Spamsnake 10.10 Baruwa issues after update
 

Hi All,

I recently updated my spamsnake with the latest baruwa packages following the guide. As i was updating also did a ubuntu full update. Everything seemed to be working fine but after a few days of running I noticed that mails were not being processed by mailscanner. The queue was filling up. I checked the mail.log and it looks like mailscanner is constantly restarting. In baruwa I see no errors (green).
This same issue occurred on another box which i also updated using the same method in the guide. It is also recurring after a few days of running fine and happens exactly around 2:00 AM. Any pointers would be appreciated.

Thx

Did you upgrade MailScanner as well?

Check to see if the Baruwa*.pm files exists in /opt/MailScanner/lib/MailScanner/CustomFunctions. If they do, open each one and verify that the database credentials are correctly configured.

I updated through apt-get update. Didn't really pay attention if mailscanner was also updated. But I followed the guide to correct the symlinks and checked those files in /opt/MailScanner/lib/MailScanner/CustomFunctions according to the upgrade guide and all .pm files contain the correct database credentials.

Everything also seems to be working fine as is Baruwa. Only problem is that the processing stops after a few days and mailscanner keeps restarting, only way to get the queue to process is to reboot. Yesterday this happened exactly around 00:00 hours on both spamsnakes I built and I also noticed a lot of mailscanner (defunct) processes through top when the problem arises. Before the update of baruwa and ubuntu it was running fine for months (very stable)

I tried troubleshooting but this is a tough one to crack.

It's possible that your problems are related to a cron job, but you'll have to do a bit of troubleshooting.

Also, check your hard drive space and memory usage.

The memory usage is fine, so is hard drive space.

Did a bit of troubleshooting and I'm a bit closer to the solution.

I noticed that the problem only occurs when a virus was in a email message.
So it had to be related to clamd.

Also I noticed some time ago that there was a permissions difference in my spamsnake after the update and an old backup 'before' update.

The folder /var/spool/MailScanner should have permissions postfix:www-data for all containing folders:

incoming
quarantaine
spammassassin

I manually set them correct yesterday. Somehow the folder incoming gets permissions changed to postfix:clamav and then is when the problems arise. The moment a virus message arrives, mailscanner crashes. If i correct the permissions, mailscanner runs without crashing.

So question is, what is causing /var/spool/MailScanner/incoming to change it permissions?

Thx for your insight.

Tuxic

Hey,

Incoming Work Group in MailScanner.conf is responsible for changing the folder's permission. That permission needs to be so in order for Clamav to have access to scan emails for viruses. Things are pointing towards Clamav being the culprit.

Make sure you have the following settings in /etc/clamav/clamd.conf:

LocalSocket /var/run/clamav/clamd.ctl
LocalSocketGroup clamav
LocalSocketMode 666
User clamav
AllowSupplementaryGroups true
PidFile /var/run/clamav/clamd.pid
DatabaseDirectory /var/lib/clamav

Also, do the following:
usermod -a -G www-data clamav


vi /etc/apparmor.d/usr.sbin.clamd


and add the Incoming folder to the list of folders
/usr/sbin/clamd { #clamav /var/spool/MailScanner/** rw, /var/spool/MailScanner/incoming/** rw, } Reload apparmor:


/etc/init.d/apparmor reload

Let me know how that works out for you.