Thomas Lamy wrote: > Ken Goods wrote: >> René Bellora wrote: >>
<Snip> >>> it *is* a MailScanner message. May be virus scanning took too much >>> time? >> > > Most definitely. And MailScanner seems to think from this, that the > email contains some zip-bomb. > >> Thanks Rene, >> That was helpful, I'll take this back to the MailScanner list. >> >> Kind regards, >> Ken > Look at your config file, and set (or add): > Virus Scanner Timeout 600 (the default is 300) > > Do you have the offending (raw) mail? Which version of clamav? > > Thomas Thomas, You're a genius.. ok, at least a lot smarter than I when it come to this. (BTW ClamAV 0.85.1/943/Thu Jun 16 10:24:01 2005) You were so right. It was a particular email that was continually being cycled through MailScanner 7 to 9 minutes apart and each time it would timeout and throw that error. Not only that but it nearly doubled the load on the server and tripled the files in the incoming queue! Once I doubled the timeout for Clamscan in MS.conf, ClamAV evidently returned something that MailScanner could handle (or MailScanner handled the return differently). After you got me looking in the right direction I found a bunch of these that I hadn't noticed before: Jun 16 12:00:13 gw-mail MailScanner[18566]: ProcessClamAVOutput: unrecognised line "/var/spool/MailScanner/incoming/18566/./j53JPHJp027469/msg-18566-4.txt: Empty file". Please contact the authors! Once I increased the timeout I see the message delivered no problems. And now that I think about it I'm sure there was a thread on the MailScanner list regarding this within the last month, just didn't make the connection to my error. I'll take a look and see what I find. I'm sure it's time to upgrade MailScanner and SA as well. Thanks so much for your input. Everything seems to be getting back to normal. Learned a lot about grep and parsing the maillog, thanks again. I'll be a Linux admin in a couple hard years. :) Kind regards, Ken _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
