Mailscanner generated duplicate message.

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Mark Sapiro wrote:
> * PGP Signed by an unknown key
>
> Alex Broens wrote:
>   
>>
>>
>> On 12/24/2007 3:23 PM, Mark Sapiro wrote:
>>     
>>> Alex Broens wrote:
>>>       
>>>> probably totally irrelevant yet got a hunch...
>>>>
>>>>
>>>> what are your settings in MailScanner.conf for
>>>>
>>>> Queue Scan Interval
>>>>
>>>> Max Unscanned Messages Per Scan
>>>>
>>>> Max Unsafe Messages Per Scan
>>>>         
>>> Queue Scan Interval = 6
>>>
>>> Max Unscanned Messages Per Scan = 30
>>>
>>> Max Unsafe Messages Per Scan = 30
>>>
>>>
>>>       
>>>> Could it be you're seeing a race condition between scanning threads?
>>>>         
>>> This is exactly what the problem seems to be, but I don't know what to
>>> do to prevent it or what I could have done or omitted to cause it.
>>>
>>> I suppose I could set
>>>
>>> Max Children = 1
>>>
>>> but that seems extreme, and it seems if it were necessary, more than
>>> just me would be seeing this problem.
>>>       
>> Single CPU:
>>
>> Max Children = 5
>>     
>
>
> This is what I currently have.
>
>
>   
>> Dual:
>>
>> Max Children = 8
>>
>> (keep the box relaxed till you get the stuff to process)
>>
>> Pls try:
>>
>> Queue Scan Interval = 15
>>
>> Max Unscanned Messages Per Scan = 5
>> Max Unsafe Messages Per Scan = 5
>>     
>
>
> I will try these. Note that I will be offline for the next week, so I
> won't be able to report much until after the new year.
>
>
>   
>> You may need to tweek "Queue Scan Interval" to your box's perfomance
>>
>> my rule of thumb:
>>
>> Queue Scan Interval = thread_count + 3
>>
>> keep us posted
>>     
>
>   
I'm slightly surprised you need to change Queue Scan Interval much. It 
won't have much effect when you have quite a few children running, as 
the effective queue scan interval will be that number divided by the 
number of children. So your queue will be scanned once every second or 
two anyway. Which is more than frequent enough!
> OK.
>
> Note that logs indicate that this problem has only occurred on mail
> which is not actually scanned because of a 'no' in scan.messages.rules.
> I don't know why this would matter, but it may be significant.
>
> All but one of the occurrences were on outgoing mail from localhost. The
> other one was an incoming message to postmaster. Logs indicate 4 copies
> of this one were delivered and I undoubtedly saw all four but just
> deleted them thinking they were multiple spams
>
> The nature of the server is that outgoing mail is virtually all Mailman
> list posts or forwards of mail, all of which was scanned on the way in.
> I would just as soon not have Postfix hold mail from localhost at all,
> but I haven't figured out how to do that.
>   
You could easily stop it scanning outgoing messages from itself if you want.
In MailScaner.conf, set
    Scan Messages = %rules-dir%/not.this.server.rules
and then in /etc/MailScanner/rules/not.this.server.rules put 4 lines 
like this
(where the server's own IP address is 10.11.12.13) :

# Say "yes" to everything except messages I created.
From: 127.0.0.1 no
From: 10.11.12.13 no # Worth adding this, just in case
FromOrTo: default yes

Then run
    service MailScanner reload
to make it re-read its configuration. That's a very simple example of 
how rulesets work, so now you can start adding rulesets that do lots 
more clever things for other configuration settings where you want 
different values for different messages: they are documented (well?) in 
The Book, the Wiki, the configration files themselves, the 
"spam.whitelist.rules" example file and the other files in 
/etc/MailScanner/rules.

Now messages originating from the host itself will not be scanned or 
processed by MailScanner at all, just moved straight into the outgoing 
queue without being looked at. Note that none of the MailScanner headers 
will be added either, so the messages will look like they never saw 
MailScanner at all.

The last thing you want is to have mailing list exploders sending 
multiple copies of messages, that equals an enormous amount of 
unnecessary mail!

Jules

- -- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.7.0 (Build 1012)
Comment: Use Thunderbird's Enigmail add-on to verify this message
Charset: ISO-8859-1

wj8DBQFHb+BsEfZZRxQVtlQRAjeNAJ49lPhfOtgWw/C1+ac/z13IMjCUfQCfR9F0
aEWAmfnsjAIHPi3BlHFCNuI=
=g/H7
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.