Few questions

[Peter Kruit]

Hello,

I have a few questions. I've been running MailScanner for about two weeks
on our production servers. This included one server doing spam filtering
and two servers doing virus scanning. My questions are related to the mail
server doing the spam filtering.

I'm running with MailScanner v4.26.8 and Spamassassin v2.63 on a HP-UX 11i
OS. I have manualy upgraded SA.pm to that of MailScanner v4.27.7.

Question 1: Bayes rebuild
-------------------------

I've set the following options in the MailScanner.conf file:

Rebuild Bayes Every = 86400
Wait During Bayes Rebuild = no

At some point a MailScanner process reports the following:

May 10 12:36:45 x MailScanner[19132]: MailScanner E-Mail Virus Scanner
version 4.26.8 starting...
May 10 12:36:46 x MailScanner[19132]: Bayes database rebuild is due
May 10 12:36:48 x MailScanner[19132]: SpamAssassin Bayes database rebuild
preparing
May 10 12:36:48 x MailScanner[19132]: SpamAssassin Bayes database rebuild
starting

The process doesn't log anything after this. The bayes DB isn't rebuild
either:

-rw-------   1 root       root    137586 May 11 14:04 bayes_journal
-rw-------   1 root       root   2637824 May 11 14:04 bayes_seen
-rw-------   1 root       root   9986048 May 11 14:04 bayes_toks

When I rebuild the Bayes DB manualy all goes well.

Why isn't MailScanner doing this?

Question 2: Virus and Content Scanning
--------------------------------------

I've set the following options in the MailScanner.conf file:

Virus Scanning = no

The log file however still shows:

May 11 14:11:09 x MailScanner[4038]: Virus and Content Scanning: Starting

Is this normal? I don't want the server to do any virus scanning, only spam
filtering.

Question 3: Random time-outs
----------------------------

This is somewhat hard to explain. But it looks like I'm having random
Spamassassin time-outs. At first it looked like a DNS problem. The DNS time-
out values on a non existing domain were higher then the Spamassassin time-
out in MailScanner.conf.

The /etc/resolv.conf file:

search x
nameserver x
nameserver x
retrans 5
retry 2

About an hour after changing this I got a new Spamassassin time-out. This
time, from and to a resolving domain, the only difference was that the
sender was sending a bulk of 850+ messages.

The log files show the following:

May 11 12:03:53 x MailScanner[13679]: SpamAssassin timed out and was
killed, consecutive failure 1 of 20
May 11 12:03:59 x MailScanner[13679]: Message i4BA1N625668 from x (x) to x
is not spam, SpamAssassin (timed out)
May 11 12:04:59 x MailScanner[13679]: SpamAssassin timed out and was
killed, consecutive failure 2 of 20
May 11 12:05:00 x MailScanner[13679]: Message i4BA1N625669 from x (x) to x
is not spam, SpamAssassin (timed out)

This continues until it randomly decides to not time-out anymore.

The change to the resolv.conf file caused sendmail to time-out on DNS
queries and reject e-mail. After rolling back to the old situation and
setting dns_available to no in spam.assassin.prefs.conf the time-outs
stayed:

May 11 15:12:05 x MailScanner[20795]: SpamAssassin timed out and was
killed, consecutive failure 1 of 20
May 11 15:12:06 x MailScanner[20795]: Message i4BDA1C22897 from x (x) to x
is not spam, SpamAssassin (timed out)

This also randomly stops.

So, is this a DNS problem? Or do I need to look elsewhere. Debugging
doesn't help either, because time-out are random? Or is there a way to
relate the time-outs to something else?

Any suggestions are welcome.

Thanks,

Peter Kruit

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html