MailScanner Crash

[Bjron Mork]

Dear All,

 

I have MailScanner running 4.79.11 with Postfix 2.7, and mailwatch,
everything was working fine, since long, but suddenly, my both servers has
started showing messages below..

 

I have more than 10GB RAM free, disk space is around 70% free, currently
MailScanner is not scanning for any email for spam, need your urgent support
for its recovery.

 

 

 

[root at outbound ~]# tail -f /var/log/maillog | grep MailScanner

Aug  3 09:58:52 outbound MailScanner[10560]: Warning: skipping message
E41E321D800A.AC841 as it has been attempted too many times 

Aug  3 09:58:52 outbound MailScanner[10560]: Quarantined message
E41E321D800A.AC841 as it caused MailScanner to crash several times 

Aug  3 09:58:52 outbound MailScanner[10560]: Saved entire message to
/var/spool/MailScanner/quarantine/20110803/E41E321D800A.AC841 

Aug  3 09:58:52 outbound MailScanner[10560]: writing to
/var/spool/MailScanner/quarantine/20110803/E41E321D800A.AC841/message: No
such file or directory 

Aug  3 09:58:56 outbound MailScanner[10618]: MailScanner E-Mail Virus
Scanner version 4.79.11 starting... 

Aug  3 09:58:56 outbound MailScanner[10618]: Reading configuration file
/etc/MailScanner/MailScanner.conf 

Aug  3 09:58:56 outbound MailScanner[10618]: Reading configuration file
/etc/MailScanner/conf.d/README 

Aug  3 09:58:56 outbound MailScanner[10618]: Enabling SpamAssassin
auto-whitelist functionality... 

Aug  3 09:58:57 outbound MailScanner[10596]: Connected to Processing
Attempts Database 

Aug  3 09:58:57 outbound MailScanner[10596]: Found 5223 messages in the
Processing Attempts Database 

Aug  3 09:58:57 outbound MailScanner[10596]: Using locktype = flock 

Aug  3 09:58:57 outbound MailScanner[10596]: Warning: skipping message
E41E321D800A.AC841 as it has been attempted too many times 

Aug  3 09:58:57 outbound MailScanner[10596]: Quarantined message
E41E321D800A.AC841 as it caused MailScanner to crash several times 

Aug  3 09:58:57 outbound MailScanner[10596]: Saved entire message to
/var/spool/MailScanner/quarantine/20110803/E41E321D800A.AC841 

Aug  3 09:58:57 outbound MailScanner[10596]: writing to
/var/spool/MailScanner/quarantine/20110803/E41E321D800A.AC841/message: No
such file or directory 

 

 

[root at outbound ~]# check_MailScanner 

MailScanner running with pid 8262 10698 10704 10710 10716 10722

[root at outbound ~]# 

 

 

[root at outbound ~]# MailScanner --lint

Trying to setlogsock(unix)

 

Reading configuration file /etc/MailScanner/MailScanner.conf

Reading configuration file /etc/MailScanner/conf.d/README

Read 867 hostnames from the phishing whitelist

Read 4306 hostnames from the phishing blacklists

Config: calling custom init function SQLBlacklist

Starting up SQL Blacklist

Read 772 blacklist entries

Config: calling custom init function MailWatchLogging

Started SQL Logging child

Config: calling custom init function SQLWhitelist

Starting up SQL Whitelist

Read 101 whitelist entries

 

Checking version numbers...

Version number in MailScanner.conf (4.79.11) is correct.

 

Your envelope_sender_header in spam.assassin.prefs.conf is correct.

MailScanner setting GID to  (89)

MailScanner setting UID to  (89)

 

Checking for SpamAssassin errors (if you use it)...

Using SpamAssassin results cache

Connected to SpamAssassin cache database

config: SpamAssassin failed to parse line, "/usr/local/bin/dccproc" is not
valid for "dcc_path", skipping: dcc_path /usr/local/bin/dccproc

SpamAssassin reported an error.

LibClamAV Warning:
***********************************************************

LibClamAV Warning: ***  This version of the ClamAV engine is outdated.
***

LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq
***

LibClamAV Warning:
***********************************************************

LibClamAV Warning:
***********************************************************

LibClamAV Warning: ***  This version of the ClamAV engine is outdated.
***

LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq
***

LibClamAV Warning:
***********************************************************

Connected to Processing Attempts Database

Created Processing Attempts Database successfully

There are 5223 messages in the Processing Attempts Database

Using locktype = posix

MailScanner.conf says "Virus Scanners = clamavmodule"

Found these virus scanners installed: clamavmodule

===========================================================================

Filename Checks: Windows/DOS Executable (1 eicar.com)

Other Checks: Found 1 problems

Virus and Content Scanning: Starting

ClamAVModule::INFECTED:: Eicar-Test-Signature:: ./1/eicar.com

Virus Scanning: ClamAVModule found 1 infections

Infected message 1 came from 10.1.1.1

Virus Scanning: Found 1 viruses

===========================================================================

 

If any of your virus scanners (clamavmodule)

are not listed there, you should check that they are installed correctly

and that MailScanner is finding them correctly via its virus.scanners.conf.

Config: calling custom end function SQLBlacklist

Closing down by-domain spam blacklist

Config: calling custom end function MailWatchLogging

Config: calling custom end function SQLWhitelist

Closing down by-domain spam whitelist

[root at outbound ~]# 

 

 

Regards,

B~Mork

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110803/340ea08e/attachment.html