mail scanner stuck

[Eduardo Casarero]

jim, i´ve the messages but i just substracted them from the mqueu.in. Sizes
goes from 400Kb to 7Mb. Aparently they are compressed PPT Power Point
Presentations. how can i open that mail if i have the qfk3HFIQcc008169 and
dfk3HFIQcc008169<file:///C:/Documents%20and%20Settings/ecasarero/Escritorio/mails/dfk3HFIQcc008169>.
 In the bacht that failed there was 1 email only, i chaged parameters
so
mailscanner takes 1 by 1 so i found this 4 problematic mails.

regards.

2006/4/18, Jim Holland <mailscanner at mango.zw>:
>
> Hi Martin
>
> On Tue, 18 Apr 2006, Martin Hepworth wrote:
>
> > I'd look at why the clamavmodule is timing out - does clamscan work OK
> > from the command line????
>
> On my system I am not running clamavmodule - just plain clamav.  The error
> message below was on the system being run by Eduardo Casarero.
>
> > RH 7.1 is really really old
>
> Soon to be upgraded to Debian Sarge :-)
>
> > so it could be problems with either clamAV or the perl module not
> > working with 7.1.
>
> > What happens if you change from the module to the normal clamav scanner
> > in MailScanner.conf?
>
> See above.
>
> > > -----Original Message-----
> > > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> > > bounces at lists.mailscanner.info] On Behalf Of Jim Holland
> > > Sent: 17 April 2006 22:41
> > > To: MailScanner discussion
> > > Subject: Re: mail scanner stuck
> > >
> > > On Mon, 17 Apr 2006, Eduardo Casarero wrote:
> > >
> > > > Date: Mon, 17 Apr 2006 17:33:54 -0300
> > > > From: Eduardo Casarero <ecasarero at gmail.com>
> > > > Reply-To: MailScanner discussion <mailscanner at lists.mailscanner.info
> >
> > > > To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> > > > Subject: Re: mail scanner stuck
> > > >
> > > > hi, after doing some investigation i found the following:
> > > > with 4 particular emails:
> > >
> > > > in /var/log/maillog:
> > >
> > > Apr 17 16:54:22 avas2 MailScanner[4150]: Virus and Content Scanning:
> > > Starting
> > > Apr 17 16:59:23 avas2 MailScanner[4150]: Commercial scanner
> clamavmodule
> > > timed out!
> > > Apr 17 16:59:23 avas2 MailScanner[4150]: Virus Scanning: Denial Of
> Service
> > > attack detected!
> > >
> --------------------------------------------------------------------------
> > > ---
> > > > After this last log message the mail scanner rescan of the same
> email
> > > > looping. This was logged with 1 child runnig (just for debuggin, in
> > > > normal operation runs 6 childs)
> > >
> > > . . .
> > >
> > > > After this i really don´t know what to do. Cause Clamav is the only
> AV
> > > > on the system and MScanner has a Timeout for AV of 300 segs an
> clamav
> > > takes
> > > > only 37.24 seg. so MScanner cant see that clamav finished or
> something
> > > > is missing.
> > >
> > > . . .
> > >
> > > This seems to be very similar to the problem I wrote about earlier
> this
> > > evening in:
> > >
> > >     Subject: Solved? Re: Still stuck in queue, version 4.52.2
> > >
> > > I would be very interested to know:
> > >
> > >     The size of the message
> > >
> > >     What files it contained
> > >
> > >     Whether the files were compressed, and if so
> > >     what was the uncompressed file size
> > >
> > >     How many messages were in the batch that failed?
> > >
> > > Clearly if the message is one of say 30 in a batch then it is going to
> be
> > > easier for ClamAV to time out on the batch than if there was only one
> in
> > > the batch.  My understanding is that the timeout setting applies to
> the
> > > whole batch and not to a single message.
> > >
> > > As indicated in my message, I have changed the default for:
> > >
> > >     Virus Scanner Timeout =
> > >
> > > in MailScanner.conf from 300 to 600 seconds to try to avoid this kind
> of
> > > problem.
> > >
> > > Regards
> > >
> > > Jim Holland
> > > System Administrator
> > > MANGO - Zimbabwe's non-profit e-mail service
> > >
> > > --
> > > MailScanner mailing list
> > > mailscanner at lists.mailscanner.info
> > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > >
> > > Before posting, read http://wiki.mailscanner.info/posting
> > >
> > > Support MailScanner development - buy the book off the website!
> >
> >
> > **********************************************************************
> >
> > This email and any files transmitted with it are confidential and
> > intended solely for the use of the individual or entity to whom they
> > are addressed. If you have received this email in error please notify
> > the system manager.
> >
> > This footnote confirms that this email message has been swept
> > for the presence of computer viruses and is believed to be clean.
> >
> > **********************************************************************
> >
> >
>
> Regards
>
> Jim Holland
> System Administrator
> MANGO - Zimbabwe's non-profit e-mail service
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20060418/f329ba2d/attachment.html