Mails Stuck in mqueue.in?

Julian Field MailScanner at ecs.soton.ac.uk
Thu Jun 9 14:45:44 IST 2005 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Run MailScanner on them in debug mode. You may find it is crashing  
when it tries to remove them, and then gets re-spawned so scans them  
again.

On 9 Jun 2005, at 14:30, Mike Kercher wrote:

> I've been seeing this behavior on just one of my MS boxes.   
> Periodically,
> the same emails get scanned over and over and over.  They are  
> always HS Spam
> and my HS Spam action is delete.  For some reason they just never get
> removed from mqueue.in:
>
> Jun  9 08:24:27 mail MailScanner[26638]: Spam Checks: Found 5 spam  
> messages
> Jun  9 08:24:27 mail MailScanner[26638]: Spam Actions: message
> j59Cwocq031622 actions are delete
> Jun  9 08:24:27 mail MailScanner[26638]: Spam Actions: message
> j59CVtDm027874 actions are delete
> Jun  9 08:24:27 mail MailScanner[26638]: Spam Actions: message
> j59D9tYw001212 actions are delete
> Jun  9 08:24:27 mail MailScanner[26638]: Spam Actions: message
> j59DBqsG001578 actions are delete
> Jun  9 08:24:27 mail MailScanner[26638]: Spam Actions: message
> j59CMh4H026742 actions are delete
> Jun  9 08:24:30 mail sendmail[4515]: ruleset=check_relay,
> arg1=[220.81.231.67], arg2=220.81.231.67, relay=[220.81.231.67],  
> reject=550
> 5.7.1 Use your ISP SMTP server or fix reverse DNS for 220.81.231.67
>
> Jun  9 08:24:30 mail MailScanner[26647]: Message j59DBqsG001578 from
> 84.94.56.60 (tremendous at 012.net.il) to abby.com is spam, SpamAssassin
> (score=26.731, required 5.7, BAYES_99 3.50, DNS_FROM_RFC_POST 1.61,
> DNS_FROM_RFC_WHOIS 0.30, HELO_DYNAMIC_HCC 3.74,  
> HELO_DYNAMIC_IPADDR2 3.50,
> HELO_DYNAMIC_SPLIT_IP 0.78, HTML_40_50 0.04, HTML_IMAGE_ONLY_08 3.04,
> HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.18, MIME_QP_LONG_LINE 0.04,
> RAZOR2_CF_RANGE_51_100 0.06, RAZOR2_CHECK 1.51, RCVD_BY_IP 0.07,
> RCVD_IN_SORBS_DUL 1.99, RCVD_NUMERIC_HELO 1.25, UNIQUE_WORDS 2.27,
> URIBL_AB_SURBL 0.42, URIBL_JP_SURBL 2.46)
>
> Jun  9 08:24:32 mail MailScanner[26611]: Message j59Cwoco031622 from
> 151.44.27.164 (ihvcds at gmail.com) to abby.com is spam, SpamAssassin
> (score=13.356, required 5.7, BAYES_95 3.00, DCC_CHECK 2.17,  
> DIGEST_MULTIPLE
> 0.10, PYZOR_CHECK 3.45, RAZOR2_CF_RANGE_51_100 0.06, RAZOR2_CHECK  
> 1.51,
> RCVD_IN_NJABL_DUL 0.09, RCVD_IN_SORBS_DUL 1.99, URIBL_SBL 1.00)
>
> Jun  9 08:24:32 mail MailScanner[26638]: Virus and Content Scanning:
> Starting
> Jun  9 08:24:34 mail MailScanner[26647]: Message j59CMh4H026742 from
> 81.213.179.179 (identdep_op4464380012 at charteronebank.com) to  
> abby.com is
> spam, SpamAssassin (score=15.942, required 5.7, AWL 0.00, BAYES_95  
> 3.00,
> FROM_HAS_ULINE_NUMS 0.06, HTML_80_90 0.15, HTML_FONT_LOW_CONTRAST  
> 0.79,
> HTML_IMAGE_ONLY_08 3.04, HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.18,
> MSGID_FROM_MTA_ID 1.72, NORMAL_HTTP_TO_IP 0.03,  
> RAZOR2_CF_RANGE_51_100 0.06,
> RAZOR2_CHECK 1.51, RCVD_HELO_IP_MISMATCH 2.18, RCVD_IN_SORBS_DUL 1.99,
> RCVD_IN_SORBS_WEB 0.01, RCVD_NUMERIC_HELO 1.25)
>
> Jun  9 08:24:35 mail MailScanner[26611]: Message j59Cwocn031622 from
> 151.44.27.164 (ebvlnhnytdc at gmail.com) to abby.com is spam,  
> SpamAssassin
> (score=13.808, required 5.7, AWL -0.05, BAYES_99 3.50, DCC_CHECK 2.17,
> DIGEST_MULTIPLE 0.10, PYZOR_CHECK 3.45, RAZOR2_CF_RANGE_51_100 0.06,
> RAZOR2_CHECK 1.51, RCVD_IN_NJABL_DUL 0.09, RCVD_IN_SORBS_DUL 1.99,  
> URIBL_SBL
> 1.00)
> Jun  9 08:24:36 mail MailScanner[26647]: Spam Checks: Found 5 spam  
> messages
> Jun  9 08:24:36 mail MailScanner[26647]: Spam Actions: message
> j59Cwocq031622 actions are delete
> Jun  9 08:24:36 mail MailScanner[26647]: Spam Actions: message
> j59CVtDm027874 actions are delete
> Jun  9 08:24:36 mail MailScanner[26647]: Spam Actions: message
> j59D9tYw001212 actions are delete
> Jun  9 08:24:36 mail MailScanner[26647]: Spam Actions: message
> j59DBqsG001578 actions are delete
> Jun  9 08:24:36 mail MailScanner[26647]: Spam Actions: message
> j59CMh4H026742 actions are delete
> Jun  9 08:24:39 mail MailScanner[26611]: Message j59CMh4H026742 from
> 81.213.179.179 (identdep_op4464380012 at charteronebank.com) to  
> abby.com is
> spam, SpamAssassin (score=15.942, required 5.7, BAYES_95 3.00,
> FROM_HAS_ULINE_NUMS 0.06, HTML_80_90 0.15, HTML_FONT_LOW_CONTRAST  
> 0.79,
> HTML_IMAGE_ONLY_08 3.04, HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.18,
> MSGID_FROM_MTA_ID 1.72, NORMAL_HTTP_TO_IP 0.03,  
> RAZOR2_CF_RANGE_51_100 0.06,
> RAZOR2_CHECK 1.51, RCVD_HELO_IP_MISMATCH 2.18, RCVD_IN_SORBS_DUL 1.99,
> RCVD_IN_SORBS_WEB 0.01, RCVD_NUMERIC_HELO 1.25)
>
> Jun  9 08:24:39 mail MailScanner[26611]: Spam Checks: Found 6 spam  
> messages
> Jun  9 08:24:39 mail MailScanner[26611]: Spam Actions: message
> j59DBqsD001578 actions are delete
> Jun  9 08:24:39 mail MailScanner[26611]: Spam Actions: message
> j59DBqsA001578 actions are delete
> Jun  9 08:24:39 mail MailScanner[26611]: Spam Actions: message
> j59DBqsC001578 actions are delete
> Jun  9 08:24:39 mail MailScanner[26611]: Spam Actions: message
> j59Cwoco031622 actions are delete
> Jun  9 08:24:39 mail MailScanner[26611]: Spam Actions: message
> j59Cwocn031622 actions are delete
> Jun  9 08:24:39 mail MailScanner[26611]: Spam Actions: message
> j59CMh4H026742 actions are delete
>
> These end up driving the load on the machine to over 5.x and the  
> box starts
> to crawl.  I'm using MS 4.41.3-1, SA+sql, Sendmail-8.13.4,  
> sophossavi and
> clamavmodule.  OS is RHEL 3U4.  Any thoughts?
>
> Mike
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>

- -- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.1 (Build 2185)

iQA/AwUBQqhICxH2WUcUFbZUEQJemACdEcgAof7VsH8MEyxS5wb50J0ISMgAoKte
YuugM3sBnGAhB7uKwWFa4ker
=eME8
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

More information about the MailScanner mailing list