scanning mail over and over

Joseph Wagner wagner at MILLER-ENGINEERING.COM
Mon Oct 25 20:16:54 IST 2004


<x-flowed>
I ran MailScanner in debug mode and I received no error message.
I also, tried changing file locking from flock to posix and that made no
difference.
It still looks like multiple child processes are picking the messages up.
Oh, and yes I restarted MailScanner after making changes to the config file.





Julian Field wrote:

> Go into debug mode and see what it is saying. Kill all your MailScanner
> processes, set
>         Debug = yes
>         Debug SpamAssassin = yes
> in MailScanner.conf, and run check_mailscanner. I suspect it will
> print an
> error message.
>
> At 18:48 25/10/2004, you wrote:
>
>> I am trying to setup an email server that uses Mailscanner but I'm
>> having a bit of a problem.
>> I am using:
>> Postfix 2.0.18
>> ClamAV v0.80
>> Mailscanner v4.34.8
>> it's running on Trustix 2.1
>>
>> For the most part the system seems to be working.  I sent test infected
>> messages to it and it caught most of them.
>> But, mailscanner has been scanning some of the same messages over and
>> over again without any action being taken.
>> Here is a snippet from  /var/log/mail/info
>>
>> Oct 25 08:27:26 moon MailScanner[30061]: New Batch: Scanning 14
>> messages, 44308 bytes
>> Oct 25 08:27:30 moon MailScanner[30094]: MailScanner E-Mail Virus
>> Scanner version 4.34.8 starting...
>> Oct 25 08:27:30 moon MailScanner[30061]: Virus and Content Scanning:
>> Starting
>> Oct 25 08:27:31 moon MailScanner[30094]: Using locktype = flock
>> Oct 25 08:27:33 moon MailScanner[30061]: Filename Checks: Windows/DOS
>> Executable (25940108FBB eicar.com)
>> Oct 25 08:27:33 moon MailScanner[30061]: Other Checks: Found 1 problems
>> Oct 25 08:27:36 moon MailScanner[30094]: New Batch: Scanning 14
>> messages, 44308 bytes
>> Oct 25 08:27:40 moon MailScanner[30094]: Virus and Content Scanning:
>> Starting
>> Oct 25 08:27:40 moon MailScanner[30134]: MailScanner E-Mail Virus
>> Scanner version 4.34.8 starting...
>> Oct 25 08:27:41 moon MailScanner[30134]: Using locktype = flock
>> Oct 25 08:27:43 moon MailScanner[30094]: Filename Checks: Windows/DOS
>> Executable (25940108FBB eicar.com)
>> Oct 25 08:27:43 moon MailScanner[30094]: Other Checks: Found 1 problems
>> Oct 25 08:27:46 moon MailScanner[30134]: New Batch: Scanning 14
>> messages, 44308 bytes
>> Oct 25 08:27:50 moon MailScanner[30134]: Virus and Content Scanning:
>> Starting
>> Oct 25 08:27:50 moon MailScanner[30166]: MailScanner E-Mail Virus
>> Scanner version 4.34.8 starting...
>> Oct 25 08:27:51 moon MailScanner[30166]: Using locktype = flock
>> Oct 25 08:27:53 moon MailScanner[30134]: Filename Checks: Windows/DOS
>> Executable (25940108FBB eicar.com)
>> Oct 25 08:27:53 moon MailScanner[30134]: Other Checks: Found 1 problems
>> Oct 25 08:27:56 moon MailScanner[30166]: New Batch: Scanning 14
>> messages, 44308 bytes
>> Oct 25 08:28:00 moon MailScanner[30201]: MailScanner E-Mail Virus
>> Scanner version 4.34.8 starting...
>> Oct 25 08:28:00 moon MailScanner[30166]: Virus and Content Scanning:
>> Starting
>> Oct 25 08:28:01 moon MailScanner[30201]: Using locktype = flock
>> Oct 25 08:28:03 moon MailScanner[30166]: Filename Checks: Windows/DOS
>> Executable (25940108FBB eicar.com)
>> Oct 25 08:28:03 moon MailScanner[30166]: Other Checks: Found 1 problems
>>
>> Any clues? Does anyone have any tips for running Mailscanner on
>> Trustix 2.1?
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>



More information about the MailScanner mailing list