Virus epidemic, 11,000 messages waiting!

[Derek Winkler]

/var/spool/MailScanner/incoming has a subdirectory for each child, and this
directory contains the messages that the child process is working on. Your
batch size is probably 150. Right after that you should have seen Scanning
150 messages.

In sendmail...

grep RPFD: whoever at whatever.com <mailto:whoever at whatever.com>  qf*

Delete the qf file and it's corresponding df and the other files that
sendmail uses or *<msg id>. Easy enough to script.

If there is a large number of files in the directory wrap the grep in a
find:

find ./ -name "qf*" -exec grep RPFD: whoever at whatever.com
<mailto:whoever at whatever.com>  {} \;

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On Behalf
Of Max Kipness
Sent: Tuesday, June 15, 2004 5:09 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Virus epidemic, 11,000 messages waiting!



Hi,

I have a client that has been is being hit by 10000 plus emails with zafi in
them. He told me that he was not receiving email, so I looked at his log and
saw that 11,000 emails are ready to be processed.

It seems like all the emails are sent to one person, so I've gut that user
account off in /etc/access which is working fine.

I have to question though.

1) I thought that all messages waiting to be processed were in
/var/spool/MailScanner/incoming in the various subdirectories. I had a
script that counted the messages there on one of my servers. However on this
server, only 150 are in there. Where are the other 11,000? The last lines I
see in the log say: New Batch: Found 11.000 messagins waiting.

2) Does anyone have a script would find email from this certain person and
delete? Or is there anyway not to have MailScanner process at this point?



-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20040615/75d47887/attachment.html