<p>What is the debug result for a gtube run, not eicar as you showed that to be fine...?<br>
The processing db thing kind of indicate that something is killing ms.</p>
<p>Cheers<br>
-- <br>
-- Glenn</p>
<div class="gmail_quote">Den 23 aug 2011 00:12 skrev "John Bull" <<a href="mailto:jbull@esd113.org">jbull@esd113.org</a>>:<br type="attribution">> List,<br>> <br>> Testing Lab - Installation specifics:<br>
> MailScanner-4.84.3-1.rpm.tar<br>> Postfix 2.6.6<br>> Scientific Linux 6.1, perl 5.10.1<br>> High scoring spam is set to: store and notify<br>> <br>> Problem:<br>> Email with gtube spam test remains in the Postfix hold queue and is not delivered to the spam quarantine.<br>
> <br>> # postqueue -p<br>> -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------<br>> EFF9C4EB9! 755 Mon Aug 22 13:22:51 jbull@esd113.lab<br>> tone@test.lab<mailto:<a href="mailto:tone@test.lab">tone@test.lab</a>><br>
> <br>> MailScanner successfully creates /var/Spool/MailScanner/quarantine/<date>/spam<br>> but the email never makes it there.<br>> <br>> Directory Permissions:<br>> chown -R postfix.clamav /var/spool/MailScanner/incoming<br>
> chmod -R 770 /var/spool/MailScanner/incoming<br>> chown postfix.postfix /var/spool/MailScanner/incoming/SpamAssassin.cache.db<br>> chown postfix.postfix -R /var/spool/MailScanner/incoming/SpamAssassin-Temp<br>> chown postfix.postfix /var/spool/MailScanner/incoming/Processing.db<br>
> <br>> chown -R postfix.apache /var/spool/MailScanner/quarantine<br>> chmod 770 -R /var/spool/MailScanner/quarantine<br>> <br>> mkdir /var/spool/MailScanner/spamassassin<br>> chown -R postfix:postfix /var/spool/MailScanner/spamassassin<br>
> chmod -R 770 /var/spool/MailScanner/spamassassin<br>> <br>> MailScanner Config<br>> Run As User = postfix<br>> Run As Group = postfix<br>> Incoming Queue Dir = /var/spool/postfix/hold<br>> Outgoing Queue Dir = /var/spool/postfix/incoming<br>
> Incoming Work Dir = /var/spool/MailScanner/incoming<br>> MTA = postfix<br>> Sendmail = /usr/sbin/sendmail.postfix<br>> Incoming Work Group = clamav<br>> Incoming Work Permissions = 0644<br>> Quarantine User = postfix<br>
> Quarantine Group = apache<br>> Quarantine Permissions = 0660<br>> Virus Scanners = clamd<br>> Quarantine Infections = no<br>> Quarantine Whole Message = yes<br>> Quarantine Whole Messages As Queue Files = no<br>
> Keep Spam And MCP Archive Clean = yes<br>> Spam Checks = yes<br>> Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules<br>> Is Definitely Spam = %rules-dir%/spam.blacklist.rules<br>> Definite Spam Is High Scoring = yes<br>
> Use SpamAssassin = yes<br>> Required SpamAssassin Score = 4.75<br>> High SpamAssassin Score = 6<br>> Spam Score = yes<br>> Spam Actions = deliver<br>> High Scoring Spam Actions = store notify<br>> <br>
> <br>> Maillog:<br>> Spam Checks: Starting<br>> Aug 22 13:26:06 opened MailScanner[2548]: Message EFF9C4EB9.A5C23 from 192.168.0.110 (jbull@esd113.lab) to test.lab is spam, SpamAssassin (score=1001.99, required 4.75, autolearn=disabled, ALL_TRUSTED -1.00, DCC_CHECK 3.00, GTUBE 1000.00, T_RP_MATCHES_RCVD -0.01)<br>
> Aug 22 13:26:06 opened MailScanner[2548]: Spam Checks: Found 1 spam messages<br>> Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: message EFF9C4EB9.A5C23 actions are store,notify<br>> Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: Notify tone@test.lab<mailto:<a href="mailto:tone@test.lab">tone@test.lab</a>><br>
> <br>> : Warning: skipping message EFF9C4EB9.A5C23 as it has been attempted too many times<br>> Aug 22 13:46:35 opened MailScanner[3396]: Quarantined message EFF9C4EB9.A5C23 as it caused MailScanner to crash several times<br>
> <br>> MailScanner --processing<br>> Currently being processed:<br>> <br>> Number of messages: 1<br>> Tries Message Next Try At<br>> ===== ======= ===========<br>> 6 EFF9C4EB9.A5C23 Mon Aug 22 13:49:34 2011<br>
> <br>> # MailScanner --lint --debug<br>> Trying to setlogsock(unix)<br>> <br>> Reading configuration file /etc/MailScanner/MailScanner.conf<br>> Reading configuration file /etc/MailScanner/conf.d/README<br>
> Read 867 hostnames from the phishing whitelist<br>> Read 4076 hostnames from the phishing blacklists<br>> <br>> Checking version numbers...<br>> Version number in MailScanner.conf (4.84.3) is correct.<br>
> MailScanner setting GID to (89)<br>> MailScanner setting UID to (89)<br>> <br>> Checking for SpamAssassin errors (if you use it)...<br>> Using SpamAssassin results cache<br>> Connected to SpamAssassin cache database<br>
> SpamAssassin reported no errors.<br>> Connected to Processing Attempts Database<br>> Created Processing Attempts Database successfully<br>> There is 1 message in the Processing Attempts Database<br>> Using locktype = posix<br>
> MailScanner.conf says "Virus Scanners = clamd"<br>> Found these virus scanners installed: clamd<br>> ===========================================================================<br>> Filename Checks: Windows/DOS Executable (1 <a href="http://eicar.com">eicar.com</a>)<br>
> Other Checks: Found 1 problems<br>> Virus and Content Scanning: Starting<br>> Clamd::INFECTED:: Eicar-Test-Signature :: ./1/<a href="http://eicar.com">eicar.com</a><br>> Virus Scanning: Clamd found 2 infections<br>
> Infected message 1 came from 10.1.1.1<br>> Virus Scanning: Found 2 viruses<br>> ===========================================================================<br>> Virus Scanner test reports:<br>> Clamd said "<a href="http://eicar.com">eicar.com</a> was infected: Eicar-Test-Signature"<br>
> <br>> If any of your virus scanners (clamd)<br>> are not listed there, you should check that they are installed correctly<br>> and that MailScanner is finding them correctly via its virus.scanners.conf.<br>> <br>
> Thank you,<br>> John<br></div>