Mails Stuck in mqueue.in?

[Mike Kercher]

I've been seeing this behavior on just one of my MS boxes.  Periodically,
the same emails get scanned over and over and over.  They are always HS Spam
and my HS Spam action is delete.  For some reason they just never get
removed from mqueue.in:

Jun  9 08:24:27 mail MailScanner[26638]: Spam Checks: Found 5 spam messages 
Jun  9 08:24:27 mail MailScanner[26638]: Spam Actions: message
j59Cwocq031622 actions are delete 
Jun  9 08:24:27 mail MailScanner[26638]: Spam Actions: message
j59CVtDm027874 actions are delete 
Jun  9 08:24:27 mail MailScanner[26638]: Spam Actions: message
j59D9tYw001212 actions are delete 
Jun  9 08:24:27 mail MailScanner[26638]: Spam Actions: message
j59DBqsG001578 actions are delete 
Jun  9 08:24:27 mail MailScanner[26638]: Spam Actions: message
j59CMh4H026742 actions are delete 
Jun  9 08:24:30 mail sendmail[4515]: ruleset=check_relay,
arg1=[220.81.231.67], arg2=220.81.231.67, relay=[220.81.231.67], reject=550
5.7.1 Use your ISP SMTP server or fix reverse DNS for 220.81.231.67

Jun  9 08:24:30 mail MailScanner[26647]: Message j59DBqsG001578 from
84.94.56.60 (tremendous at 012.net.il) to abby.com is spam, SpamAssassin
(score=26.731, required 5.7, BAYES_99 3.50, DNS_FROM_RFC_POST 1.61,
DNS_FROM_RFC_WHOIS 0.30, HELO_DYNAMIC_HCC 3.74, HELO_DYNAMIC_IPADDR2 3.50,
HELO_DYNAMIC_SPLIT_IP 0.78, HTML_40_50 0.04, HTML_IMAGE_ONLY_08 3.04,
HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.18, MIME_QP_LONG_LINE 0.04,
RAZOR2_CF_RANGE_51_100 0.06, RAZOR2_CHECK 1.51, RCVD_BY_IP 0.07,
RCVD_IN_SORBS_DUL 1.99, RCVD_NUMERIC_HELO 1.25, UNIQUE_WORDS 2.27,
URIBL_AB_SURBL 0.42, URIBL_JP_SURBL 2.46) 

Jun  9 08:24:32 mail MailScanner[26611]: Message j59Cwoco031622 from
151.44.27.164 (ihvcds at gmail.com) to abby.com is spam, SpamAssassin
(score=13.356, required 5.7, BAYES_95 3.00, DCC_CHECK 2.17, DIGEST_MULTIPLE
0.10, PYZOR_CHECK 3.45, RAZOR2_CF_RANGE_51_100 0.06, RAZOR2_CHECK 1.51,
RCVD_IN_NJABL_DUL 0.09, RCVD_IN_SORBS_DUL 1.99, URIBL_SBL 1.00) 

Jun  9 08:24:32 mail MailScanner[26638]: Virus and Content Scanning:
Starting 
Jun  9 08:24:34 mail MailScanner[26647]: Message j59CMh4H026742 from
81.213.179.179 (identdep_op4464380012 at charteronebank.com) to abby.com is
spam, SpamAssassin (score=15.942, required 5.7, AWL 0.00, BAYES_95 3.00,
FROM_HAS_ULINE_NUMS 0.06, HTML_80_90 0.15, HTML_FONT_LOW_CONTRAST 0.79,
HTML_IMAGE_ONLY_08 3.04, HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.18,
MSGID_FROM_MTA_ID 1.72, NORMAL_HTTP_TO_IP 0.03, RAZOR2_CF_RANGE_51_100 0.06,
RAZOR2_CHECK 1.51, RCVD_HELO_IP_MISMATCH 2.18, RCVD_IN_SORBS_DUL 1.99,
RCVD_IN_SORBS_WEB 0.01, RCVD_NUMERIC_HELO 1.25) 

Jun  9 08:24:35 mail MailScanner[26611]: Message j59Cwocn031622 from
151.44.27.164 (ebvlnhnytdc at gmail.com) to abby.com is spam, SpamAssassin
(score=13.808, required 5.7, AWL -0.05, BAYES_99 3.50, DCC_CHECK 2.17,
DIGEST_MULTIPLE 0.10, PYZOR_CHECK 3.45, RAZOR2_CF_RANGE_51_100 0.06,
RAZOR2_CHECK 1.51, RCVD_IN_NJABL_DUL 0.09, RCVD_IN_SORBS_DUL 1.99, URIBL_SBL
1.00) 
Jun  9 08:24:36 mail MailScanner[26647]: Spam Checks: Found 5 spam messages 
Jun  9 08:24:36 mail MailScanner[26647]: Spam Actions: message
j59Cwocq031622 actions are delete 
Jun  9 08:24:36 mail MailScanner[26647]: Spam Actions: message
j59CVtDm027874 actions are delete 
Jun  9 08:24:36 mail MailScanner[26647]: Spam Actions: message
j59D9tYw001212 actions are delete 
Jun  9 08:24:36 mail MailScanner[26647]: Spam Actions: message
j59DBqsG001578 actions are delete 
Jun  9 08:24:36 mail MailScanner[26647]: Spam Actions: message
j59CMh4H026742 actions are delete 
Jun  9 08:24:39 mail MailScanner[26611]: Message j59CMh4H026742 from
81.213.179.179 (identdep_op4464380012 at charteronebank.com) to abby.com is
spam, SpamAssassin (score=15.942, required 5.7, BAYES_95 3.00,
FROM_HAS_ULINE_NUMS 0.06, HTML_80_90 0.15, HTML_FONT_LOW_CONTRAST 0.79,
HTML_IMAGE_ONLY_08 3.04, HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.18,
MSGID_FROM_MTA_ID 1.72, NORMAL_HTTP_TO_IP 0.03, RAZOR2_CF_RANGE_51_100 0.06,
RAZOR2_CHECK 1.51, RCVD_HELO_IP_MISMATCH 2.18, RCVD_IN_SORBS_DUL 1.99,
RCVD_IN_SORBS_WEB 0.01, RCVD_NUMERIC_HELO 1.25) 

Jun  9 08:24:39 mail MailScanner[26611]: Spam Checks: Found 6 spam messages 
Jun  9 08:24:39 mail MailScanner[26611]: Spam Actions: message
j59DBqsD001578 actions are delete 
Jun  9 08:24:39 mail MailScanner[26611]: Spam Actions: message
j59DBqsA001578 actions are delete 
Jun  9 08:24:39 mail MailScanner[26611]: Spam Actions: message
j59DBqsC001578 actions are delete 
Jun  9 08:24:39 mail MailScanner[26611]: Spam Actions: message
j59Cwoco031622 actions are delete 
Jun  9 08:24:39 mail MailScanner[26611]: Spam Actions: message
j59Cwocn031622 actions are delete 
Jun  9 08:24:39 mail MailScanner[26611]: Spam Actions: message
j59CMh4H026742 actions are delete 

These end up driving the load on the machine to over 5.x and the box starts
to crawl.  I'm using MS 4.41.3-1, SA+sql, Sendmail-8.13.4, sophossavi and
clamavmodule.  OS is RHEL 3U4.  Any thoughts?

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!