linux RH9 2.4.20-31.9 Qmail-Scanner 1.23 clamav 0.75.1
odd problem since upgrading to 1.23, with coincidental update to clamav 0.75
Over the past 3-4 days I've seen clamscan processes hanging around, sucking up resources, never dying, causing high load. I can kill the processes, but after some time I end up in the same boat:
qscand 21954 29.3 0.0 17576 240 ? R Aug08 419:37 /usr/local/bin/clamscan -r -m --unzip --unrar --unzoo --lha --disable-summary --max-recursion=10 --max-space=100000 /var/spool/qmailscan/tmp/twobar.example.com109201865648221824
qscand 29758 20.5 1.4 17576 7188 ? R 01:18 259:40 /usr/local/bin/clamscan -r -m --unzip --unrar --unzoo --lha --disable-summary --max-recursion=10 --max-space=100000 /var/spool/qmailscan/tmp/twobar.example.com109202866348229710
qscand 940 18.6 3.1 17576 16012 ? R 02:41 219:42 /usr/local/bin/clamscan -r -m --unzip --unrar --unzoo --lha --disable-summary --max-recursion=10 --max-space=100000 /var/spool/qmailscan/tmp/twobar.example.com1092033643482923
qscand 7719 16.4 2.1 17576 11140 ? R 05:27 166:18 /usr/local/bin/clamscan -r -m --unzip --unrar --unzoo --lha --disable-summary --max-recursion=10 --max-space=100000 /var/spool/qmailscan/tmp/twobar.example.com10920436464827686
qscand 10256 15.9 3.1 17576 16360 ? R 06:34 150:23 /usr/local/bin/clamscan -r -m --unzip --unrar --unzoo --lha --disable-summary --max-recursion=10 --max-space=100000 /var/spool/qmailscan/tmp/twobar.example.com109204762448210210
qscand 17328 15.2 3.1 17576 16364 ? R 09:21 118:35 /usr/local/bin/clamscan -r -m --unzip --unrar --unzoo --lha --disable-summary --max-recursion=10 --max-space=100000 /var/spool/qmailscan/tmp/twobar.example.com109205766648217284
qscand 15221 12.9 3.2 17576 16608 ? R 21:34 5:44 /usr/local/bin/clamscan -r -m --unzip --unrar --unzoo --lha --disable-summary --max-recursion=10 --max-space=100000 /var/spool/qmailscan/tmp/twobar.example.com109210165848215092
I notice clamscan options within QS have changed from:
my $clamscan_options="-r --disable-summary --max-recursion=10 --max-space=100000";
to:
my $clamscan_options="-r -m --unzip --unrar --unzoo --lha --disable-summary --max-recursion=10 --max-space=100000";
but I can run any of the above options from cmd line on the orig. email msg w/o problem.
Anyone seeing similar problems with thier QS setup?
--QS LOGS--
Mon, 09 Aug 2004 21:34:18 EDT:15092: +++ starting debugging for process 15092 by uid=2003
Mon, 09 Aug 2004 21:34:18 EDT:15092: setting UID to EUID so subprocesses can access files generated by this script
Mon, 09 Aug 2004 21:34:18 EDT:15092: program name is qmail-scanner-queue.pl, version 1.23
Mon, 09 Aug 2004 21:34:18 EDT:15092: incoming SMTP connection from via SMTP from 205.210.42.52
Mon, 09 Aug 2004 21:34:18 EDT:15092: w_c: mkdir /var/spool/qmailscan/tmp/twobar.example.com109210165848215092
Mon, 09 Aug 2004 21:34:18 EDT:15092: w_c: start dumping incoming msg into /var/spool/qmailscan/working/tmp/twobar.example.com109210165848215092 [0.001631]
Mon, 09 Aug 2004 21:34:18 EDT:15092: c_a_g: found MIME attachment
Mon, 09 Aug 2004 21:34:18 EDT:15092: w_c: primary Content-Type of multipart/mixed found
Mon, 09 Aug 2004 21:34:18 EDT:15092: w_c: found a top-level boundary definition of \-\-\-\-\=_NextPart_000_00E8_01C47C19\.81734BA0
Mon, 09 Aug 2004 21:34:18 EDT:15092: w_c: attachment 1: Content-Type of multipart/related found
Mon, 09 Aug 2004 21:34:18 EDT:15092: w_c: attachment 2: Content-Type of multipart/alternative found
Mon, 09 Aug 2004 21:34:18 EDT:15092: w_c: attachment 3: Content-Type of text/plain found
Mon, 09 Aug 2004 21:34:18 EDT:15092: w_c: attachment 4: Content-Type of text/html found
Mon, 09 Aug 2004 21:34:19 EDT:15092: found C-T attachment filename image001.jpg
Mon, 09 Aug 2004 21:34:19 EDT:15092: w_c: attachment 6: Content-Type of image/jpeg found
Mon, 09 Aug 2004 21:34:19 EDT:15092: found C-T attachment filename image002.jpg
Mon, 09 Aug 2004 21:34:19 EDT:15092: w_c: attachment 7: Content-Type of image/jpeg found
Mon, 09 Aug 2004 21:34:20 EDT:15092: found C-T attachment filename image003.jpg
Mon, 09 Aug 2004 21:34:20 EDT:15092: w_c: attachment 8: Content-Type of image/jpeg found
Mon, 09 Aug 2004 21:34:23 EDT:15092: found C-T attachment filename image004.jpg
Mon, 09 Aug 2004 21:34:23 EDT:15092: w_c: attachment 9: Content-Type of image/jpeg found
Mon, 09 Aug 2004 21:34:24 EDT:15092: found C-T attachment filename image005.jpg
Mon, 09 Aug 2004 21:34:24 EDT:15092: w_c: attachment 10: Content-Type of image/jpeg found
Mon, 09 Aug 2004 21:34:25 EDT:15092: found C-T attachment filename image006.jpg
Mon, 09 Aug 2004 21:34:25 EDT:15092: w_c: attachment 11: Content-Type of image/jpeg found
Mon, 09 Aug 2004 21:34:27 EDT:15092: found C-T attachment filename image007.jpg
Mon, 09 Aug 2004 21:34:27 EDT:15092: w_c: attachment 12: Content-Type of image/jpeg found
Mon, 09 Aug 2004 21:34:29 EDT:15092: found C-T attachment filename image008.jpg
Mon, 09 Aug 2004 21:34:29 EDT:15092: w_c: attachment 13: Content-Type of image/jpeg found
Mon, 09 Aug 2004 21:34:34 EDT:15092: found C-T attachment filename image009.jpg
Mon, 09 Aug 2004 21:34:34 EDT:15092: w_c: attachment 14: Content-Type of image/jpeg found
Mon, 09 Aug 2004 21:34:37 EDT:15092: found C-T attachment filename =?windows-1255?b?vghlidmgq29ozw5zihnlehrldcat+u7l8ox6iofj+ex6lmrvyw==?=
Mon, 09 Aug 2004 21:34:37 EDT:15092: w_c: attachment 16: Content-Type of application/msword found
Mon, 09 Aug 2004 21:34:56 EDT:15092: w_c: rename new msg from /var/spool/qmailscan/working/tmp/twobar.example.com109210165848215092 to /var/spool/qmailscan/working/new/twobar.example.com109210165848215092 [37.222098]
n, 09 Aug 2004 21:34:56 EDT:15092: d_m: starting /usr/local/bin/reformime -x/var/spool/qmailscan/tmp/twobar.example.com109210165848215092/ </var/spool/qmailscan/working/new/twobar.example.com109210165848215092 [0.000538]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: finished /usr/local/bin/reformime -x/var/spool/qmailscan/tmp/twobar.example.com109210165848215092/ [3.030827]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: Checking all attachments to see if they're MS-TNEF
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/1092101696.15193-0.twobar.example.com is a TNEF file?: 256 [0.66297]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/1092101697.15193-1.twobar.example.com is a TNEF file?: 256 [0.003296]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image001.jpg is a TNEF file?: 256 [0.003225]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image002.jpg is a TNEF file?: 256 [0.00331]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image003.jpg is a TNEF file?: 256 [0.003289]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image004.jpg is a TNEF file?: 256 [0.003269]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image005.jpg is a TNEF file?: 256 [0.003325]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image006.jpg is a TNEF file?: 256 [0.00321]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image007.jpg is a TNEF file?: 256 [0.003293]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image008.jpg is a TNEF file?: 256 [0.0033]
Mon, 09 Aug 2004 21:34:56 EDT:15092: d_m: starting /usr/local/bin/reformime -x/var/spool/qmailscan/tmp/twobar.example.com109210165848215092/ </var/spool/qmailscan/working/new/twobar.example.com109210165848215092 [0.000538]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: finished /usr/local/bin/reformime -x/var/spool/qmailscan/tmp/twobar.example.com109210165848215092/ [3.030827]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: Checking all attachments to see if they're MS-TNEF
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/1092101696.15193-0.twobar.example.com is a TNEF file?: 256 [0.66297]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/1092101697.15193-1.twobar.example.com is a TNEF file?: 256 [0.003296]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image001.jpg is a TNEF file?: 256 [0.003225]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image002.jpg is a TNEF file?: 256 [0.00331]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image003.jpg is a TNEF file?: 256 [0.003289]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image004.jpg is a TNEF file?: 256 [0.003269]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image005.jpg is a TNEF file?: 256 [0.003325]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image006.jpg is a TNEF file?: 256 [0.00321]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image007.jpg is a TNEF file?: 256 [0.003293]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image008.jpg is a TNEF file?: 256 [0.0033]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/image009.jpg is a TNEF file?: 256 [0.00329]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: is /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/RldCAt_u7l8OX6IOfj_eX6LmRvYw____ is a TNEF file?: 256 [0.003199]
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: Check for zip files...
Mon, 09 Aug 2004 21:34:59 EDT:15092: d_m: unpacking message took 3.730494 seconds
Mon, 09 Aug 2004 21:34:59 EDT:15092: unsetting QMAILQUEUE env var
Mon, 09 Aug 2004 21:34:59 EDT:15092: g_e_h: return-path is "[EMAIL PROTECTED]", recips is "[EMAIL PROTECTED]"
Mon, 09 Aug 2004 21:34:59 EDT:15092: from="priya" <[EMAIL PROTECTED]>,subj=New jazz band , x-qmail-scanner-message-id=<[EMAIL PROTECTED]> via SMTP from 205.210.42.52
Mon, 09 Aug 2004 21:34:59 EDT:15092: ini_sc: start scanning
Mon, 09 Aug 2004 21:34:59 EDT:15092: ini_sc: recursively scan the directory /var/spool/qmailscan/tmp/twobar.example.com109210165848215092/
Mon, 09 Aug 2004 21:34:59 EDT:15092: scanloop: starting scan of directory "/var/spool/qmailscan/tmp/twobar.example.com109210165848215092"...
Mon, 09 Aug 2004 21:34:59 EDT:15092: scanloop: scanner=clamscan_scanner,plain_text_msg=0
Mon, 09 Aug 2004 21:34:59 EDT:15092: clamscan: starting scan of directory "/var/spool/qmailscan/tmp/twobar.example.com109210165848215092"...
Mon, 09 Aug 2004 21:34:59 EDT:15092: run /usr/local/bin/clamscan -r -m --unzip --unrar --unzoo --lha --disable-summary --max-recursion=10 --max-space=100000 /var/spool/qmailscan/tmp/twobar.example.com109210165848215092 2>&1
============= proc 15092 STOPS here ===============
------------------------------------------------------- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
