<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Hello All</div><div><br></div><div>I hope you can shed some light on the below issue</div><div><br></div><div>This is a new install of MailScanner 4.79.5</div><div>FreeBSD 8.0 amd64</div><div>postfix-2.6.5,1</div><div>p5-Mail-SpamAssassin-3.2.5_4</div><div>clamav-0.95.3</div><div><br></div><div>All the effected mails seem to have attachments, mail sizes vary most are over 200kb but some are only 80kb</div><div>most seem to be word docs both .doc and .docx </div><div>I have turned off OLE scans to see if that was a part of the problem </div><div><br></div><div>ClamAVmodule Maximum File Size = 5000000 # (5 Mbytes) </div><div><br></div><div><div>Max Spam Check Size = 40k</div><div>Max SpamAssassin Size = 40k</div><div>Max Custom Spam Scanner Size = 40k</div><div><br></div></div><div><br></div><div><br></div><div>the Server is a Xeon 2Ghz quad core 4 GB RAM</div><div>it averages about 95% idle with about 2.5GB free RAM although when clamscan is running it might drop down to about 80% idle </div><div><br></div><div>I can turn on the debug option but its not every mail that has this issue its probably 1 out of every 100 to 150 messages. so it might take some time to trigger the problem</div><div><br></div><div>the below message was 333.6kb</div><div><br></div><div>From MailWatch interface:</div><div><br></div><div>Subject: <i>removed to protect the innocent</i><br>
MIME-Version: 1.0<br>
Content-Type: multipart/mixed;<br>
boundary="----_=_NextPart_001_01CA9B73.4F7F8242"<br>
Date: Fri, 22 Jan 2010 16:58:08 +0200<br>
Message-ID:
<<a href="mailto:B8ADB5A39790EF41901A5F105DB2CB8DB43CCD@server.Hi-tech.local">B8ADB5A39790EF41901A5F105DB2CB8DB43CCD@server.Hi-tech.local</a>><br>
Content-class: urn:content-classes:message<br>
X-MimeOLE: Produced By Microsoft Exchange V6.5<br>
X-MS-Has-Attach: <br>
X-MS-TNEF-Correlator: <br>
Thread-Topic: <span class="Apple-style-span" style="font-style: italic; ">removed to protect the innocent</span> <br>
Thread-Index: AcgMB3G2oM864RICTwyR1vhZ6+t5JwAAI2GAPhemM7A=<br>
X-Priority: 1<br>
Priority: Urgent<br>
Importance: high</div><div><br></div><div>From maillog</div><div><br></div><div>Jan 22 16:54:42 mailav02 postfix/cleanup[12659]: EC4A71761FFF: message-id=<<a href="mailto:B8ADB5A39790EF41901A5F105DB2CB8DB43CCD@server.Hi-tech.local">B8ADB5A39790EF41901A5F105DB2CB8DB43CCD@server.Hi-tech.local</a>></div><div>Jan 22 17:00:26 mailav02 MailScanner[14816]: Making attempt 2 at processing message EC4A71761FFF.00000 </div><div>Jan 22 17:05:25 mailav02 MailScanner[14819]: Making attempt 3 at processing message EC4A71761FFF.00000 </div><div>Jan 22 17:10:25 mailav02 MailScanner[14900]: Making attempt 4 at processing message EC4A71761FFF.00000 </div><div>Jan 22 17:12:47 mailav02 MailScanner[15034]: Making attempt 5 at processing message EC4A71761FFF.00000 </div><div>Jan 22 17:18:32 mailav02 MailScanner[14985]: Making attempt 6 at processing message EC4A71761FFF.00000 </div><div>Jan 22 17:18:33 mailav02 MailScanner[15120]: Warning: skipping message EC4A71761FFF.00000 as it has been attempted too many times </div><div>Jan 22 17:18:33 mailav02 MailScanner[15120]: Quarantined message EC4A71761FFF.00000 as it caused MailScanner to crash several times </div><div>Jan 22 17:18:33 mailav02 MailScanner[15120]: Saved entire message to /var/spool/MailScanner/quarantine/20100122/EC4A71761FFF.00000 </div><div>Jan 22 17:18:33 mailav02 MailScanner[15120]: Logging message EC4A71761FFF.00000 to SQL</div><div><br></div><div>Regards, </div><div><br></div><div>Lyndon</div><div><br></div><div><br></div><br />--
<br />This message has been scanned for viruses and dangerous content by the
<br /><b>Mexcom MailScanner</b></a>, and appears to be clean.
<br />Should you wish to secure your mail, call sales @ 011-801-4000, alternatively visit
<br />http://www.mexcom.co.za or mail sales@mexcom.co.za
</body></html>