Strange behavior since update to latest version... Failed to link message body between queues error..

[Petry Roman, ITS-IT]

Hello,

I updated from Version 4.22-4 to 4.31.6 last week and get some strange
messages in my mail log. Transfervolume of the server is 10000 mails per
day.
Sendmail with sophos installed. All logs before the update are o.k... I
searched the list archive, but i only found 2 messages about thios problem,
but with exim and not sendmail..

I saw some strange messages like...

Jul 30 10:29:55 nrz83 sendmail-in[4197]: i6U8TtsP004197:
from=<xxxxx.xxxx at xxxxxx.de>, size=3461, class=0, nrcpts=1,
msgid=<985A4512575C7B40A722B69A2293895556B482 at yyyy.xxxx.de>, proto=SMTP,
daemon=MTA, relay=111-111-1111-1111.xx.xxxxx.de [222.222.222.222] (may be
forged)
Jul 30 10:29:55 nrz83 sendmail-in[4197]: i6U8TtsP004197:
to=<yyyyy.yyyyyl at yyy.yyyy.biz>, delay=00:00:00, mailer=smtp, pri=30859,
stat=queued
Jul 30 10:30:38 nrz83 MailScanner[30622]: Filetype Checks: Allowing
i6U8TtsP004197 msg-30622-172.txt
Jul 30 10:30:38 nrz83 MailScanner[30622]: Filetype Checks: Allowing
i6U8TtsP004197 msg-30622-171.txt
Jul 30 10:30:38 nrz83 MailScanner[30642]: Filetype Checks: Allowing
i6U8TtsP004197 msg-30642-143.txt
Jul 30 10:30:38 nrz83 MailScanner[30642]: Filetype Checks: Allowing
i6U8TtsP004197 msg-30642-144.txt
Jul 30 10:30:38 nrz83 MailScanner[30642]: Failed to link message body
between queues (/cache/mqueue/dfi6U8TtsP004197 -->
/cache/mqueue.in/dfi6U8TtsP004197)
Jul 30 10:30:40 nrz83 sendmail[4639]: i6U8TtsP004197:
to=<yyyyy.yyyyyl at yyy.yyyyy.biz>, delay=00:00:45, xdelay=00:00:01,
mailer=smtp, pri=120859, relay=[122.122.122.222] [122.122.122.222],
dsn=2.0.0, stat=Sent (Ok)

I saw 350 of this errors in my log files, yesterday .. The other thing I see
are sendmail errors like:

Jul 28 00:12:11 nrz83 sendmail-in[15816]: i6RMC6WY015816:
from=<ygcpdqby at seznam.cz>, size=1256, class=0, nrcpts=1,
msgid=<149225241151.221670S94N17c6 at seznam.cz>, proto=SMTP, daemon=MTA,
relay=200-161-150-211.dsl.telesp.net.br [200.161.150.211]
Jul 28 00:12:11 nrz83 sendmail-in[15816]: i6RMC6WY015816:
to=<info at xxxxxx.de>, delay=00:00:02, mailer=smtp, pri=30533, stat=queued
Jul 28 00:12:12 nrz83 MailScanner[29763]: RBL checks: i6RMC6WY015816 found
in spamcop.net
Jul 28 00:12:14 nrz83 MailScanner[29763]: Message i6RMC6WY015816 from
200.161.150.211 (ygcpdqby at seznam.cz) to ancofer.de is spam, spamcop.net,
SpamAssassin (Wertung=6.288, benoetigt 5, BAYES_80 1.66,
DATE_IN_FUTURE_03_06 1.93, FORGED_TELESP_RCVD 2.70)
Jul 28 00:12:14 nrz83 MailScanner[29763]: Spam Actions: message
i6RMC6WY015816 actions are bounce,deliver,striphtml
Jul 28 00:12:15 nrz83 MailScanner[5171]: RBL checks: i6RMC6WY015816 found in
spamcop.net
Jul 28 00:12:16 nrz83 MailScanner[5171]: Message i6RMC6WY015816 from
200.161.150.211 (ygcpdqby at seznam.cz) to ancofer.de is spam, spamcop.net,
SpamAssassin (Wertung=6.288, benoetigt 5, BAYES_80 1.66,
DATE_IN_FUTURE_03_06 1.93, FORGED_TELESP_RCVD 2.70)
Jul 28 00:12:16 nrz83 MailScanner[5171]: Spam Actions: message
i6RMC6WY015816 actions are bounce,deliver,striphtml
Jul 28 00:12:18 nrz83 MailScanner[29763]: Filetype Checks: Allowing
i6RMC6WY015816 msg-29763-80.txt
Jul 28 00:12:18 nrz83 sendmail[15844]: i6RMC6WY015816: to=<info at xxxxxx.de>,
delay=00:00:09, xdelay=00:00:00, mailer=smtp, pri=120533,
relay=[222.222.222.222] [222.222.222.222], dsn=2.0.0, stat=Sent (Ok)
Jul 28 00:12:20 nrz83 MailScanner[5171]: Filetype Checks: Allowing
i6RMC6WY015816 msg-5171-60.txt
Jul 28 00:12:20 nrz83 sendmail[15848]: i6RMC6WY015816: SYSERR(root): readqf:
cannot open ./dfi6RMC6WY015816: No such file or directory
Jul 28 00:12:20 nrz83 sendmail[15848]: i6RMC6WY015816: to=<info at xxxxxx.de>,
delay=00:00:11, xdelay=00:00:00, mailer=smtp, pri=120533,
relay=[222.222.222.222] [222.222.222.222], dsn=2.0.0, stat=Sent (Ok)

680 yesterday of this..

Well, it looks like that 2 Mailscanner are starting for the same file, both
scans the file, and one sends it to sendmail outgoing queue. After that the
second ends and want also to send the file, but it´s not there anymore ..

I thinkt those two erros have something common ??? I checked permissions and
so on, but no luck. Any hints how to go further.. Debuging ?? 


mfg

Roman Petry
AG der Dillinger Huettenwerke
ITS-IT
Tel. +49-6831-474670

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html