Mailscanner stops working after a few hours.

[Glenn Steen]

On 27/03/06, John McMonagle <johnm at advocap.org> wrote:
> Using postfix and mailscanner on debian sarge.
> postfix        2.1.5-9
> mailscanner    4.41.3-2
>
> Setup from the instructions the Mailscanner web page.
>
> I noticed that messages are keep going into
> /var/spool/postfix/hold but mailscanner quits processing them.
> Mailscanner is running yet.
> I'm guessing it's quiting at about the  4 hour time period that
> mailscanner process are restarted.
> /etc/init.d/mailscanner restart  gets it going again.
> Otherwise seems to work fine.
>
> Log of the last message the worked:
> Mar 27 11:09:38 mail postfix/smtpd[30785]: 6B081E00DC:
> client=ptx-120-27.prizeamerica2.com[207.115.120.27]
> Mar 27 11:09:39 mail postfix/cleanup[30787]: 6B081E00DC: hold: header
> Received: from ptx-120-27.prizeamerica2.com
> (ptx-120-27.prizeamerica2.com [207.115.120
> .27])??by mail.advocap.org (Postfix) with ESMTP id 6B081E00DC??for
> <lisak at advocap.org>; Mon, 27 Mar 2006 11:09:38  from
> ptx-120-27.prizeamerica2.com[207.115
> .120.27]; from=<mailcenter59927139 at prizeamerica2.com>
> to=<lisak at advocap.org> proto=ESMTP helo=<ptx-120-27.prizeamerica2.com>
> Mar 27 11:09:39 mail postfix/cleanup[30787]: 6B081E00DC:
> message-id=<20060327170938.6B081E00DC at mail.advocap.org>
> Mar 27 11:09:41 mail cyrus/imapd[30780]: accepted connection
> Mar 27 11:09:41 mail MailScanner[25532]: New Batch: Scanning 1 messages,
> 3534 bytes
> Mar 27 11:09:43 mail cyrus/imapd[29882]: login: localhost[127.0.0.1]
> mailadm plaintext
> Mar 27 11:09:43 mail MailScanner[25532]: Spam Checks: Found 1 spam messages
> Mar 27 11:09:43 mail MailScanner[25532]: Virus and Content Scanning:
> Starting
> Mar 27 11:09:44 mail postfix/smtpd[30785]: disconnect from
> ptx-120-27.prizeamerica2.com[207.115.120.27]
> Mar 27 11:09:44 mail MailScanner[25532]: MailScanner child dying of old age
> Mar 27 11:09:44 mail MailScanner[30859]: MailScanner E-Mail Virus
> Scanner version 4.41.3 starting...
> Mar 27 11:09:44 mail MailScanner[30859]: Read 120 hostnames from the
> phishing whitelist
> Mar 27 11:09:46 mail MailScanner[30859]: Using locktype = flock
>
> The message before this was not spam and delivered OK.
>
> Here is the next 2 messages and mailscanner does not start:
> Mar 27 11:11:19 mail postfix/smtpd[30785]: E3E2CE00E6:
> client=backup.dotnet.com[216.127.196.18]
> Mar 27 11:11:20 mail postfix/cleanup[30871]: E3E2CE00E6: hold: header
> Received: from hamburg.dotnet.com (backup.dotnet.com
> [216.127.196.18])??by mail.advoca
> p.org (Postfix) with ESMTP id E3E2CE00E6??for <terryd at advocap.org>; Mon,
> 27 Mar 2006 11:11:19 -0600 (CST) from backup.dotnet.com[216.127.196.18];
> from=<petc
> are at dotnet.com> to=<terryd at advocap.org> proto=ESMTP
> helo=<hamburg.dotnet.com>
> Mar 27 11:11:20 mail postfix/cleanup[30871]: E3E2CE00E6: hold: header
> Received: from 216-127-207-249.strgbay.dcwis.com ([216.127.207.249]
> helo=homee677adc14
> 2)??by hamburg.dotnet.com with smtp (Exim 3.33 #1)??id 1FNvFe-0004rq-00;
> Mon, 27 Mar 2006 11:11:34 -0600 from backup.dotnet.com[216.127.196.18];
> from=<petca
> re at dotnet.com> to=<terryd at advocap.org> proto=ESMTP helo=<hamburg.dotnet.com>
> Mar 27 11:11:20 mail postfix/cleanup[30871]: E3E2CE00E6:
> message-id=<000701c651c1$7e74a730$0201a8c0 at homee677adc142>
> Mar 27 11:11:20 mail postfix/smtpd[30785]: disconnect from
> backup.dotnet.com[216.127.196.18]
> Mar 27 11:11:39 mail postfix/smtpd[30785]: connect from
> fondy.advocap.org[192.168.2.1]
> Mar 27 11:11:39 mail postfix/smtpd[30785]: C8F5CE00E7:
> client=fondy.advocap.org[192.168.2.1]
> Mar 27 11:11:39 mail postfix/cleanup[30871]: C8F5CE00E7: hold: header
> Received: from fondy.advocap.org (fondy.advocap.org [192.168.2.1])??by
> mail.advocap.or
> g (Postfix) with ESMTP id C8F5CE00E7??for <angelam at advocap.org>; Mon, 27
> Mar 2006 11:11:39 -0600 (CST) from fondy.advocap.org[192.168.2.1];
> from=<mkonen at adv
> ocap.org> to=<angelam at advocap.org> proto=ESMTP helo=<fondy.advocap.org>
> Mar 27 11:11:39 mail postfix/cleanup[30871]: C8F5CE00E7: hold: header
> Received: by fondy.advocap.org (Postfix, from userid 2072)??id
> 1FC74440A9; Mon, 27 Mar
>  2006 11:12:07 -0600 (CST) from fondy.advocap.org[192.168.2.1];
> from=<mkonen at advocap.org> to=<angelam at advocap.org> proto=ESMTP
> helo=<fondy.advocap.org>
> Mar 27 11:11:39 mail postfix/cleanup[30871]: C8F5CE00E7: hold: header
> Received: from localhost (localhost [127.0.0.1])??by fondy.advocap.org
> (Postfix) with
> ESMTP id 12BC1440A6??for <angelam at advocap.org>; Mon, 27 Mar 2006
> 11:12:07 -0600 (CST) from fondy.advocap.org[192.168.2.1];
> from=<mkonen at advocap.org> to=<ang
> elam at advocap.org> proto=ESMTP helo=<fondy.advocap.org>
> Mar 27 11:11:39 mail postfix/cleanup[30871]: C8F5CE00E7:
> message-id=<Pine.LNX.4.61.0603271111050.15410 at fondy.advocap.org>
> Mar 27 11:11:39 mail postfix/smtpd[30785]: disconnect from
> fondy.advocap.org[192.168.2.1]
>
> I saved listing of hold before restarting mailscanner and the 2 messages
> above were in hold and were the oldest messages.
>
> Any idea what the problem is?
>
> Thanks
>
> John
>

Are there any _other_ files than queue files in hold? That has been
known to make MS ... throttle.... IIRC has to do with the tnef decoder
bit.

--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se