it seems that the messages are kept in /var/spool/postfix/hold:<div><br></div><div><div>[root@mail spool]# ls</div><div>abrt abrt-upload anacron at cron cups gdm lpd mail MailScanner plymouth postfix squirrelmail</div>
<div>[root@mail spool]# find ./ -name CFA4E2003F7.AF18F</div><div>[root@mail spool]# find ./ -name CFA4E*</div><div>./MailScanner/incoming/12112/CFA4E2003F7.AF18F.header</div><div>./MailScanner/incoming/12123/CFA4E2003F7.AF18F.header</div>
<div>./MailScanner/incoming/12074/CFA4E2003F7.AF18F.header</div><div>./MailScanner/incoming/12117/CFA4E2003F7.AF18F.header</div><div>./postfix/hold/CFA4E2003F7</div><div>[root@mail spool]# vim ./postfix/hold/CFA4E2003F7</div>
<div>[root@mail spool]# rm ./postfix/hold/CFA4E2003F7</div><div>rm: remove regular file `./postfix/hold/CFA4E2003F7'? y</div><div>[root@mail spool]# find ./ -name 8C8A92*</div><div>./MailScanner/incoming/12193/8C8A9200026.A2E96.header</div>
<div>./MailScanner/incoming/12198/8C8A9200026.A2E96.header</div><div>./MailScanner/incoming/12209/8C8A9200026.A2E96.header</div><div>./MailScanner/incoming/12204/8C8A9200026.A2E96.header</div><div>./postfix/hold/8C8A9200026</div>
<div>[root@mail spool]# cd postfix/hold/</div><div>[root@mail hold]# ls</div><div>008FA202307 122E720025D 1F79020227D 2B140202195 39C91202297 472432021C8 522E4200210 64DC52021B8 6FA57200253 7A8D1202205 868E9202220 92A3A20219F A0F34202272 AC3CD2021CD B954F20225F C8075202265 D873820228E E8A6A202259</div>
<div>00A80202266 1256C202226 1F7F7202327 2B42A200298 39DDB202291 47E4D20229E 523D120028E 6538920220B 6FBE3202264 7A96B202314 86ECE2022DB 932972001A5 A15782022EC AC8502022F0 B9C8B200295 C83B1200050 D8C1A2022BB E917C200094</div>
<div>01ABC2019F4 125B82021F0 1FF33202316 2BADC2001E4 3ABB52022ED 48791200028 5324F202275 66F492021D0 6FC14200228 7AE4C20010D 8734620009E 947DF202284 A161D200104 AD3372021C1 BA3242001B1 C8D0B202199 D943620220E E9871200299</div>
<div>01BD02022AB ...</div><div><br></div><div>if you remove manually MailScanner goes to the next one, permission issue?</div><br><div class="gmail_quote">On 28 February 2012 07:41, Kocisky <span dir="ltr"><<a href="mailto:kocisky@autistici.org">kocisky@autistici.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>[root@mail incoming]# postconf -d | grep mail_version</div><div>mail_version = 2.6.6</div><div><br></div><div>i see that it crashes on a certain message and doesn't go further (check CFA4E2003F7.AF18F): </div>
<div>
<br></div><div><div>Feb 28 07:44:22 mail MailScanner[11644]: Warning: skipping message CFA4E2003F7.AF18F as it has been attempted too many times</div>
<div>Feb 28 07:44:22 mail MailScanner[11644]: Quarantined message CFA4E2003F7.AF18F as it caused MailScanner to crash several times</div><div>Feb 28 07:44:25 mail MailScanner[11650]: MailScanner E-Mail Virus Scanner version 4.84.3 starting...</div>
<div>Feb 28 07:44:25 mail MailScanner[11650]: Reading configuration file /etc/MailScanner/MailScanner.conf</div><div>Feb 28 07:44:25 mail MailScanner[11650]: Configuration: Failed to find any configuration files like /etc/MailScanner/conf.d/*.conf, skipping them.</div>
<div>Feb 28 07:44:25 mail MailScanner[11650]: Read 869 hostnames from the phishing whitelist</div><div>Feb 28 07:44:25 mail MailScanner[11650]: Read 5352 hostnames from the phishing blacklists</div><div>Feb 28 07:44:25 mail MailScanner[11650]: Config: calling custom init function SQLBlacklist</div>
<div>Feb 28 07:44:25 mail MailScanner[11650]: Starting up SQL Blacklist</div><div>Feb 28 07:44:25 mail MailScanner[11650]: Read 0 blacklist entries</div><div>Feb 28 07:44:25 mail MailScanner[11650]: Config: calling custom init function MailWatchLogging</div>
<div>Feb 28 07:44:25 mail MailScanner[11650]: Started SQL Logging child</div><div>Feb 28 07:44:25 mail MailScanner[11650]: Config: calling custom init function SQLWhitelist</div><div>Feb 28 07:44:25 mail MailScanner[11650]: Starting up SQL Whitelist</div>
<div>Feb 28 07:44:25 mail MailScanner[11650]: Read 0 whitelist entries</div><div>Feb 28 07:44:26 mail MailScanner[11650]: Using SpamAssassin results cache</div><div>Feb 28 07:44:26 mail MailScanner[11650]: Connected to SpamAssassin cache database</div>
<div>Feb 28 07:44:26 mail MailScanner[11650]: Enabling SpamAssassin auto-whitelist functionality...</div><div>Feb 28 07:44:27 mail MailScanner[11650]: Connected to Processing Attempts Database</div><div>Feb 28 07:44:27 mail MailScanner[11650]: Found 615 messages in the Processing Attempts Database</div>
<div>Feb 28 07:44:27 mail MailScanner[11650]: Using locktype = flock</div><div>Feb 28 07:44:27 mail MailScanner[11650]: Warning: skipping message CFA4E2003F7.AF18F as it has been attempted too many times</div><div>Feb 28 07:44:27 mail MailScanner[11650]: Quarantined message CFA4E2003F7.AF18F as it caused MailScanner to crash several times</div>
<div>Feb 28 07:44:30 mail MailScanner[11655]: MailScanner E-Mail Virus Scanner version 4.84.3 starting...</div><div>Feb 28 07:44:30 mail MailScanner[11655]: Reading configuration file /etc/MailScanner/MailScanner.conf</div>
<div>Feb 28 07:44:30 mail MailScanner[11655]: Configuration: Failed to find any configuration files like /etc/MailScanner/conf.d/*.conf, skipping them.</div><div>Feb 28 07:44:30 mail MailScanner[11655]: Read 869 hostnames from the phishing whitelist</div>
<div>Feb 28 07:44:30 mail MailScanner[11655]: Read 5352 hostnames from the phishing blacklists</div><div>Feb 28 07:44:30 mail MailScanner[11655]: Config: calling custom init function SQLBlacklist</div><div>Feb 28 07:44:30 mail MailScanner[11655]: Starting up SQL Blacklist</div>
<div>Feb 28 07:44:30 mail MailScanner[11655]: Read 0 blacklist entries</div><div>Feb 28 07:44:30 mail MailScanner[11655]: Config: calling custom init function MailWatchLogging</div><div>Feb 28 07:44:30 mail MailScanner[11655]: Started SQL Logging child</div>
<div>Feb 28 07:44:30 mail MailScanner[11655]: Config: calling custom init function SQLWhitelist</div><div>Feb 28 07:44:30 mail MailScanner[11655]: Starting up SQL Whitelist</div><div>Feb 28 07:44:30 mail MailScanner[11655]: Read 0 whitelist entries</div>
<div>Feb 28 07:44:31 mail MailScanner[11655]: Using SpamAssassin results cache</div><div>Feb 28 07:44:31 mail MailScanner[11655]: Connected to SpamAssassin cache database</div><div>Feb 28 07:44:31 mail MailScanner[11655]: Enabling SpamAssassin auto-whitelist functionality...</div>
<div>Feb 28 07:44:32 mail MailScanner[11655]: Connected to Processing Attempts Database</div><div>Feb 28 07:44:32 mail MailScanner[11655]: Found 615 messages in the Processing Attempts Database</div><div>Feb 28 07:44:32 mail MailScanner[11655]: Using locktype = flock</div>
<div>Feb 28 07:44:32 mail MailScanner[11655]: Warning: skipping message CFA4E2003F7.AF18F as it has been attempted too many times</div><div>Feb 28 07:44:32 mail MailScanner[11655]: Quarantined message CFA4E2003F7.AF18F as it caused MailScanner to crash several times</div>
<div>Feb 28 07:44:35 mail MailScanner[11661]: MailScanner E-Mail Virus Scanner version 4.84.3 starting...</div><div>Feb 28 07:44:35 mail MailScanner[11661]: Reading configuration file /etc/MailScanner/MailScanner.conf</div>
<div>Feb 28 07:44:35 mail MailScanner[11661]: Configuration: Failed to find any configuration files like /etc/MailScanner/conf.d/*.conf, skipping them.</div><div>Feb 28 07:44:35 mail MailScanner[11661]: Read 869 hostnames from the phishing whitelist</div>
<div>Feb 28 07:44:35 mail MailScanner[11661]: Read 5352 hostnames from the phishing blacklists</div><div>Feb 28 07:44:35 mail MailScanner[11661]: Config: calling custom init function SQLBlacklist</div><div>Feb 28 07:44:35 mail MailScanner[11661]: Starting up SQL Blacklist</div>
<div>Feb 28 07:44:35 mail MailScanner[11661]: Read 0 blacklist entries</div><div>Feb 28 07:44:35 mail MailScanner[11661]: Config: calling custom init function MailWatchLogging</div><div>Feb 28 07:44:35 mail MailScanner[11661]: Started SQL Logging child</div>
<div>Feb 28 07:44:35 mail MailScanner[11661]: Config: calling custom init function SQLWhitelist</div><div>Feb 28 07:44:35 mail MailScanner[11661]: Starting up SQL Whitelist</div><div>Feb 28 07:44:35 mail MailScanner[11661]: Read 0 whitelist entries</div>
<div>Feb 28 07:44:36 mail MailScanner[11661]: Using SpamAssassin results cache</div><div>Feb 28 07:44:36 mail MailScanner[11661]: Connected to SpamAssassin cache database</div><div>Feb 28 07:44:36 mail MailScanner[11661]: Enabling SpamAssassin auto-whitelist functionality...</div>
<div>Feb 28 07:44:37 mail MailScanner[11661]: Connected to Processing Attempts Database</div><div>Feb 28 07:44:37 mail MailScanner[11661]: Found 615 messages in the Processing Attempts Database</div><div>Feb 28 07:44:37 mail MailScanner[11661]: Using locktype = flock</div>
<div>Feb 28 07:44:37 mail MailScanner[11661]: Warning: skipping message CFA4E2003F7.AF18F as it has been attempted too many times</div><div>Feb 28 07:44:37 mail MailScanner[11661]: Quarantined message CFA4E2003F7.AF18F as it caused MailScanner to crash several times</div>
<div>Feb 28 07:44:40 mail MailScanner[11666]: MailScanner E-Mail Virus Scanner version 4.84.3 starting...</div></div><div class="HOEnZb"><div class="h5"><div><br></div><br><div class="gmail_quote">On 28 February 2012 07:24, Kocisky <span dir="ltr"><<a href="mailto:kocisky@autistici.org" target="_blank">kocisky@autistici.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">postfix, below some additional info:<div><br></div><div><div>MailScanner --version</div><div>Running on</div><div>Linux mail 2.6.32-71.29.1.el6.centos.plus.x86_64 #1 SMP Sun Jun 26 16:27:27 BST 2011 x86_64 x86_64 x86_64 GNU/Linux</div>
<div>This is CentOS release 6.2 (Final)</div><div>This is Perl version 5.010001 (5.10.1)</div><div><br></div><div>This is MailScanner version 4.84.3</div><div>Module versions are:</div><div>1.00<span style="white-space:pre-wrap"> </span>AnyDBM_File</div>
<div>1.30<span style="white-space:pre-wrap"> </span>Archive::Zip</div><div>0.23<span style="white-space:pre-wrap"> </span>bignum</div><div>1.11<span style="white-space:pre-wrap"> </span>Carp</div>
<div>2.02<span style="white-space:pre-wrap"> </span>Compress::Zlib</div><div>1.119 <span style="white-space:pre-wrap"> </span>Convert::BinHex</div><div>0.17<span style="white-space:pre-wrap"> </span>Convert::TNEF</div>
<div>2.124<span style="white-space:pre-wrap"> </span>Data::Dumper</div><div>2.27<span style="white-space:pre-wrap"> </span>Date::Parse</div><div>1.03<span style="white-space:pre-wrap"> </span>DirHandle</div>
<div>1.06<span style="white-space:pre-wrap"> </span>Fcntl</div><div>2.77<span style="white-space:pre-wrap"> </span>File::Basename</div><div>2.14<span style="white-space:pre-wrap"> </span>File::Copy</div>
<div>2.02<span style="white-space:pre-wrap"> </span>FileHandle</div><div>2.08<span style="white-space:pre-wrap"> </span>File::Path</div><div>0.22<span style="white-space:pre-wrap"> </span>File::Temp</div>
<div>0.92<span style="white-space:pre-wrap"> </span>Filesys::Df</div><div>3.64<span style="white-space:pre-wrap"> </span>HTML::Entities</div><div>3.64<span style="white-space:pre-wrap"> </span>HTML::Parser</div>
<div>3.57<span style="white-space:pre-wrap"> </span>HTML::TokeParser</div><div>1.25<span style="white-space:pre-wrap"> </span>IO</div><div>1.14<span style="white-space:pre-wrap"> </span>IO::File</div>
<div>1.13<span style="white-space:pre-wrap"> </span>IO::Pipe</div><div>2.04<span style="white-space:pre-wrap"> </span>Mail::Header</div><div>1.89<span style="white-space:pre-wrap"> </span>Math::BigInt</div>
<div>0.22<span style="white-space:pre-wrap"> </span>Math::BigRat</div><div>3.08<span style="white-space:pre-wrap"> </span>MIME::Base64</div><div>5.427<span style="white-space:pre-wrap"> </span>MIME::Decoder</div>
<div>5.427<span style="white-space:pre-wrap"> </span>MIME::Decoder::UU</div><div>5.427<span style="white-space:pre-wrap"> </span>MIME::Head</div><div>5.427<span style="white-space:pre-wrap"> </span>MIME::Parser</div>
<div>3.08<span style="white-space:pre-wrap"> </span>MIME::QuotedPrint</div><div>5.427<span style="white-space:pre-wrap"> </span>MIME::Tools</div><div>0.14<span style="white-space:pre-wrap"> </span>Net::CIDR</div>
<div>1.25<span style="white-space:pre-wrap"> </span>Net::IP</div><div>0.19<span style="white-space:pre-wrap"> </span>OLE::Storage_Lite</div><div>1.04<span style="white-space:pre-wrap"> </span>Pod::Escapes</div>
<div>3.13<span style="white-space:pre-wrap"> </span>Pod::Simple</div><div>1.17<span style="white-space:pre-wrap"> </span>POSIX</div><div>1.21<span style="white-space:pre-wrap"> </span>Scalar::Util</div>
<div>1.82<span style="white-space:pre-wrap"> </span>Socket</div><div>2.20<span style="white-space:pre-wrap"> </span>Storable</div><div>1.4<span style="white-space:pre-wrap"> </span>Sys::Hostname::Long</div>
<div>0.27<span style="white-space:pre-wrap"> </span>Sys::Syslog</div><div>1.40<span style="white-space:pre-wrap"> </span>Test::Pod</div><div>0.92<span style="white-space:pre-wrap"> </span>Test::Simple</div>
<div>1.9721<span style="white-space:pre-wrap"> </span>Time::HiRes</div><div>1.02<span style="white-space:pre-wrap"> </span>Time::localtime</div><div><br></div><div>Optional module versions are:</div>
<div>1.58<span style="white-space:pre-wrap"> </span>Archive::Tar</div><div>0.23<span style="white-space:pre-wrap"> </span>bignum</div><div>missing<span style="white-space:pre-wrap"> </span>Business::ISBN</div>
<div>missing<span style="white-space:pre-wrap"> </span>Business::ISBN::Data</div><div>missing<span style="white-space:pre-wrap"> </span>Data::Dump</div><div>1.82<span style="white-space:pre-wrap"> </span>DB_File</div>
<div>1.27<span style="white-space:pre-wrap"> </span>DBD::SQLite</div><div>1.609<span style="white-space:pre-wrap"> </span>DBI</div><div>1.16<span style="white-space:pre-wrap"> </span>Digest</div>
<div>1.01<span style="white-space:pre-wrap"> </span>Digest::HMAC</div><div>2.39<span style="white-space:pre-wrap"> </span>Digest::MD5</div><div>2.12<span style="white-space:pre-wrap"> </span>Digest::SHA1</div>
<div>1.01<span style="white-space:pre-wrap"> </span>Encode::Detect</div><div>missing<span style="white-space:pre-wrap"> </span>Error</div><div>0.27<span style="white-space:pre-wrap"> </span>ExtUtils::CBuilder</div>
<div>2.2203<span style="white-space:pre-wrap"> </span>ExtUtils::ParseXS</div><div>2.38<span style="white-space:pre-wrap"> </span>Getopt::Long</div><div>missing<span style="white-space:pre-wrap"> </span>Inline</div>
<div>missing<span style="white-space:pre-wrap"> </span>IO::String</div><div>1.09<span style="white-space:pre-wrap"> </span>IO::Zlib</div><div>missing<span style="white-space:pre-wrap"> </span>IP::Country</div>
<div>missing<span style="white-space:pre-wrap"> </span>Mail::ClamAV</div><div>3.003001<span style="white-space:pre-wrap"> </span>Mail::SpamAssassin</div><div>missing<span style="white-space:pre-wrap"> </span>Mail::SPF</div>
<div>missing<span style="white-space:pre-wrap"> </span>Mail::SPF::Query</div><div>0.35<span style="white-space:pre-wrap"> </span>Module::Build</div><div>missing<span style="white-space:pre-wrap"> </span>Net::CIDR::Lite</div>
<div>0.65<span style="white-space:pre-wrap"> </span>Net::DNS</div><div>missing<span style="white-space:pre-wrap"> </span>Net::DNS::Resolver::Programmable</div><div>missing<span style="white-space:pre-wrap"> </span>Net::LDAP</div>
<div> 4.027<span style="white-space:pre-wrap"> </span>NetAddr::IP</div><div>missing<span style="white-space:pre-wrap"> </span>Parse::RecDescent</div><div>missing<span style="white-space:pre-wrap"> </span>SAVI</div>
<div>3.17<span style="white-space:pre-wrap"> </span>Test::Harness</div><div>missing<span style="white-space:pre-wrap"> </span>Test::Manifest</div><div>2.0.0<span style="white-space:pre-wrap"> </span>Text::Balanced</div>
<div>1.40<span style="white-space:pre-wrap"> </span>URI</div><div>0.77<span style="white-space:pre-wrap"> </span>version</div><div>missing<span style="white-space:pre-wrap"> </span>YAML</div>
<div>[root@mail ~]#</div><div><div><br><div class="gmail_quote">On 27 February 2012 23:50, Andrew Colin Kissa <span dir="ltr"><<a href="mailto:andrew@topdog.za.net" target="_blank">andrew@topdog.za.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><br>
On 28 Feb 2012, at 5:51 AM, Kocisky wrote:<br>
<br>
> let me take it back... it still crashes, i still have the error:<br>
><br>
> [root@mail ~]# MailScanner --debug<br>
><br>
> Configuration: Failed to find any configuration files like /etc/MailScanner/conf.d/*.conf, skipping them. at /usr/share/MailScanner/MailScanner/Config.pm line 2044<br>
><br>
> In Debugging mode, not forking...<br>
> Trying to setlogsock(unix)<br>
> Building a message batch to scan...<br>
> Have a batch of 30 messages.<br>
> Insecure dependency in open while running with -T switch at /usr/lib64/perl5/IO/File.pm line 185.<br>
><br>
<br>
</div>What MTA are you using ? i can take a look at this for you if i can squeeze some time.<br>
<br>
--<br>
<a href="http://www.baruwa.org" target="_blank">www.baruwa.org</a><br>
<div><div><br>
<br>
<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
</div></div></blockquote></div><br></div></div></div>
</blockquote></div><br>
</div></div></blockquote></div><br></div>