MailScanner now on the fritz

[Dave Duffner - PSCGi]

Martin,

        Yep, that was the only place that it wasn't done
until Julian's suggestion yesterday.  Popped that into
the file, restarted services (and with today's reboot
it's definitely applied) and still it's at it again.
Random, which is the real strange part, but it loves
to do it.

        On the AWL issue, I'm not sure it's a problem
with the AWL function, as that's showing 'disabled'.
I think it's more than we've built up an AWL file over
time before disarming it and for whatever reason SA's
dipping back into that file as a reference.  Then it
tags.

        So my goal on that issue is to determine where
this 'AWL list' is and flush that file, then see if it
keeps tagging mail.  If so, then it's a larger issue
and possibly time to revamp that server.  If it stops,
problem solved.

        UPDATE:  On the zombie issue mentioned, after
changing some of the tags in MailScanner.conf to 'disarm'
frame tags, etc. to match what someone suggested was
working for them in this List, that's the culprit for
the zombies!

        Changed the settings back to yes/no as I had them,
restarted MailScanner and all the zombies and loads
are now gone.  So one of those 'disarms' apparently
either has issues with trying to disarm certain messages
that causes the processes to loop forever as zombies,
or can't do it and instead of killing the process for
good it's dumping the PID, handing the message back to
be re-processed and then a new PID goes defunct trying
to do the same thing.

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Martin Hepworth
> Sent: Wednesday, March 30, 2005 10:10 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: MailScanner now on the fritz
>
>
> Dave
>
> have you tried turning off AWL in SA? I find a real PITA esp
> with SA 3.x.
>
> in spam.assassin.prefs.conf set
>
> use_auto_whitelist      0
>
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Dave Duffner - PSCGi wrote:
> > Greetings,
> >
> >         Apparently gone from bad to worse.  Determined
> we're running
> > MS 4.31.6, on an Ensim Pro box w/FC1, SA, ClamAV, etc. We
> had reports
> > from late yesterday and this morning that some e-mail was
> taking over
> > an hour to be delivered, even from 2 accounts within the
> same box.  So
> > we took a look and found some serious problems cropping up:
> >
> >         Since the last Ensim Pro upgrade from 4.02-XX to 4.03-XX,
> > which apparently modified MailScanner (and other elements) in some
> > way, this sucker's just not right.
> >
> >         The AWL issue still remains, randomly tags those who
> > apparently must be in an existing AWL file somewhere, that
> seriously
> > needs to be flushed as the AWL adjustment is always a
> positive number
> > (usually massive like in the 100's) and instantly earns the
> e-mail a
> > spam tag.
> >
> >         In trying to perform the -v or --help commands, it turns up
> > errors regarding the lack of some config file as specified
> in line 575
> > of the Config.pm file.  According to posts, that shouldn't be the
> > case, those commands should produce a result.
> >
> >         Now, since changing the SpamAssassin and AWL tags
> in the conf
> > files, we're suddenly seeing (using top) a constant stream
> of zombie
> > processes and 'defunct' MailScanner processes running.
> >
> >         Kill the PID, new one comes up.  Should be running 5-8
> > processes tops, wants to run 12.  At least 5 are zombies and keep
> > respawning.  The top report shows them as MailScanner <defunct> and
> > zombied process.  Strange part is that one of the processes
> seems to
> > run just fine?
> >
> >         Top that off with the fact that after changing the
> conf files
> > to the recently suggested 'disarm' to prevent MS from
> nailing 'script
> > in HTML' mail, that's back again?
> >
> >         Restarted services multiple times, rebooted the server to
> > ensure everything is reset properly.  All that, zombies and
> defunct's
> > abound.
> >
> >         Any clues out there?
> >
> >
> > I--I
> > Message scanned by MailScanner, and is believed to be clean.
> > CONFIDENTIALITY NOTICE:  This transmission intended for the
> specified
> > destination and person.  If this is not you, this
> > e-mail must be deleted immediately.     www.pscginternet.com
> >
> > ------------------------ MailScanner list
> ------------------------ To
> > unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
> > mailscanner' in the body of the email. Before posting, read the MAQ
> > (http://www.mailscanner.biz/maq/) and the archives
> > (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential
> and intended solely for the use of the individual or entity
> to whom they are addressed. If you have received this email
> in error please notify the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail at jiscmail.ac.uk with the words: 'leave mailscanner'
> in the body of the email. Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> I--I
> Message scanned by MailScanner, and is believed to be clean.
> CONFIDENTIALITY NOTICE:  This transmission intended for the
> specified destination and person.  If this is not you, this
> e-mail must be deleted immediately.     www.pscginternet.com
>


I--I
Message scanned by MailScanner, and is believed to be clean.
CONFIDENTIALITY NOTICE:  This transmission intended for the
specified destination and person.  If this is not you, this
e-mail must be deleted immediately.     www.pscginternet.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!