Virus epidemic, 11,000 messages waiting!

[Robin, Rob]

If you are using sendmail, you can also use qtool.pl. It should come w/ the source of the sendmail. If memory serves me correct, under its contrib dir.

'qtool.pl' I believe will use the flock by def if it detects it's available.

Try something along the line of:

/path/to/qtool.pl -e '$msg{recipient} =~ /recipient-blah.com/' /var/spool/mailbackup/ /var/spool/mqueue.in/

This will only move it to another dir :-)....


------------------------
Rob Robin
Network Analyst
Green Apple, Inc.
740-653-9890
rrobin at greenapple.com
www.greenapple.com
Internet access, hosting and development solutions since 1995.

-----Original Message-----
From: Max Kipness [mailto:mkipness at GENIANT.COM] 
Sent: Tuesday, June 15, 2004 5:09 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Virus epidemic, 11,000 messages waiting!


Hi,

I have a client that has been is being hit by 10000 plus emails with zafi in them. He told me that he was not receiving email, so I looked at his log and saw that 11,000 emails are ready to be processed.

It seems like all the emails are sent to one person, so I've gut that user account off in /etc/access which is working fine.

I have to question though.

1) I thought that all messages waiting to be processed were in /var/spool/MailScanner/incoming in the various subdirectories. I had a script that counted the messages there on one of my servers. However on this server, only 150 are in there. Where are the other 11,000? The last lines I see in the log say: New Batch: Found 11.000 messagins waiting.

2) Does anyone have a script would find email from this certain person and delete? Or is there anyway not to have MailScanner process at this point?

Thanks,
Max
-------------------------- MailScanner list ----------------------
To leave, send leave mailscanner to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/ and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html