scanning mail over and over

[Julian Field]

<x-flowed>
Go into debug mode and see what it is saying. Kill all your MailScanner
processes, set
         Debug = yes
         Debug SpamAssassin = yes
in MailScanner.conf, and run check_mailscanner. I suspect it will print an
error message.

At 18:48 25/10/2004, you wrote:
>I am trying to setup an email server that uses Mailscanner but I'm
>having a bit of a problem.
>I am using:
>Postfix 2.0.18
>ClamAV v0.80
>Mailscanner v4.34.8
>it's running on Trustix 2.1
>
>For the most part the system seems to be working.  I sent test infected
>messages to it and it caught most of them.
>But, mailscanner has been scanning some of the same messages over and
>over again without any action being taken.
>Here is a snippet from  /var/log/mail/info
>
>Oct 25 08:27:26 moon MailScanner[30061]: New Batch: Scanning 14
>messages, 44308 bytes
>Oct 25 08:27:30 moon MailScanner[30094]: MailScanner E-Mail Virus
>Scanner version 4.34.8 starting...
>Oct 25 08:27:30 moon MailScanner[30061]: Virus and Content Scanning:
>Starting
>Oct 25 08:27:31 moon MailScanner[30094]: Using locktype = flock
>Oct 25 08:27:33 moon MailScanner[30061]: Filename Checks: Windows/DOS
>Executable (25940108FBB eicar.com)
>Oct 25 08:27:33 moon MailScanner[30061]: Other Checks: Found 1 problems
>Oct 25 08:27:36 moon MailScanner[30094]: New Batch: Scanning 14
>messages, 44308 bytes
>Oct 25 08:27:40 moon MailScanner[30094]: Virus and Content Scanning:
>Starting
>Oct 25 08:27:40 moon MailScanner[30134]: MailScanner E-Mail Virus
>Scanner version 4.34.8 starting...
>Oct 25 08:27:41 moon MailScanner[30134]: Using locktype = flock
>Oct 25 08:27:43 moon MailScanner[30094]: Filename Checks: Windows/DOS
>Executable (25940108FBB eicar.com)
>Oct 25 08:27:43 moon MailScanner[30094]: Other Checks: Found 1 problems
>Oct 25 08:27:46 moon MailScanner[30134]: New Batch: Scanning 14
>messages, 44308 bytes
>Oct 25 08:27:50 moon MailScanner[30134]: Virus and Content Scanning:
>Starting
>Oct 25 08:27:50 moon MailScanner[30166]: MailScanner E-Mail Virus
>Scanner version 4.34.8 starting...
>Oct 25 08:27:51 moon MailScanner[30166]: Using locktype = flock
>Oct 25 08:27:53 moon MailScanner[30134]: Filename Checks: Windows/DOS
>Executable (25940108FBB eicar.com)
>Oct 25 08:27:53 moon MailScanner[30134]: Other Checks: Found 1 problems
>Oct 25 08:27:56 moon MailScanner[30166]: New Batch: Scanning 14
>messages, 44308 bytes
>Oct 25 08:28:00 moon MailScanner[30201]: MailScanner E-Mail Virus
>Scanner version 4.34.8 starting...
>Oct 25 08:28:00 moon MailScanner[30166]: Virus and Content Scanning:
>Starting
>Oct 25 08:28:01 moon MailScanner[30201]: Using locktype = flock
>Oct 25 08:28:03 moon MailScanner[30166]: Filename Checks: Windows/DOS
>Executable (25940108FBB eicar.com)
>Oct 25 08:28:03 moon MailScanner[30166]: Other Checks: Found 1 problems
>
>Any clues? Does anyone have any tips for running Mailscanner on Trustix 2.1?
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>