*****SPAM***** Re: 4.51.5 scanning messages multiple times

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Aha! We have an error message. Please can you send me one of the 
messages producing this error?

jf wrote:
> Debug mode produces the usual EOCD signature messages and errors like
> the one below.  During this debug session, duplicate scans were logged
> again (so if there was another message that would pop up during this
> problem, it should have this time).
>
> read-open
> /var/spool/MailScanner/incoming/16041/k24MxfOU003753/winmail.dat: No
> such file or directory at /usr/lib/perl5/site_perl/5.8.5/MIME/Body.pm
> line 435.
>
> All boxes are running sendmail 8.13.1; the sendmail.cf, access,
> MailScanner.conf files do not produce output when they are diff-compared
> to the other boxes.  I've also compared the rc/init.d directories for
> differences in startup scripts to no avail.
>
> I guess I'm primarily fishing for more files to compare.  Is there
> another log that might have relevant messages?
>
> Julian Field wrote:
>   
>> Have you run MailScanner in debug mode? Does it produce any errors? 
>> There are reasons why messages can be dropped from a batch, but there 
>> are very few with sendmail, it's only Postfix which does it 
>> (intentionally, to allow scanning later).
>>
>> If you are using sendmail 8.13 and upwards you should use Lock Type = 
>> posix, before 8.13 you should use Lock Type = flock.
>>
>> Differing locking will cause problems like this.
>>
>> You say the 4 boxes are setup identically, but they are behaving 
>> differently, which tends to imply they aren't actually the same :-)
>>
>> jf wrote:
>>     
>>>> I am running MailScanner 4.51.5 (recently upgraded from 4.50.15) on 4
>>>> RedHat AS4 boxes with the same hardware.  The sendmail and MailScanner
>>>> configuration files are identical, and the load is distributed to all
>>>> four with a content switch.  Three of the boxes are working fine, but on
>>>> one of the boxes messages are being scanned several times before being
>>>> delivered.  This is happening with almost every message on that server.
>>>>  Only one message is delivered, but it is scanned many times.
>>>>
>>>> The only other difference I can find between this server and the three
>>>> others is that on this one, I see lots of "[MailScanner] <defunct>"
>>>> processes, where the other servers have none.
>>>>
>>>> The only semi-relevant archived suggestions I can find deal with
>>>> duplicate deliveries and the lock type.  The lock type is set to posix
>>>> on all four servers.  Changing it to flock  does not remove the behavior.
>>>>
>>>> Below is a log excerpt showing this problem occurring with one message.
>>>>
>>>> If anyone has any suggestions, I'd appreciate them.
>>>>
>>>> --- start example log -------------------
>>>> Mar  9 04:42:30 mailforward-d sendmail[22343]: k299gIL0022343:
>>>> from=<u789mobs at maxmailer.net>, size=2312, class=0, nrcpts=1, msgid=<
>>>> 200603090941.k299fL1f089152 at ns1.maxmailer.net>, proto=ESMTP, daemon=MTA,
>>>> relay=ns1.maxmailer.net [216.171.216.248]
>>>> Mar  9 04:42:30 mailforward-d sendmail[22343]: k299gIL0022343:
>>>> to=<user at emich.edu>, delay=00:00:00, mailer=esmtp, pri=32312, st
>>>> at=queued
>>>> Mar  9 04:57:46 mailforward-d MailScanner[31296]: SpamAssassin cache hit
>>>> for message k299gIL0022343
>>>> Mar  9 04:57:46 mailforward-d MailScanner[31296]: Message k299gIL0022343
>>>> from 216.171.216.248 (u789mobs at maxmailer.net) to emich.edu is spam,
>>>> SpamAssassin (score=6.005, required 5, URIBL_JP_SURBL 2.46,
>>>> URIBL_OB_SURBL 3.21, unsub13 0.33)
>>>> Mar  9 04:57:46 mailforward-d MailScanner[31296]: Spam Actions: message
>>>> k299gIL0022343 actions are deliver
>>>> Mar  9 04:57:57 mailforward-d MailScanner[31587]: SpamAssassin cache hit
>>>> for message k299gIL0022343
>>>> Mar  9 04:57:57 mailforward-d MailScanner[31587]: Message k299gIL0022343
>>>> from 216.171.216.248 (u789mobs at maxmailer.net) to emich.edu is spam,
>>>> SpamAssassin (score=6.005, required 5, URIBL_JP_SURBL 2.46,
>>>> URIBL_OB_SURBL 3.21, unsub13 0.33)
>>>>
>>>> ... (same thing goes on for a bit)
>>>>
>>>> Mar  9 05:05:16 mailforward-d sendmail[2722]: k299gIL0022343:
>>>> to=<user at emich.edu>, delay=00:22:47, xdelay=00:00:00, mailer=esmtp,
>>>> pri=122312, relay=server.emich.edu. [serverip], dsn=2.0.0, stat=Sent (Ok.)
>>>> --- end example log -------------------
>>>>   
>>>>         

- -- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.5 (Build 5050)

iQA/AwUBRBCJYhH2WUcUFbZUEQIXpQCgjHeSFdLsCtOENITkd/5nVOsR0mAAmwRp
EIeUCSvawEyrw0yaQGXk2ToE
=47Qh
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.