mailscanner (Solaris 2.6) Could not open file

[Spicer, Kevin]

Chang Kai Cheong wrote:
> Hi Kevin,
> 
> My Solaris got:
> 
> set rlim_fd_max = 4096
> 
> in /etc/system and I think 2048 (out of 4096) should be fairly good
> but still it failed.  The strange thing is that the same error
> message keeps going even after the restart of MailScanner.  I have to
> move the mqueue.in away and create a new one in order to successfully
> start MailScanner and make it work properly again (should it be a
> file descriptor problem??).  I can re-start the MailScanner only if
> the mqueue.in is re-created and then gradually moved back the queued
> messages. 
> 
> Actually, my MailScanner has been running smoothly for over a year
> and got this intermittent error since January 2004 (and I got the
> same version running on Alpha Tru64 without problem).  I cannot find
> any clues in truss output as well (only find a number of
> fstat/open/fcntl call to mail messages and then rmdir of the incoming
> dir. before dying of child mailscanner processes).  Any ideas?
> 

Its probably been tipped over the edge by the MyDoom virus.  IIRC these limits
apply to processes and their children, so...

5 mailscanner processes * 100 message batches * 2 queue files per message = 1000 files
Then we've got the output header files (another 500 files), then any attachments/ bodies
being scanned (say 2 parts per message maybe another 1000).  And thats before Spamassassin,
file command etc.etc.  Okay I admit that maybe all of these aren't open at the same time -
but you can see how quickly they can be used up when the server is busy.

The very fact that taking the messages out of the queue clears the problem suggests it is a
symptom of the number of files involved.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.