I encounter such problem before. any Zip archive would cause my MailScanner to crash. When I run ms in debug mode, I got this error:<br>====================================================<br><pre>Insecure dependency in chmod while running with -T switch at /usr/share/perl5/Archive/Zip/Member.pm line 490.<br>
============================================================<br><br>This was due to a bug in the perl Arhive::Zip module. then I foud a patch at <a href="https://rt.cpan.org/Public/Bug/Display.html?id=61930">https://rt.cpan.org/Public/Bug/Display.html?id=61930</a> .<br>
, after applying that patch, the problem gone. Hope this information useful.<br></pre><div class="gmail_quote">2010/12/30 Johnson, SE <span dir="ltr"><<a href="mailto:sjohnson@edina.k12.mn.us">sjohnson@edina.k12.mn.us</a>></span><br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">Ok, I disabled virus checking and I still have the issue. Any ZIP<br>
extension causes a crash. I was also told that .DOCX extensions cause<br>
the issue but I have no way of testing that...<br>
<br>
I would assume that numerous other people would be having this issue if<br>
it were a bug...<br>
<br>
Anyone have any ideas on what is going on with this?<br>
<div class="im"><br>
-----Original Message-----<br>
From: <a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a><br>
[mailto:<a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a>] On Behalf Of<br>
Johnson, SE<br>
</div><div><div></div><div class="h5">Sent: Wednesday, December 29, 2010 3:11 PM<br>
To: MailScanner discussion<br>
Subject: RE: MailScanner crashing<br>
<br>
I FINALLY got it to fail (duplicate the issue) on demand.<br>
<br>
It seems to have to deal with .ZIP extensions and files that may have<br>
"double extensions" eg: studentlist.prn.pdf<br>
<br>
This is the reply message I get back from the mailscanner:<br>
Our virus detector failed to completely analyse a message you sent:-<br>
To: <a href="mailto:me@here.com">me@here.com</a><br>
Subject: test with a zip file<br>
Date: Wed Dec 29 14:55:32 2010<br>
Any parts of the message that could not be analysed will not have been<br>
delivered.<br>
<br>
If you are using Microsoft Outlook, we strongly recommend you change<br>
your outgoing message format from "Rich Text" to "HTML" or "Plain Text".<br>
<br>
1) Click on the "Tools" menu and choose "Options..."<br>
2) Go to the "Mail Format" tab<br>
3) For message format, select "HTML" or "Plain text"<br>
4) Click OK<br>
<br>
The virus detector said this about the message:<br>
Report: Report: MailScanner: Message attempted to kill MailScanner<br>
<br>
Is this my CLAMAV causing the issue?<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a><br>
[mailto:<a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a>] On Behalf Of<br>
Johnson, SE<br>
Sent: Wednesday, December 29, 2010 1:38 PM<br>
To: MailScanner discussion<br>
Subject: RE: MailScanner crashing<br>
<br>
Here's a copy of the whole maillog where the message is processed:<br>
<br>
Dec 29 13:23:18 mailfilter MailScanner[21060]: New Batch: Found 6<br>
messages waiting<br>
<br>
Dec 29 13:23:18 mailfilter MailScanner[21060]: New Batch: Scanning 1<br>
messages, 622326 bytes<br>
<br>
Dec 29 13:23:19 mailfilter MailScanner[21060]: Sender Warnings:<br>
Delivered 1 warnings to virus senders<br>
<br>
Dec 29 13:23:19 mailfilter MailScanner[21060]: Notices: Warned about 1<br>
messages<br>
<br>
Dec 29 13:23:19 mailfilter MailScanner[21060]: Deleted 1 messages from<br>
processing-database<br>
<br>
Dec 29 13:23:19 mailfilter MailScanner[21060]: Logging message<br>
1B40140A9A.AEEAC to SQL<br>
<br>
Dec 29 13:23:19 mailfilter MailScanner[21060]: New Batch: Found 6<br>
messages waiting<br>
<br>
Dec 29 13:23:19 mailfilter MailScanner[21060]: New Batch: Scanning 1<br>
messages, 2120 bytes<br>
<br>
Dec 29 13:23:19 mailfilter MailScanner[21060]: Virus and Content<br>
Scanning: Starting<br>
<br>
Dec 29 13:23:20 mailfilter MailScanner[21060]: Requeue: 2196B40A9A.A4045<br>
to E75AE4115A<br>
<br>
Dec 29 13:23:20 mailfilter MailScanner[21060]: Uninfected: Delivered 1<br>
messages<br>
<br>
Dec 29 13:23:20 mailfilter MailScanner[21060]: Deleted 1 messages from<br>
processing-database<br>
<br>
Dec 29 13:23:20 mailfilter MailScanner[21060]: Logging message<br>
2196B40A9A.A4045 to SQL<br>
<br>
Dec 29 13:23:32 mailfilter MailScanner[21060]: Warning: skipping message<br>
1EB5340A9B.AF498 as it has been attempted too many times<br>
<br>
Dec 29 13:23:32 mailfilter MailScanner[21060]: Quarantined message<br>
1EB5340A9B.AF498 as it caused MailScanner to crash several times<br>
<br>
Dec 29 13:23:32 mailfilter MailScanner[21060]: Saved entire message to<br>
/var/spool/MailScanner/quarantine/20101229/1EB5340A9B.AF498<br>
<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a><br>
[mailto:<a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a>] On Behalf Of<br>
Johnson, SE<br>
Sent: Wednesday, December 29, 2010 1:30 PM<br>
To: MailScanner discussion<br>
Subject: RE: MailScanner crashing<br>
<br>
Oh, version 4.81.4<br>
<br>
Its running on Red Hat core 13 (on a VM server), processor is 1.76ghz<br>
2gb ram and about 200gb HD space.<br>
[root@mailfilter ~]# MailScanner --version<br>
Running on<br>
Linux mailfilter 2.6.34.7-66.fc13.x86_64 #1 SMP Wed Dec 15 07:04:30 UTC<br>
2010 x86_64 x86_64 x86_64 GNU/Linux<br>
This is Fedora release 13 (Goddard)<br>
This is Perl version 5.010001 (5.10.1)<br>
<br>
This is MailScanner version 4.81.4<br>
Module versions are:<br>
1.00 AnyDBM_File<br>
1.30 Archive::Zip<br>
0.23 bignum<br>
1.11 Carp<br>
2.03 Compress::Zlib<br>
1.119 Convert::BinHex<br>
0.17 Convert::TNEF<br>
2.124 Data::Dumper<br>
2.30 Date::Parse<br>
1.03 DirHandle<br>
1.06 Fcntl<br>
2.77 File::Basename<br>
2.14 File::Copy<br>
2.02 FileHandle<br>
2.08 File::Path<br>
0.22 File::Temp<br>
0.92 Filesys::Df<br>
3.68 HTML::Entities<br>
3.68 HTML::Parser<br>
3.57 HTML::TokeParser<br>
1.25 IO<br>
1.14 IO::File<br>
1.13 IO::Pipe<br>
2.06 Mail::Header<br>
1.89 Math::BigInt<br>
0.22 Math::BigRat<br>
3.08 MIME::Base64<br>
5.428 MIME::Decoder<br>
5.428 MIME::Decoder::UU<br>
5.428 MIME::Head<br>
5.428 MIME::Parser<br>
3.08 MIME::QuotedPrint<br>
5.428 MIME::Tools<br>
0.13 Net::CIDR<br>
1.25 Net::IP<br>
0.19 OLE::Storage_Lite<br>
1.04 Pod::Escapes<br>
3.07 Pod::Simple<br>
1.17 POSIX<br>
1.21 Scalar::Util<br>
1.82 Socket<br>
2.20 Storable<br>
1.4 Sys::Hostname::Long<br>
0.27 Sys::Syslog<br>
1.44 Test::Pod<br>
0.94 Test::Simple<br>
1.9719 Time::HiRes<br>
1.02 Time::localtime<br>
<br>
Optional module versions are:<br>
1.62 Archive::Tar<br>
0.23 bignum<br>
2.05 Business::ISBN<br>
20081208 Business::ISBN::Data<br>
1.19 Data::Dump<br>
1.82 DB_File<br>
1.29 DBD::SQLite<br>
1.609 DBI<br>
1.16 Digest<br>
1.02 Digest::HMAC<br>
2.39 Digest::MD5<br>
2.12 Digest::SHA1<br>
1.01 Encode::Detect<br>
0.17016 Error<br>
0.2802 ExtUtils::CBuilder<br>
2.2206 ExtUtils::ParseXS<br>
2.38 Getopt::Long<br>
0.46 Inline<br>
1.08 IO::String<br>
1.10 IO::Zlib<br>
2.27 IP::Country<br>
0.29 Mail::ClamAV<br>
3.003001 Mail::SpamAssassin<br>
v2.006 Mail::SPF<br>
missing Mail::SPF::Query<br>
0.3607 Module::Build<br>
0.21 Net::CIDR::Lite<br>
0.65 Net::DNS<br>
v0.003 Net::DNS::Resolver::Programmable<br>
0.4001 Net::LDAP<br>
4.027 NetAddr::IP<br>
1.965001 Parse::RecDescent<br>
missing SAVI<br>
3.17 Test::Harness<br>
1.23 Test::Manifest<br>
2.0.0 Text::Balanced<br>
1.54 URI<br>
0.82 version<br>
0.72 YAML<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a><br>
[mailto:<a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a>] On Behalf Of<br>
Johnson, SE<br>
Sent: Wednesday, December 29, 2010 12:14 PM<br>
To: MailScanner discussion<br>
Subject: RE: MailScanner crashing<br>
<br>
Update on that error...<br>
<br>
I let the<br>
MailScanner --debug ID=[messageid]<br>
run over night and it came back to a prompt with no errors. However,<br>
I'm not sure if the message was ultimately delivered.<br>
<br>
The crash is happening at the rate of about 2 / hour and the vast<br>
majority of messages are legitimate which is not good...<br>
<br>
Any ideas on what's going? I could really use some assistance on this<br>
problem...<br>
<br>
Oh one more thing I noticed. I'm not 100% sure if this is true on all<br>
messages stopped, but it appears that they are HTML emails around 35-50k<br>
in size.<br>
<br>
I took the body of one of those emails and sent it from my outside email<br>
account and it worked just fine.<br>
<br>
Thanks!<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a><br>
[mailto:<a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a>] On Behalf Of<br>
Johnson, SE<br>
Sent: Tuesday, December 28, 2010 3:58 PM<br>
To: <a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
Subject: MailScanner crashing<br>
<br>
I've seen a few posts out there but no one with my exact issue...<br>
<br>
Periodically I'm getting the message similar to this in my logs:<br>
<br>
Dec 28 13:27:30 mailfilter MailScanner[27222]: Making attempt 2 at<br>
processing message 872F6416F2.ACB5B<br>
Dec 28 13:36:32 mailfilter MailScanner[27229]: Making attempt 3 at<br>
processing message 872F6416F2.ACB5B<br>
Dec 28 13:41:45 mailfilter MailScanner[30951]: Making attempt 4 at<br>
processing message 872F6416F2.ACB5B<br>
Dec 28 13:44:27 mailfilter MailScanner[31782]: Making attempt 5 at<br>
processing message 872F6416F2.ACB5B<br>
Dec 28 13:51:32 mailfilter MailScanner[1250]: Making attempt 6 at<br>
processing message 872F6416F2.ACB5B<br>
Dec 28 13:51:39 mailfilter MailScanner[1290]: Warning: skipping message<br>
872F6416F2.ACB5B as it has been attempted too many times<br>
Dec 28 13:51:39 mailfilter MailScanner[1290]: Quarantined message<br>
872F6416F2.ACB5B as it caused MailScanner to crash several times<br>
Dec 28 13:51:39 mailfilter MailScanner[1290]: Saved entire message to<br>
/var/spool/MailScanner/quarantine/20101228/872F6416F2.ACB5B<br>
Dec 28 13:52:36 mailfilter MailScanner[1290]: Logging message<br>
872F6416F2.ACB5B to SQL<br>
<br>
I didn't think much of it at first until I realized in the MailWatch<br>
program that many of these messages were legitimate.<br>
<br>
I tried MailScanner --lint which came up clean<br>
spamassassin --lint is clean as well<br>
<br>
I then tried to reprocess one of the messages in the queue with:<br>
MailScanner --debug --ID=[messageid]<br>
(while I was in the quarantine dir)<br>
<br>
The program starts to process it I got<br>
<br>
In Debugging mode, not forking...<br>
Trying to setlogsock(unix)<br>
Building a message batch to scan...<br>
<br>
But it never seems to go past this... I let it sit for over an hour and<br>
it never came back...<br>
<br>
I then found a reference to debug-sa... I ran MailScanner --debug<br>
--debug-sa and got:<br>
15:54:34 Building a message batch to scan...<br>
(long pause)<br>
Then I get the final output with no issues being reported.<br>
<br>
Does anyone know what I can do to find my issue?<br>
Thanks!<br>
Scott<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br>
--<br>
This message has been scanned for viruses and<br>
dangerous content by MailScanner, and is<br>
believed to be clean.<br>
<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br>
--<br>
This message has been scanned for viruses and<br>
dangerous content by MailScanner, and is<br>
believed to be clean.<br>
<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br>
--<br>
This message has been scanned for viruses and<br>
dangerous content by MailScanner, and is<br>
believed to be clean.<br>
<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br>
--<br>
This message has been scanned for viruses and<br>
dangerous content by MailScanner, and is<br>
believed to be clean.<br>
<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br>
--<br>
This message has been scanned for viruses and<br>
dangerous content by MailScanner, and is<br>
believed to be clean.<br>
<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
</div></div></blockquote></div><br>