MailScanner: extracting attachments

Steve Crumley scrumley at secure-enterprise.com
Fri Mar 14 17:27:08 GMT 2008


> Subject: Re: MailScanner: extracting attachments
> 
> He wanted an lsof from the "extracting attachments" 
> processes, not just 
> a ps listing.
> 


Since he and I seem to be having the same problem, here is the lsof from
my system:

COMMAND    PID USER   FD   TYPE     DEVICE     SIZE     NODE NAME
MailScann 5234 root  cwd    DIR        8,1  1867776 11010049
/var/spool/mqueue.in
MailScann 5234 root  rtd    DIR        8,1     4096        2 /
MailScann 5234 root  txt    REG        8,1    15160  3012983
/usr/bin/perl
MailScann 5234 root  mem    REG        8,1    16424  3047426
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/IO/IO.so
MailScann 5234 root  mem    REG        8,1   117644  3296898
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/POSIX/POSIX.so
MailScann 5234 root  mem    REG        8,1   313720  3310141
/usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi/auto/Compress/R
aw/Zlib/Zlib.so
MailScann 5234 root  mem    REG        8,1  1263776  3246704
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
MailScann 5234 root  mem    REG        8,1   845624  6406275
/lib/tls/i686/libdb-4.2.so
MailScann 5234 root  mem    REG        8,1    12280  3296879
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/Fcntl/Fcntl.so
MailScann 5234 root  mem    REG        8,1    31240  3296867
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/Encode/Encode.so
MailScann 5234 root  mem    REG        8,1   123171  3148265
/usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi/auto/HTML/Parse
r/Parser.so
MailScann 5234 root  mem    REG        8,1    63540  3296838
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/DB_File/DB_File.so
MailScann 5234 root  mem    REG        8,1    28476  6407453
/lib/libcrypt-2.3.4.so
MailScann 5234 root  mem    REG        8,1    10028  3296836
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/Cwd/Cwd.so
MailScann 5234 root  mem    REG        8,1    44004  3179394
/usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi/auto/Filesys/Df
/Df.so
MailScann 5234 root  mem    REG        8,1   112168  6406174
/lib/ld-2.3.4.so
MailScann 5234 root  mem    REG        8,1  1529120  6406234
/lib/tls/libc-2.3.4.so
MailScann 5234 root  mem    REG        8,1   213772  6406284
/lib/tls/libm-2.3.4.so
MailScann 5234 root  mem    REG        8,1    16732  6406254
/lib/libdl-2.3.4.so
MailScann 5234 root  mem    REG        8,1   107800  6406257
/lib/tls/libpthread-2.3.4.so
MailScann 5234 root  mem    REG        8,1    81120  6407455
/lib/libresolv-2.3.4.so
MailScann 5234 root  mem    REG        8,1    57964  3473687
/usr/lib/perl5/site_perl/5.8.5/i386-linux-thread-multi/auto/Time/HiRes/H
iRes.so
MailScann 5234 root  mem    REG        8,1    18348  3296882
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/File/Glob/Glob.so
MailScann 5234 root  mem    REG        8,1    11504  3326775
/usr/lib/MailScanner/utils/lib/perl5/site_perl/5.8.5/i386-linux-thread-m
ulti/auto/MIME/Base64/Base64.so
MailScann 5234 root  mem    REG        8,1    47404  6406258
/lib/libnss_files-2.3.4.so
MailScann 5234 root  mem    REG        8,1    13192  3296852
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/Digest/MD5/MD5.so
MailScann 5234 root  mem    REG        8,1    72148  3297063
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/Storable/Storable.so
MailScann 5234 root  mem    REG        8,1   101704  6407338
/lib/libnsl-2.3.4.so
MailScann 5234 root  mem    REG        8,1    18624  3047428
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/Sys/Syslog/Syslog.so
MailScann 5234 root  mem    REG        8,1     6368  3297086
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/Sys/Hostname/Hostname.
so
MailScann 5234 root  mem    REG        8,1    15848  6407458
/lib/libutil-2.3.4.so
MailScann 5234 root  mem    REG        8,1    21164  3297060
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/Socket/Socket.so
MailScann 5234 root  mem    REG        8,1    33468  3296894
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/auto/List/Util/Util.so
MailScann 5234 root  mem    REG        8,1   264469  3116095
/usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi/auto/DBI/DBI.so
MailScann 5234 root  mem    REG        8,1 48516688  3010005
/usr/lib/locale/locale-archive
MailScann 5234 root    0u   CHR      136,1                 3 /dev/pts/1
MailScann 5234 root    1u   CHR      136,1                 3 /dev/pts/1
MailScann 5234 root    2w  FIFO        0,7            100668 pipe
MailScann 5234 root    3u  unix 0xf71da480            100664 socket
MailScann 5234 root    4r   REG        8,1    56745  3424307
/usr/lib/MailScanner/MailScanner/CustomConfig.pm
MailScann 5234 root    5r   REG        8,1    22104  3424260
/usr/lib/MailScanner/MailScanner/ConfigDefs.pl
MailScann 5234 root    6r   REG        8,1     2727  3424308
/usr/lib/MailScanner/MailScanner/CustomFunctions/GenericSpamScanner.pm
MailScann 5234 root    7r   REG        8,1    56745  3424307
/usr/lib/MailScanner/MailScanner/CustomConfig.pm
MailScann 5234 root    8uW  REG        8,1      928 11010123
/var/spool/mqueue.in/qfm2AKTf0B030298
MailScann 5234 root    9uW  REG        8,1      102 15712271
/var/spool/mqueue.in/dfm2AKTf0B030298



More information about the MailScanner mailing list