Here is my reconstruction from this inadequate logging sample.
> Apr 24 13:20:10 doctor doctor[31]: postfix/smtpd[17053]: 0762D12CFB0D:
> client=defout.telus.net[204.209.205.55]
> Apr 24 13:20:41 doctor doctor[31]: postfix/cleanup[17311]: 0762D12CFB0D:
> message-id=<6ef179d262924e5a8c03336971544...@taskercomp>
At 13:22:00, a different Postfix SMTPD process reports a queue file
write error. This Postfix SMTPD process is missing from the logfile.
Also missing is the logging for the postmaster notice delivery.
> Apr 24 13:22:04 doctor doctor[31]: postfix/qmgr[4921]: 0762D12CFB0D:
> from=<sender>, size=5104017, nrcpt=1 (queue active)
> Apr 24 13:22:04 doctor clamsmtpd: 100B1C: from=sender, to=recipient,
> status=CLEAN
The logging shows a clamsmtpd filter, but the logging is missing
for the process that sends the message into the clamsmtpd filter.
Let's assume that this missing process was the same missing Postfix
SMTPD process that reported a queue file write error. That is
admittedly optimistic, considering that you left out most of the
relevant information.
Then, we have the following timeline:
13:20:10 The missing Postfix SMTPD process receives a connection.
13:20:10 The missing Postfix SMTPD process connects to a before-queue
filter (clamsmtpd).
13:20:10 The before-queue filter (clamsmtpd) connects to Postfix
SMTPD process 17053.
13:20:41 The before-queue filter (clamsmtpd) sends the message
header and perhaps the first part of the message body.
13:22:00 The missing Postfix SMTPD process times out (smtpd_proxy_timeout)
and sends a postmaster notification. I already mentioned
that the postmaster notification is missing in the logging.
13:22:04 The before-queue filter (clamsmtpd) finishes after two
and a half minute. This is long after the missing Postfix
SMTPD process has given up.
If this timeline is correct then you have too many body_checks
rules, or you have a clamsmtpd setup that is taking too much time.
But it is more likely that you left out a whole lot of other
relevant information with your selective logfile reporting.
Wietse
