MailScanner: Message attempted to kill MailScanner

[Garrod M. Alwood]

You need to get an update, I had the same problem

Garrod Alwood
Open Source Consultant
9047384988
Garrod.alwood at lorodoes.com<mailto:Garrod.alwood at lorodoes.com>
Sent from my iPod

On Jan 22, 2010, at 11:14 AM, "Lyndon Labuschagne" <lyndonl at mexcom.co.za<mailto:lyndonl at mexcom.co.za>> wrote:

Hello All

I hope you can shed some light on the below issue

This is a new install of MailScanner 4.79.5
FreeBSD 8.0 amd64
postfix-2.6.5,1
p5-Mail-SpamAssassin-3.2.5_4
clamav-0.95.3

All the effected mails seem to have attachments, mail sizes vary most are over 200kb but some are only 80kb
most seem to be word docs both .doc and .docx
I have turned off OLE scans to see if that was a part of the problem

ClamAVmodule Maximum File Size = 5000000 # (5 Mbytes)

Max Spam Check Size = 40k
Max SpamAssassin Size = 40k
Max Custom Spam Scanner Size = 40k



the Server is a Xeon 2Ghz quad core 4 GB RAM
it averages about 95% idle with about 2.5GB free RAM although when clamscan is running it might drop down to about 80% idle

I can turn on the debug option but its not every mail that has this issue its probably 1 out of every 100 to 150 messages. so it might take some time to trigger the problem

the below message was 333.6kb

From MailWatch interface:

Subject: removed to protect the innocent
MIME-Version: 1.0
Content-Type: multipart/mixed;
     boundary="----_=_NextPart_001_01CA9B73.4F7F8242"
Date: Fri, 22 Jan 2010 16:58:08 +0200
Message-ID: <<mailto:B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local>B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local<mailto:B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local>>
Content-class: urn:content-classes:message
X-MimeOLE: Produced By Microsoft Exchange V6.5
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: removed to protect the innocent
Thread-Index: AcgMB3G2oM864RICTwyR1vhZ6+t5JwAAI2GAPhemM7A=
X-Priority: 1
Priority: Urgent
Importance: high

From maillog

Jan 22 16:54:42 mailav02 postfix/cleanup[12659]: EC4A71761FFF: message-id=<<mailto:B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local>B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local<mailto:B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local>>
Jan 22 17:00:26 mailav02 MailScanner[14816]: Making attempt 2 at processing message EC4A71761FFF.00000
Jan 22 17:05:25 mailav02 MailScanner[14819]: Making attempt 3 at processing message EC4A71761FFF.00000
Jan 22 17:10:25 mailav02 MailScanner[14900]: Making attempt 4 at processing message EC4A71761FFF.00000
Jan 22 17:12:47 mailav02 MailScanner[15034]: Making attempt 5 at processing message EC4A71761FFF.00000
Jan 22 17:18:32 mailav02 MailScanner[14985]: Making attempt 6 at processing message EC4A71761FFF.00000
Jan 22 17:18:33 mailav02 MailScanner[15120]: Warning: skipping message EC4A71761FFF.00000 as it has been attempted too many times
Jan 22 17:18:33 mailav02 MailScanner[15120]: Quarantined message EC4A71761FFF.00000 as it caused MailScanner to crash several times
Jan 22 17:18:33 mailav02 MailScanner[15120]: Saved entire message to /var/spool/MailScanner/quarantine/20100122/EC4A71761FFF.00000
Jan 22 17:18:33 mailav02 MailScanner[15120]: Logging message EC4A71761FFF.00000 to SQL

Regards,

Lyndon



--
This message has been scanned for viruses and dangerous content by the
Mexcom MailScanner, and appears to be clean.
Should you wish to secure your mail, call sales @ 011-801-4000, alternatively visit
http://www.mexcom.co.za or mail sales at mexcom.co.za<mailto:sales at mexcom.co.za>
<ATT00001..txt>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100122/b9ad1cb4/attachment.html