Mail Not Routing, stuck in /var/spool/mqueue.in

[Stephen Swaney]

I'm starting to suspect that something besides MailScanner may be the
cause of this mysterious problem.

We have a new install of MailScanner that has been chugging nicely along
since Sunday. All of the sudden between 10 & 11 AM EDT the "New Batch:
Found ***** messages waiting" started creeping rapidly up. until it
reached about 15,000 around 2:00 PM. I've been closely monitoring this
server since Sunday and it's never had more than 200 messages queued
before. It's no powerhouse, a 1 GHz Pentium with 512 MB RAM but it was
chugging nicely along until today.

We're now dropping the queue about 2,000 messages per hour by routing
outbound email through another gateway. I can't do a lot of log
diagnosis on the system right now because The load is a bit high and I
don't want to disrupt the cleanup.

I just think it's strange that all of the sudden so many of us are
experiencing the same problem with different versions of MailScanner.
Only thing new in my systems logs is the reporting of:

        Report: ClamAV: patch.exe contains Worm.Dumaru

Which started about the same time as the queue backup. From the web:

        "Dumaru is a mass mailing worm, uses  e-mail addresses collected
        from htm, wab, html, dbx, tbb, abd files to distribute infected
        messages. Dumaru worm arrives as an e-mail attachment. The
        infected attachment name will be "patch.exe"."

Can't see why this would cause a problem if we're stopping it, but it's
the only apparent anomaly in the logs.

Any ideas?

Steve

Stephen Swaney
President
Fortress Systems, Ltd.
www.FSL.com
Steve.Swaney at FSL.com
Phone: 202 338-1670
Fax:202 448-2969
U.S. Toll Free Phone and Fax: 877 746-6636

--
This message has been scanned for viruses and
dangerous content by MailScanner and Sophos Anti-Virus at
Fortress Systems.com
and is
believed to be clean.

--
Postmaster at FSL.com
Fortress Systems, Ltd.
Email Gateways
info at FSL.com
www.FSL.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030903/c58908f8/attachment.html