mail scanner stuck

[Jim Holland]

Hi Martin

On Tue, 18 Apr 2006, Martin Hepworth wrote:

> I'd look at why the clamavmodule is timing out - does clamscan work OK
> from the command line????

On my system I am not running clamavmodule - just plain clamav.  The error 
message below was on the system being run by Eduardo Casarero.
 
> RH 7.1 is really really old

Soon to be upgraded to Debian Sarge :-)

> so it could be problems with either clamAV or the perl module not
> working with 7.1.

> What happens if you change from the module to the normal clamav scanner
> in MailScanner.conf?

See above. 
 
> > -----Original Message-----
> > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> > bounces at lists.mailscanner.info] On Behalf Of Jim Holland
> > Sent: 17 April 2006 22:41
> > To: MailScanner discussion
> > Subject: Re: mail scanner stuck
> > 
> > On Mon, 17 Apr 2006, Eduardo Casarero wrote:
> > 
> > > Date: Mon, 17 Apr 2006 17:33:54 -0300
> > > From: Eduardo Casarero <ecasarero at gmail.com>
> > > Reply-To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> > > To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> > > Subject: Re: mail scanner stuck
> > >
> > > hi, after doing some investigation i found the following:
> > > with 4 particular emails:
> > 
> > > in /var/log/maillog:
> > 
> > Apr 17 16:54:22 avas2 MailScanner[4150]: Virus and Content Scanning:
> > Starting
> > Apr 17 16:59:23 avas2 MailScanner[4150]: Commercial scanner clamavmodule
> > timed out!
> > Apr 17 16:59:23 avas2 MailScanner[4150]: Virus Scanning: Denial Of Service
> > attack detected!
> > --------------------------------------------------------------------------
> > ---
> > > After this last log message the mail scanner rescan of the same email
> > > looping. This was logged with 1 child runnig (just for debuggin, in
> > > normal operation runs 6 childs)
> > 
> > . . .
> > 
> > > After this i really don´t know what to do. Cause Clamav is the only AV
> > > on the system and MScanner has a Timeout for AV of 300 segs an clamav
> > takes
> > > only 37.24 seg. so MScanner cant see that clamav finished or something
> > > is missing.
> > 
> > . . .
> > 
> > This seems to be very similar to the problem I wrote about earlier this
> > evening in:
> > 
> > 	Subject: Solved? Re: Still stuck in queue, version 4.52.2
> > 
> > I would be very interested to know:
> > 
> > 	The size of the message
> > 
> > 	What files it contained
> > 
> > 	Whether the files were compressed, and if so
> > 	what was the uncompressed file size
> > 
> > 	How many messages were in the batch that failed?
> > 
> > Clearly if the message is one of say 30 in a batch then it is going to be
> > easier for ClamAV to time out on the batch than if there was only one in
> > the batch.  My understanding is that the timeout setting applies to the
> > whole batch and not to a single message.
> > 
> > As indicated in my message, I have changed the default for:
> > 
> > 	Virus Scanner Timeout =
> > 
> > in MailScanner.conf from 300 to 600 seconds to try to avoid this kind of
> > problem.
> > 
> > Regards
> > 
> > Jim Holland
> > System Administrator
> > MANGO - Zimbabwe's non-profit e-mail service
> > 
> > --
> > MailScanner mailing list
> > mailscanner at lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > 
> > Before posting, read http://wiki.mailscanner.info/posting
> > 
> > Support MailScanner development - buy the book off the website!
> 
> 
> **********************************************************************
> 
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
> 
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.	
> 
> **********************************************************************
> 
> 

Regards

Jim Holland
System Administrator
MANGO - Zimbabwe's non-profit e-mail service