mail scanner stuck

[Martin Hepworth]

Jim

I'd look at why the clamavmodule is timing out - does clamscan work OK from
the command line????

RH 7.1 is really really old so it could be problems with either clamAV or
the perl module not working with 7.1. 

What happens if you change from the module to the normal clamav scanner in
MailScanner.conf?

--
Martin Hepworth 
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> bounces at lists.mailscanner.info] On Behalf Of Jim Holland
> Sent: 17 April 2006 22:41
> To: MailScanner discussion
> Subject: Re: mail scanner stuck
> 
> On Mon, 17 Apr 2006, Eduardo Casarero wrote:
> 
> > Date: Mon, 17 Apr 2006 17:33:54 -0300
> > From: Eduardo Casarero <ecasarero at gmail.com>
> > Reply-To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> > To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> > Subject: Re: mail scanner stuck
> >
> > hi, after doing some investigation i found the following:
> > with 4 particular emails:
> 
> > in /var/log/maillog:
> 
> Apr 17 16:54:22 avas2 MailScanner[4150]: Virus and Content Scanning:
> Starting
> Apr 17 16:59:23 avas2 MailScanner[4150]: Commercial scanner clamavmodule
> timed out!
> Apr 17 16:59:23 avas2 MailScanner[4150]: Virus Scanning: Denial Of Service
> attack detected!
> --------------------------------------------------------------------------
> ---
> > After this last log message the mail scanner rescan of the same email
> > looping. This was logged with 1 child runnig (just for debuggin, in
> > normal operation runs 6 childs)
> 
> . . .
> 
> > After this i really don´t know what to do. Cause Clamav is the only AV
> > on the system and MScanner has a Timeout for AV of 300 segs an clamav
> takes
> > only 37.24 seg. so MScanner cant see that clamav finished or something
> > is missing.
> 
> . . .
> 
> This seems to be very similar to the problem I wrote about earlier this
> evening in:
> 
> 	Subject: Solved? Re: Still stuck in queue, version 4.52.2
> 
> I would be very interested to know:
> 
> 	The size of the message
> 
> 	What files it contained
> 
> 	Whether the files were compressed, and if so
> 	what was the uncompressed file size
> 
> 	How many messages were in the batch that failed?
> 
> Clearly if the message is one of say 30 in a batch then it is going to be
> easier for ClamAV to time out on the batch than if there was only one in
> the batch.  My understanding is that the timeout setting applies to the
> whole batch and not to a single message.
> 
> As indicated in my message, I have changed the default for:
> 
> 	Virus Scanner Timeout =
> 
> in MailScanner.conf from 300 to 600 seconds to try to avoid this kind of
> problem.
> 
> Regards
> 
> Jim Holland
> System Administrator
> MANGO - Zimbabwe's non-profit e-mail service
> 
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.	

**********************************************************************