*****SPAM***** Re: 4.51.5 scanning messages multiple times

[jf]

Debug mode produces the usual EOCD signature messages and errors like
the one below.  During this debug session, duplicate scans were logged
again (so if there was another message that would pop up during this
problem, it should have this time).

read-open
/var/spool/MailScanner/incoming/16041/k24MxfOU003753/winmail.dat: No
such file or directory at /usr/lib/perl5/site_perl/5.8.5/MIME/Body.pm
line 435.

All boxes are running sendmail 8.13.1; the sendmail.cf, access,
MailScanner.conf files do not produce output when they are diff-compared
to the other boxes.  I've also compared the rc/init.d directories for
differences in startup scripts to no avail.

I guess I'm primarily fishing for more files to compare.  Is there
another log that might have relevant messages?

Julian Field wrote:
> Have you run MailScanner in debug mode? Does it produce any errors? 
> There are reasons why messages can be dropped from a batch, but there 
> are very few with sendmail, it's only Postfix which does it 
> (intentionally, to allow scanning later).
> 
> If you are using sendmail 8.13 and upwards you should use Lock Type = 
> posix, before 8.13 you should use Lock Type = flock.
> 
> Differing locking will cause problems like this.
> 
> You say the 4 boxes are setup identically, but they are behaving 
> differently, which tends to imply they aren't actually the same :-)
> 
> jf wrote:
>>> I am running MailScanner 4.51.5 (recently upgraded from 4.50.15) on 4
>>> RedHat AS4 boxes with the same hardware.  The sendmail and MailScanner
>>> configuration files are identical, and the load is distributed to all
>>> four with a content switch.  Three of the boxes are working fine, but on
>>> one of the boxes messages are being scanned several times before being
>>> delivered.  This is happening with almost every message on that server.
>>>  Only one message is delivered, but it is scanned many times.
>>>
>>> The only other difference I can find between this server and the three
>>> others is that on this one, I see lots of "[MailScanner] <defunct>"
>>> processes, where the other servers have none.
>>>
>>> The only semi-relevant archived suggestions I can find deal with
>>> duplicate deliveries and the lock type.  The lock type is set to posix
>>> on all four servers.  Changing it to flock  does not remove the behavior.
>>>
>>> Below is a log excerpt showing this problem occurring with one message.
>>>
>>> If anyone has any suggestions, I'd appreciate them.
>>>
>>> --- start example log -------------------
>>> Mar  9 04:42:30 mailforward-d sendmail[22343]: k299gIL0022343:
>>> from=<u789mobs at maxmailer.net>, size=2312, class=0, nrcpts=1, msgid=<
>>> 200603090941.k299fL1f089152 at ns1.maxmailer.net>, proto=ESMTP, daemon=MTA,
>>> relay=ns1.maxmailer.net [216.171.216.248]
>>> Mar  9 04:42:30 mailforward-d sendmail[22343]: k299gIL0022343:
>>> to=<user at emich.edu>, delay=00:00:00, mailer=esmtp, pri=32312, st
>>> at=queued
>>> Mar  9 04:57:46 mailforward-d MailScanner[31296]: SpamAssassin cache hit
>>> for message k299gIL0022343
>>> Mar  9 04:57:46 mailforward-d MailScanner[31296]: Message k299gIL0022343
>>> from 216.171.216.248 (u789mobs at maxmailer.net) to emich.edu is spam,
>>> SpamAssassin (score=6.005, required 5, URIBL_JP_SURBL 2.46,
>>> URIBL_OB_SURBL 3.21, unsub13 0.33)
>>> Mar  9 04:57:46 mailforward-d MailScanner[31296]: Spam Actions: message
>>> k299gIL0022343 actions are deliver
>>> Mar  9 04:57:57 mailforward-d MailScanner[31587]: SpamAssassin cache hit
>>> for message k299gIL0022343
>>> Mar  9 04:57:57 mailforward-d MailScanner[31587]: Message k299gIL0022343
>>> from 216.171.216.248 (u789mobs at maxmailer.net) to emich.edu is spam,
>>> SpamAssassin (score=6.005, required 5, URIBL_JP_SURBL 2.46,
>>> URIBL_OB_SURBL 3.21, unsub13 0.33)
>>>
>>> ... (same thing goes on for a bit)
>>>
>>> Mar  9 05:05:16 mailforward-d sendmail[2722]: k299gIL0022343:
>>> to=<user at emich.edu>, delay=00:22:47, xdelay=00:00:00, mailer=esmtp,
>>> pri=122312, relay=server.emich.edu. [serverip], dsn=2.0.0, stat=Sent (Ok.)
>>> --- end example log -------------------
>>>   
>