HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials

HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials (http://www.howtoforge.com/forums/index.php)
-   HOWTO-Related Questions (http://www.howtoforge.com/forums/forumdisplay.php?f=2)
-   -   Perfect SpamSnake - Emails Stuck in MailScanner Incomming queue (http://www.howtoforge.com/forums/showthread.php?t=29205)

teixeira 4th December 2008 00:06

Perfect SpamSnake - Emails Stuck in MailScanner Incomming queue
 
Hi HTF Forum,

Today i noticed something weird, hundreds of emails remain in the Mailscanner Incomming queue. This is the 1st time that this happens to me since 3 weeks i've spamsnake running perfectly.

I noticed also two aspects, mails atuck in queue but after 3-4h queues gets more empty, but not fully empty.
And i noticed that when clamav open the attachments for scanning the cpu goes some seconds to 100%.

Here's a extract of the current mail.log
Quote:

root@scx:~# tail -f /var/log/mail.log
Dec 3 23:04:50 scx MailScanner[4216]: SpamAssassin cache hit for message 56D83148719.E77A2
Dec 3 23:04:50 scx MailScanner[4216]: SpamAssassin cache hit for message D25421486F8.F0D29
Dec 3 23:04:51 scx MailScanner[4216]: SpamAssassin cache hit for message ECC461486E3.4B3B7
Dec 3 23:04:51 scx MailScanner[4216]: SpamAssassin cache hit for message 72C041486ED.50F53
Dec 3 23:04:51 scx MailScanner[4216]: SpamAssassin cache hit for message 47946148737.F01BB
Dec 3 23:04:52 scx MailScanner[4216]: Message 87145148736.5AC3E from 212.55.150.217 (newsletter-sporting@sportmultimedia.pt) to est.pt is too big for spam checks (404449 > 200000 bytes)
Dec 3 23:04:52 scx MailScanner[4216]: SpamAssassin cache hit for message 90A70148721.D01E2
Dec 3 23:04:52 scx MailScanner[4216]: SpamAssassin cache hit for message AB8501486EB.5120B
Dec 3 23:04:53 scx MailScanner[4216]: SpamAssassin cache hit for message 1C6681486F7.82D30
Dec 3 23:04:53 scx MailScanner[4216]: SpamAssassin cache hit for message 74E5314872C.083FF
Dec 3 23:04:53 scx MailScanner[4216]: Message 6CDDA1486E9.9CA36 from 208.94.243.162 (directmni@manbrave.com) to est.pt is too big for spam checks (223450 > 200000 bytes)
Dec 3 23:04:54 scx MailScanner[4216]: SpamAssassin cache hit for message 0838314871B.BF7F8
Dec 3 23:04:54 scx MailScanner[4216]: Message 069BA1486AF.D1EE3 from 212.55.150.216 (newsletter-sporting@sportmultimedia.pt) to est.pt is too big for spam checks (404421 > 200000 bytes)
Dec 3 23:04:54 scx MailScanner[4216]: SpamAssassin cache hit for message EBA941486F2.F2423
Dec 3 23:04:55 scx MailScanner[4216]: SpamAssassin cache hit for message 40A3F1486F9.4B21B
Dec 3 23:04:55 scx MailScanner[4216]: Spam Checks: Found 2 spam messages
Dec 3 23:04:56 scx MailScanner[4216]: Expanding TNEF archive at /var/spool/MailScanner/incoming/4216/ECC461486E3.4B3B7/winmail.dat
Dec 3 23:04:56 scx MailScanner[4216]: Message ECC461486E3.4B3B7 has had TNEF winmail.dat removed
Dec 3 23:04:57 scx MailScanner[4216]: Virus and Content Scanning: Starting
Dec 3 23:05:05 scx MailScanner[4216]: Content Checks: Detected and have disarmed web bug tags in HTML message in D04C71486FD.81A03 from gbounce-7013748642-7142-600045133-12...e.jh-email.com
Dec 3 23:05:05 scx MailScanner[4216]: Content Checks: Detected and have disarmed web bug tags in HTML message in 90F061486F4.A2AED from wboyes@controlglobalnews.com
Dec 3 23:05:05 scx MailScanner[4267]: MailScanner E-Mail Virus Scanner version 4.68.8 starting...
Dec 3 23:05:05 scx MailScanner[4267]: Read 817 hostnames from the phishing whitelist
Dec 3 23:05:06 scx MailScanner[4267]: Read 5141 hostnames from the phishing blacklist
Dec 3 23:05:06 scx MailScanner[4267]: Config: calling custom init function SQLBlacklist
Dec 3 23:05:06 scx MailScanner[4267]: Starting up SQL Blacklist
Dec 3 23:05:06 scx MailScanner[4267]: Read 0 blacklist entries
Dec 3 23:05:07 scx MailScanner[4267]: Config: calling custom init function MailWatchLogging
Dec 3 23:05:07 scx MailScanner[4267]: Started SQL Logging child

Any help or suggestions will be greatly appreciated.

BR,
Teixeira

Rocky 4th December 2008 00:14

Hey,

If you're not running the latest version of Clamav, please upgrade it and see if that solves your problems.

Rocky

teixeira 4th December 2008 02:49

i tried to update clamav but i didn't succeed. i read the wiki and faq in the clamav offical website and it stills in the 0.92 version...

Do u have an idea how to do it? how did you perform your clamav update?

Thanks,
TT


All times are GMT +2. The time now is 06:23.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.