MailScanner: Message attempted to kill MailScanner

[Lyndon Labuschagne]

Ok cool thanks all 

I will try that on monday, if the gods smile on my there might be an updated BSD port :) not that im holding my breath 


On 22 Jan 2010, at 6:51 PM, Julian Field wrote:

> Yes, just install the latest version available on the website.
> 
> On 22/01/2010 16:17, Garrod M. Alwood wrote:
>> You need to get an update, I had the same problem
>> 
>> Garrod Alwood
>> Open Source Consultant
>> 9047384988
>> Garrod.alwood at lorodoes.com <mailto:Garrod.alwood at lorodoes.com>
>> Sent from my iPod
>> 
>> On Jan 22, 2010, at 11:14 AM, "Lyndon Labuschagne" <lyndonl at mexcom.co.za <mailto:lyndonl at mexcom.co.za>> wrote:
>> 
>>> Hello All
>>> 
>>> I hope you can shed some light on the below issue
>>> 
>>> This is a new install of MailScanner 4.79.5
>>> FreeBSD 8.0 amd64
>>> postfix-2.6.5,1
>>> p5-Mail-SpamAssassin-3.2.5_4
>>> clamav-0.95.3
>>> 
>>> All the effected mails seem to have attachments, mail sizes vary most are over 200kb but some are only 80kb
>>> most seem to be word docs both .doc and .docx
>>> I have turned off OLE scans to see if that was a part of the problem
>>> 
>>> ClamAVmodule Maximum File Size = 5000000 # (5 Mbytes)
>>> 
>>> Max Spam Check Size = 40k
>>> Max SpamAssassin Size = 40k
>>> Max Custom Spam Scanner Size = 40k
>>> 
>>> 
>>> 
>>> the Server is a Xeon 2Ghz quad core 4 GB RAM
>>> it averages about 95% idle with about 2.5GB free RAM although when clamscan is running it might drop down to about 80% idle
>>> 
>>> I can turn on the debug option but its not every mail that has this issue its probably 1 out of every 100 to 150 messages. so it might take some time to trigger the problem
>>> 
>>> the below message was 333.6kb
>>> 
>>> From MailWatch interface:
>>> 
>>> Subject: /removed to protect the innocent/
>>> MIME-Version: 1.0
>>> Content-Type: multipart/mixed;
>>>     boundary="----_=_NextPart_001_01CA9B73.4F7F8242"
>>> Date: Fri, 22 Jan 2010 16:58:08 +0200
>>> Message-ID: <B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local <mailto:B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local>>
>>> Content-class: urn:content-classes:message
>>> X-MimeOLE: Produced By Microsoft Exchange V6.5
>>> X-MS-Has-Attach:
>>> X-MS-TNEF-Correlator:
>>> Thread-Topic: removed to protect the innocent
>>> Thread-Index: AcgMB3G2oM864RICTwyR1vhZ6+t5JwAAI2GAPhemM7A=
>>> X-Priority: 1
>>> Priority: Urgent
>>> Importance: high
>>> 
>>> From maillog
>>> 
>>> Jan 22 16:54:42 mailav02 postfix/cleanup[12659]: EC4A71761FFF: message-id=<B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local <mailto:B8ADB5A39790EF41901A5F105DB2CB8DB43CCD at server.Hi-tech.local>>
>>> Jan 22 17:00:26 mailav02 MailScanner[14816]: Making attempt 2 at processing message EC4A71761FFF.00000
>>> Jan 22 17:05:25 mailav02 MailScanner[14819]: Making attempt 3 at processing message EC4A71761FFF.00000
>>> Jan 22 17:10:25 mailav02 MailScanner[14900]: Making attempt 4 at processing message EC4A71761FFF.00000
>>> Jan 22 17:12:47 mailav02 MailScanner[15034]: Making attempt 5 at processing message EC4A71761FFF.00000
>>> Jan 22 17:18:32 mailav02 MailScanner[14985]: Making attempt 6 at processing message EC4A71761FFF.00000
>>> Jan 22 17:18:33 mailav02 MailScanner[15120]: Warning: skipping message EC4A71761FFF.00000 as it has been attempted too many times
>>> Jan 22 17:18:33 mailav02 MailScanner[15120]: Quarantined message EC4A71761FFF.00000 as it caused MailScanner to crash several times
>>> Jan 22 17:18:33 mailav02 MailScanner[15120]: Saved entire message to /var/spool/MailScanner/quarantine/20100122/EC4A71761FFF.00000
>>> Jan 22 17:18:33 mailav02 MailScanner[15120]: Logging message EC4A71761FFF.00000 to SQL
>>> 
>>> Regards,
>>> 
>>> Lyndon
>>> 
>>> 
>>> 
>>> -- 
>>> This message has been scanned for viruses and dangerous content by the
>>> *Mexcom MailScanner*, and appears to be clean.
>>> Should you wish to secure your mail, call sales @ 011-801-4000, alternatively visit
>>> http://www.mexcom.co.za or mail sales at mexcom.co.za <mailto:sales at mexcom.co.za>
>>> <ATT00001..txt>
> 
> Jules
> 
> -- 
> Julian Field MEng CITP CEng
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> 
> Need help customising MailScanner?
> Contact me!
> Need help fixing or optimising your systems?
> Contact me!
> Need help getting you started solving new requirements from your boss?
> Contact me!
> 
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> Follow me at twitter.com/JulesFM and twitter.com/MailScanner
> 
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!