MailScanner not processing mail

[Rapitharian]

Folks,
I have an issue where MailScanner is accepting mail, but then the mail just sits in /var/spool/mqueue.in

I am running sendmail 8.13.8, and MailScanner V 4.81.4.

I changed the lock type in /etc/MailScanner/MailScanner.conf to; flock from blank, restarted MailScanner but this change made no differance. I am at a loss. Any help is appreciated.

-Rap

[falko]

Are there any errors in your mail log (in the /var/log/ directory)?

[Rapitharian]

Falko,
No there are not but here is a sample of what is in the log.

[root@spam spool]# service MailScanner restart && tail -f /var/log/maillog
Shutting down MailScanner daemons:
MailScanner: [FAILED]
incoming sendmail: [ OK ]
outgoing sendmail: [ OK ]
Waiting for MailScanner to die gracefully dead.
Starting MailScanner daemons:
incoming sendmail: [ OK ]
outgoing sendmail: [ OK ]
MailScanner: [ OK ]
Jan 30 22:57:40 spam sendmail[8486]: p0V3uMFG008486: from=tippy@test.com, size=48, class=0, nrcpts=1, msgid=<201101310357.p0V3uMFG008486@spam.domain.net>, proto=SMTP, daemon=MTA, relay=living [192.168.1.102] (may be forged)
Jan 30 22:57:40 spam sendmail[8486]: p0V3uMFG008486: to=steve@domain.net, delay=00:00:33, mailer=smtp, pri=30048, stat=queued
Jan 30 23:01:07 spam update.bad.phishing.sites: Delaying cron job up to 600 seconds
Jan 30 23:01:29 spam update.virus.scanners: Delaying cron job up to 600 seconds
Jan 30 23:04:12 spam update.virus.scanners: Found clamav installed
Jan 30 23:04:12 spam update.virus.scanners: Running autoupdate for clamav
Jan 30 23:04:12 spam ClamAV-autoupdate[8700]: ClamAV updater /usr/local/bin/freshclam cannot be run
Jan 30 23:04:12 spam update.virus.scanners: Found generic installed
Jan 30 23:04:12 spam update.virus.scanners: Running autoupdate for generic
Jan 30 23:04:13 spam sendmail[8559]: p0V413TR008559: from=root, size=405, class=0, nrcpts=1, msgid=<201101310401.p0V413TR008559@spam.domain.net>, relay=root@localhost
Jan 30 23:04:14 spam sendmail[8893]: p0V44DKU008893: from=<root@spam.domain.net>, size=684, class=0, nrcpts=1, msgid=<201101310401.p0V413TR008559@spam.domain.net>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]
Jan 30 23:04:14 spam sendmail[8893]: p0V44DKU008893: to=<root@spam.domain.net>, delay=00:00:01, mailer=smtp, pri=30684, stat=queued
Jan 30 23:04:14 spam sendmail[8559]: p0V413TR008559: to=root, ctladdr=root (0/0), delay=00:03:11, xdelay=00:00:01, mailer=relay, pri=30405, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (p0V44DKU008893 Message accepted for delivery)
Jan 30 23:10:21 spam sendmail[9011]: alias database /etc/aliases rebuilt by root
Jan 30 23:10:21 spam sendmail[9011]: /etc/aliases: 76 aliases, longest 10 bytes, 765 bytes total
Jan 30 23:10:21 spam sendmail[9019]: starting daemon (8.13.8): SMTP
Jan 30 23:10:21 spam sm-msp-queue[9023]: starting daemon (8.13.8): queueing@00:15:00
Jan 30 23:10:21 spam sendmail[9027]: starting daemon (8.13.8): queueing@00:15:00

As you can see the local mail is relaying to 127.0.0.1, but the mail from tippy@test.com to steve@domain.net just get queued.

I also looked at the messages and didn't see any errors logged in them.

I would also be happy to change any config settings/logging options to assist.

I am happy to look for information so ask away. BTW, the OS is CentOS.

-Rap

[Rapitharian]

New news,
In my MailScanner.conf file I set Debug=yes and SpamAssassin Debug=yes.
Then I:

[root@spam mqueue.in]# service MailScanner stop
Shutting down MailScanner daemons:
MailScanner: [FAILED]
incoming sendmail: [ OK ]
outgoing sendmail: [ OK ]
[root@spam mqueue.in]# check_MailScanner
Starting MailScanner... Failed.


Now I need to figure out why it would fail.

When I run the standard command I get this:

[root@spam mqueue.in]# service MailScanner start && tail -f /var/log/maillog
Starting MailScanner daemons:
incoming sendmail: [ OK ]
outgoing sendmail: [ OK ]
MailScanner: [ OK ]
Jan 31 23:14:00 spam update.virus.scanners: Running autoupdate for generic
Jan 31 23:14:01 spam sendmail[31958]: p11416rC031958: from=root, size=405, class=0, nrcpts=1, msgid=<201102010401.p11416rC031958@spam.domain.net>, relay=root@localhost
Jan 31 23:14:01 spam sendmail[32582]: p114E17d032582: from=<root@spam.domain.net>, size=684, class=0, nrcpts=1, msgid=<201102010401.p11416rC031958@spam.domain.net>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]
Jan 31 23:14:01 spam sendmail[32582]: p114E17d032582: to=<root@spam.domain.net>, delay=00:00:00, mailer=smtp, pri=30684, stat=queued
Jan 31 23:14:01 spam sendmail[31958]: p11416rC031958: to=root, ctladdr=root (0/0), delay=00:12:55, xdelay=00:00:00, mailer=relay, pri=30405, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (p114E17d032582 Message accepted for delivery)
Jan 31 23:33:58 spam sendmail[427]: alias database /etc/aliases rebuilt by root
Jan 31 23:33:58 spam sendmail[427]: /etc/aliases: 76 aliases, longest 10 bytes, 765 bytes total
Jan 31 23:33:58 spam sendmail[435]: starting daemon (8.13.8): SMTP
Jan 31 23:33:58 spam sm-msp-queue[439]: starting daemon (8.13.8): queueing@00:15:00
Jan 31 23:33:58 spam sendmail[443]: starting daemon (8.13.8): queueing@00:15:00


Why do I not believe that MailScanner is actually starting, because it never processes any mail from the mqueue.in folder.

-Rap

[falko]

What are the outputs of netstat -tap and getenforce?

[Rapitharian]

Thanks for all the help Falko.
results:


[root@spam log]# netstat -tap
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 *:717 *:* LISTEN 1807/rpc.statd
tcp 0 0 localhost.localdomain:783 *:* LISTEN 2140/spamd.pid
tcp 0 0 *:sunrpc *:* LISTEN 1770/portmap
tcp 0 0 *:ndmp *:* LISTEN 2457/perl
tcp 0 0 localhost.localdomain:54321 *:* LISTEN 2451/avgtcpd
tcp 0 0 localhost.localdomain:54322 *:* LISTEN 2451/avgtcpd
tcp 0 0 localhost.localdomain:ipp *:* LISTEN 2075/cupsd
tcp 0 0 localhost.localdomain:smtp *:* LISTEN 11495/sendmail: acc
tcp 0 0 192.168.1.9:smtp *:* LISTEN 11495/sendmail: acc
tcp 0 0 localhost.localdomain:smtp localhost.localdomain:55590 TIME_WAIT -
tcp 0 0 *:ssh *:* LISTEN 2061/sshd
tcp 0 0 ::ffff:192.168.1.9:ssh home01.depression:isis-ambc ESTABLISHED 2579/0
tcp 0 1296 ::ffff:192.168.1.9:ssh 321000130444bbf:2373 ESTABLISHED 31652/2
tcp 0 0 ::ffff:192.168.1.9:ssh home01.depres:o2server-port ESTABLISHED 3477/1


[root@spam log]# getenforce
Enforcing


As another note in looking in the /var/logs/messages file I saw this error:
NotifyClamd: Can't find or parse configuration file /etc/clamd.conf
as a result I ran:
yum install clamd
it completed successfully I will see if it resolves the above error. I can say it did nothing to help MaiScanner start. When running check_MailScanner I still get: Starting MailScanner... Failed.

-Rap

[Rapitharian]

Ran a MailScanner --lint and got the following output:


[root@spam log]# MailScanner --lint
dualvar is only available with the XS version of Scalar::Util at /usr/lib/perl5/site_perl/5.8.8/Compress/Zlib.pm line 8
BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.8/Compress/Zlib.pm line 8.
Compilation failed in require at /usr/lib/MailScanner/MailScanner/SA.pm line 42.
BEGIN failed--compilation aborted at /usr/lib/MailScanner/MailScanner/SA.pm line 42.
Compilation failed in require at /usr/sbin/MailScanner line 110.
BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 110.


-Rap

[Rapitharian]

Found the solution to the issue I was having.
It is found in this Bugzilla report for Fedora:
https://bugzilla.redhat.com/show_bug.cgi?id=434574

Look for the post by:

Dan Stahlke 2008-02-23 17:04:03 EST

This same bug has been reported in CentOS 3:
http://bugs.centos.org/view.php?id=2434

Related discussion:
http://www.perlmonks.org/?node_id=460411

The fix:
perl -MCPAN -e shell
force install Scalar::Util

Once I did that MailScanner starts and processes mail. :)

-Rap