Random CLAMAV error killing MailScanner

[Anthony Cartmell]

Last night I noticed exactly 50 messages failing to be processed. Oddly
six of these were duplicate copies of a message sent to me that were
processed and delivered without trouble. It was only one of the three
recipients (a local server mail account) that didn't get the message
delivered: it would seem that the message itself wasn't the problem.

The first processing attempt I get this error in the maillog:

Sep 22 03:51:31 gus MailScanner[13973]: Clamd::ERROR:: UNKNOWN CLAMD
RETURN ./t8M2nAIC012697.header/Access denied. ERROR ::
/var/spool/MailScanner/incoming/13973

but then MailScanner tries five more attempts, and on the repeated
attempts this error is not repeated. The message is then quarantined.

Sep 22 03:52:54 gus MailScanner[14389]: Making attempt 2 at processing
message t8M2nAIC012697
Sep 22 03:58:30 gus MailScanner[16248]: Making attempt 3 at processing
message t8M2nAIC012697
Sep 22 04:03:00 gus MailScanner[18438]: Making attempt 4 at processing
message t8M2nAIC012697
Sep 22 04:05:12 gus MailScanner[19789]: Making attempt 5 at processing
message t8M2nAIC012697
Sep 22 04:10:50 gus MailScanner[22281]: Making attempt 6 at processing
message t8M2nAIC012697
Sep 22 04:10:56 gus MailScanner[22382]: Warning: skipping message
t8M2nAIC012697 as it has been attempted too many times
Sep 22 04:10:56 gus MailScanner[22382]: Quarantined message
t8M2nAIC012697 as it caused MailScanner to crash several times
Sep 22 04:10:56 gus MailScanner[22382]: Saved entire message to
/var/spool/MailScanner/quarantine/20150922/t8M2nAIC012697

Looks like an odd permission problem, but this is on a server that has
been running MailScanner happily for years. CentOS 6.7, MailScanner
4.84.5, no SELinux.

Anyone seen this before?

Anthony
-- 
www.fonant.com - Quality web sites
Tel. 01903 867 810
Fonant Ltd is registered in England and Wales, company No. 7006596
Registered office: Amelia House, Crescent Road, Worthing, West Sussex,
BN11 1QR