix  postdrop       36 Sep 26 02:44 CE5612EC199
>
>Each file has the same contents:
>
>mail maildrop # file 067762EC19B
>067762EC19B: data
>mail maildrop # cat 067762EC19B
>F
> MailScannerSM              0XE
>
>And in my logs, I get (many times, for each file):
>
>Sep 26 09:12:59 mail postfix/pickup[20381]: warning:
>maildrop/067762EC19B:
>No recipients specified
>
>The funny thing is, I can't find where these files enter the system.
>I keep logs going back for 8 days and there's no mention of these
>files except for the postfix/pickup warnings.
>
>mail maildrop # ls -l /var/log/mail.log*
>-rw-r-----    1 root     adm       1994410 Sep 26 09:16
>/var/log/mail.log
>-rw-r-----    1 root     adm       3285694 Sep 25 23:59
>/var/log/mail.log.0
>-rw-r-----    1 root     adm        317627 Sep 25 00:00
>/var/log/mail.log.1.gz
>-rw-r-----    1 root     adm        218594 Sep 23 23:59
>/var/log/mail.log.2.gz
>-rw-r-----    1 root     adm        168074 Sep 23 00:00
>/var/log/mail.log.3.gz
>-rw-r-----    1 root     adm         67781 Sep 21 23:58
>/var/log/mail.log.4.gz
>-rw-r-----    1 root     adm         89634 Sep 20 23:57
>/var/log/mail.log.5.gz
>-rw-r-----    1 root     adm        222786 Sep 19 23:59
>/var/log/mail.log.6.gz
>mail maildrop # zgrep 067762EC19B /var/log/mail.log*.gz
>mail maildrop #
>mail maildrop # grep 067762EC19B /var/log/mail.log.0 | grep -v recip
>mail maildrop # grep 067762EC19B /var/log/mail.log | grep -v recip
>mail maildrop #
>
>Also:
>mail maildrop # find /var -name 067762EC19B -print
>/var/spool/postfix/maildrop/067762EC19B
>mail maildrop #
>
>There's only a couple a day, but I can't find where these are
>coming from.  That bothers me a bit.  The only clue I'm given
>is in the contents of each file, but I don't know if that's
>meaningful either.  If I delete them, it doesn't seem to have
>any impact on the system whatsoever (except, of course, pickup
>stops complaining).  (None of the other logs in /var/log have
>anything in them about these files either.)
>
>Does anyone have any ideas here?  Where else can I look?  To me,
>it looks like MailScanner is generating these files and putting
>them in maildrop, but I don't know enough about the internals
>of MS to figure out where that could be happening.
>
>Anyway, I appreciate any and all help I could be given on
>this matter.
>
>--J(K)
>