<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.0.7">
</HEAD>
<BODY>
I'm starting to suspect that something besides MailScanner may be the cause of this mysterious problem.<BR>
<BR>
We have a new install of MailScanner that has been chugging nicely along since Sunday. All of the sudden between 10 & 11 AM EDT the "New Batch: Found ***** messages waiting" started creeping rapidly up. until it reached about 15,000 around 2:00 PM. I've been closely monitoring this server since Sunday and it's never had more than 200 messages queued before. It's no powerhouse, a 1 GHz Pentium with 512 MB RAM but it was chugging nicely along until today.<BR>
<BR>
We're now dropping the queue about 2,000 messages per hour by routing outbound email through another gateway. I can't do a lot of log diagnosis on the system right now because The load is a bit high and I don't want to disrupt the cleanup.<BR>
<BR>
I just think it's strange that all of the sudden so many of us are experiencing the same problem with different versions of MailScanner. Only thing new in my systems logs is the reporting of:
<BLOCKQUOTE>
<TT>Report: ClamAV: patch.exe contains Worm.Dumaru</TT>
</BLOCKQUOTE>
Which started about the same time as the queue backup. From the web:
<BLOCKQUOTE>
<FONT SIZE="3"><TT>"</TT>Dumaru is a mass mailing worm, uses e-mail addresses collected from htm, wab, html, dbx, tbb, abd files to distribute infected messages. Dumaru worm arrives as an e-mail attachment. The infected attachment name will be "<B>patch.exe</B>".<TT>" </TT>
</BLOCKQUOTE>
Can't see why this would cause a problem if we're stopping it, but it's the only apparent anomaly in the logs.<BR>
<BR>
Any ideas?<BR>
<BR>
Steve</FONT>
<PRE><TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
Stephen Swaney<BR>
President<BR>
Fortress Systems, Ltd.<BR>
<A HREF="http://www.FSL.com"><U>www.FSL.com</A><BR>
<A HREF="mailto:Steve.Swaney@fsl.com">Steve.Swaney@FSL.com </U></A><BR>
Phone: 202 338-1670<BR>
Fax:202 448-2969<BR>
U.S. Toll Free Phone and Fax: 877 746-6636
</TD>
</TR>
</TABLE>
</PRE>
</BODY>
<br />--
<br />This message has been scanned for viruses and
<br />dangerous content by MailScanner and Sophos Anti-Virus at
<a href="http://www.FSL.com/"><b>Fortress Systems, Ltd.</b></a>, and is
<br />believed to be clean.
</HTML>