Mails Stuck in mqueue.in?
Scott Silva
ssilva at SGVWATER.COM
Thu Jun 9 17:16:59 IST 2005
[ The following text is in the "ISO-8859-1" character set. ]
[ Your display is set for the "US-ASCII" character set. ]
[ Some characters may be displayed incorrectly. ]
Mike Kercher wrote:
> I've been seeing this behavior on just one of my MS boxes. Periodically,
> the same emails get scanned over and over and over. They are always HS Spam
> and my HS Spam action is delete. For some reason they just never get
> removed from mqueue.in:
>
> Jun 9 08:24:27 mail MailScanner[26638]: Spam Checks: Found 5 spam messages
> Jun 9 08:24:27 mail MailScanner[26638]: Spam Actions: message
> j59Cwocq031622 actions are delete
> Jun 9 08:24:27 mail MailScanner[26638]: Spam Actions: message
> j59CVtDm027874 actions are delete
> Jun 9 08:24:27 mail MailScanner[26638]: Spam Actions: message
> j59D9tYw001212 actions are delete
> Jun 9 08:24:27 mail MailScanner[26638]: Spam Actions: message
> j59DBqsG001578 actions are delete
> Jun 9 08:24:27 mail MailScanner[26638]: Spam Actions: message
> j59CMh4H026742 actions are delete
> Jun 9 08:24:30 mail sendmail[4515]: ruleset=check_relay,
> arg1=[220.81.231.67], arg2=220.81.231.67, relay=[220.81.231.67], reject=550
> 5.7.1 Use your ISP SMTP server or fix reverse DNS for 220.81.231.67
>
> Jun 9 08:24:30 mail MailScanner[26647]: Message j59DBqsG001578 from
> 84.94.56.60 (tremendous at 012.net.il) to abby.com is spam, SpamAssassin
> (score=26.731, required 5.7, BAYES_99 3.50, DNS_FROM_RFC_POST 1.61,
> DNS_FROM_RFC_WHOIS 0.30, HELO_DYNAMIC_HCC 3.74, HELO_DYNAMIC_IPADDR2 3.50,
> HELO_DYNAMIC_SPLIT_IP 0.78, HTML_40_50 0.04, HTML_IMAGE_ONLY_08 3.04,
> HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.18, MIME_QP_LONG_LINE 0.04,
> RAZOR2_CF_RANGE_51_100 0.06, RAZOR2_CHECK 1.51, RCVD_BY_IP 0.07,
> RCVD_IN_SORBS_DUL 1.99, RCVD_NUMERIC_HELO 1.25, UNIQUE_WORDS 2.27,
> URIBL_AB_SURBL 0.42, URIBL_JP_SURBL 2.46)
>
> Jun 9 08:24:32 mail MailScanner[26611]: Message j59Cwoco031622 from
> 151.44.27.164 (ihvcds at gmail.com) to abby.com is spam, SpamAssassin
> (score=13.356, required 5.7, BAYES_95 3.00, DCC_CHECK 2.17, DIGEST_MULTIPLE
> 0.10, PYZOR_CHECK 3.45, RAZOR2_CF_RANGE_51_100 0.06, RAZOR2_CHECK 1.51,
> RCVD_IN_NJABL_DUL 0.09, RCVD_IN_SORBS_DUL 1.99, URIBL_SBL 1.00)
>
> Jun 9 08:24:32 mail MailScanner[26638]: Virus and Content Scanning:
> Starting
> Jun 9 08:24:34 mail MailScanner[26647]: Message j59CMh4H026742 from
> 81.213.179.179 (identdep_op4464380012 at charteronebank.com) to abby.com is
> spam, SpamAssassin (score=15.942, required 5.7, AWL 0.00, BAYES_95 3.00,
> FROM_HAS_ULINE_NUMS 0.06, HTML_80_90 0.15, HTML_FONT_LOW_CONTRAST 0.79,
> HTML_IMAGE_ONLY_08 3.04, HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.18,
> MSGID_FROM_MTA_ID 1.72, NORMAL_HTTP_TO_IP 0.03, RAZOR2_CF_RANGE_51_100 0.06,
> RAZOR2_CHECK 1.51, RCVD_HELO_IP_MISMATCH 2.18, RCVD_IN_SORBS_DUL 1.99,
> RCVD_IN_SORBS_WEB 0.01, RCVD_NUMERIC_HELO 1.25)
>
> Jun 9 08:24:35 mail MailScanner[26611]: Message j59Cwocn031622 from
> 151.44.27.164 (ebvlnhnytdc at gmail.com) to abby.com is spam, SpamAssassin
> (score=13.808, required 5.7, AWL -0.05, BAYES_99 3.50, DCC_CHECK 2.17,
> DIGEST_MULTIPLE 0.10, PYZOR_CHECK 3.45, RAZOR2_CF_RANGE_51_100 0.06,
> RAZOR2_CHECK 1.51, RCVD_IN_NJABL_DUL 0.09, RCVD_IN_SORBS_DUL 1.99, URIBL_SBL
> 1.00)
> Jun 9 08:24:36 mail MailScanner[26647]: Spam Checks: Found 5 spam messages
> Jun 9 08:24:36 mail MailScanner[26647]: Spam Actions: message
> j59Cwocq031622 actions are delete
> Jun 9 08:24:36 mail MailScanner[26647]: Spam Actions: message
> j59CVtDm027874 actions are delete
> Jun 9 08:24:36 mail MailScanner[26647]: Spam Actions: message
> j59D9tYw001212 actions are delete
> Jun 9 08:24:36 mail MailScanner[26647]: Spam Actions: message
> j59DBqsG001578 actions are delete
> Jun 9 08:24:36 mail MailScanner[26647]: Spam Actions: message
> j59CMh4H026742 actions are delete
> Jun 9 08:24:39 mail MailScanner[26611]: Message j59CMh4H026742 from
> 81.213.179.179 (identdep_op4464380012 at charteronebank.com) to abby.com is
> spam, SpamAssassin (score=15.942, required 5.7, BAYES_95 3.00,
> FROM_HAS_ULINE_NUMS 0.06, HTML_80_90 0.15, HTML_FONT_LOW_CONTRAST 0.79,
> HTML_IMAGE_ONLY_08 3.04, HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.18,
> MSGID_FROM_MTA_ID 1.72, NORMAL_HTTP_TO_IP 0.03, RAZOR2_CF_RANGE_51_100 0.06,
> RAZOR2_CHECK 1.51, RCVD_HELO_IP_MISMATCH 2.18, RCVD_IN_SORBS_DUL 1.99,
> RCVD_IN_SORBS_WEB 0.01, RCVD_NUMERIC_HELO 1.25)
>
> Jun 9 08:24:39 mail MailScanner[26611]: Spam Checks: Found 6 spam messages
> Jun 9 08:24:39 mail MailScanner[26611]: Spam Actions: message
> j59DBqsD001578 actions are delete
> Jun 9 08:24:39 mail MailScanner[26611]: Spam Actions: message
> j59DBqsA001578 actions are delete
> Jun 9 08:24:39 mail MailScanner[26611]: Spam Actions: message
> j59DBqsC001578 actions are delete
> Jun 9 08:24:39 mail MailScanner[26611]: Spam Actions: message
> j59Cwoco031622 actions are delete
> Jun 9 08:24:39 mail MailScanner[26611]: Spam Actions: message
> j59Cwocn031622 actions are delete
> Jun 9 08:24:39 mail MailScanner[26611]: Spam Actions: message
> j59CMh4H026742 actions are delete
>
> These end up driving the load on the machine to over 5.x and the box starts
> to crawl. I'm using MS 4.41.3-1, SA+sql, Sendmail-8.13.4, sophossavi and
> clamavmodule. OS is RHEL 3U4. Any thoughts?
>
> Mike
>
With Sendmail 8.13 the first thing to try is changing the locking to
posix from flock in /etc/MailScanner/MailScanner.conf
--
,---.____________ _ ============ .
/' \ | \ I_ O _I_,==.:
| A beer doesn't get >--|===`-----'I `---' I | |:
| upset if you come / _ \ I I | |:'
| home with another / ( `-,----============:__;:
| beer! / (_ O __) \_ :
| ,,---.__________/ (______) (_)
:/
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner
mailing list