Mailscanner only being invoked with certain message sizes
tenderby at mailwash.com.au
Wed Dec 9 16:00:04 GMT 2009
Glenn Steen wrote:
> 2009/12/9 Tony Enderby <tenderby at mailwash.com.au>:
>> Hi there,
>> I have a clean install of the latest MS from Julian's site and have it
>> installed with default rules
>> and scanning options. The only think I have changed is the scanner entry in
>> the .conf file from
>> auto to clamav and added an entry for &MailWatchLogging to log to a MySQL
>> database for
>> Machine is Fedora Core 9 with sendmail.
>> If I start MailScanner with service MailScanner start && tail -f
>> /var/log/maillog I can see the children fork
>> and the process start to run complete with SQL logging child started
>> entries. Mail can be sent in and out
>> without error but there are no MS style entries in the logs and no header
>> info added UNTIL I send a message
>> over 450K i.e a blank body email with a random image in it or a Word doc of
>> equivalent or greater size. When I send a message at or over this size I see
>> the MS process output in the logs (Starting Virus / Content scanning etc)
>> as well as a write to the MailWatch database. Anything under this though
>> sends and gets back ok but only with sendmail
>> log entries and not MailScanner.
>> A MailScanner --lint returns a favourable reply with complaints only about
>> rar not being found.
>> If anyone could shed some light in this it would be great,
>> Thanks in advance,
> Check that you don't have your "plain" MTA still running (nor set to
> autostart.... ps is a good tool here:-). What I'm thinking is that
> smaller messages never stay in your incoming queue long enough for
> MailScanner to pick it up...
Thanks Glenn, sendmail itself is not running as I performed a chkconfig
sendmail off when I first setup MS on this box and quit the service. I
noticed that sm-client is still running though on the problem machines,
however this is also running on a later version of Fedora I am testing
on and this machine does not suffer this problem so I'm not sure where
to go from here.
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
More information about the MailScanner