I had the same problem several months ago and posted a similar question here, "is there a way to 'process' messages that are left behind in simscan's working directory?" I didn't get a response and it's starting to look like you're not getting a resolution either. I ended up having to turn off spamd & clamd scanning. Yes, more spam is getting thru now but having customers lose their e-mail due to my server issue(s) is not acceptable. I can't risk turning it back on until I'm certain it won't happen again.
For me, the problem seemed to arise when we were under a spam attack. It appears as though simscan could not keep up under the load (or is spamassassin the problem?). Are there faster, more robust alternatives to consider? FYI, I am running greylisting which seems to hold up under any load & considerably reduces the amount of spam (& viruses) that get thru. Bill D -----Original Message----- From: Alexey Amerik [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 04, 2007 3:52 PM To: toaster@shupp.org Subject: Re: [toaster] messages stuck in simscan It does not appear that the message makes it to clamd or spamd. On Apr 4, 2007, at 6:33 PM, Alexey Amerik wrote: > 2007-04-04 18:26:44.830410500 CHKUSER accepted sender: from > <[EMAIL PROTECTED]::> remote <wx-out-0506.google.com:unknown: > 66.249.82.227> rcpt <> : sender accepted > 2007-04-04 18:26:45.087796500 CHKUSER accepted rcpt: from > <[EMAIL PROTECTED]::> remote <wx-out-0506.google.com:unknown: > 66.249.82.227> rcpt <[EMAIL PROTECTED]> : found existing > recipient > 2007-04-04 18:26:45.155187500 simscan: cdb looking up > 2007-04-04 18:26:45.155290500 simscan: cdb for found > clam=yes,spam=yes,spam_passthru=yes,attach=.vbs:.lnk:.scr:.wsh:.hta:.p > if > 2007-04-04 18:26:45.155343500 simscan: pelookup clam = yes > 2007-04-04 18:26:45.155365500 simscan: pelookup spam = yes > 2007-04-04 18:26:45.155383500 simscan: pelookup spam_passthru = yes > 2007-04-04 18:26:45.155406500 simscan: spampassthru = yes/1 > 2007-04-04 18:26:45.155423500 simscan: pelookup attach = > .vbs:.lnk:.scr:.wsh:.hta:.pif > 2007-04-04 18:26:45.155441500 simscan: attachment flag attach = > .vbs:.lnk:.scr:.wsh:.hta:.pif > 2007-04-04 18:26:45.155468500 simscan: .vbs is attachment number 0 > 2007-04-04 18:26:45.155486500 simscan: .lnk is attachment number 1 > 2007-04-04 18:26:45.155503500 simscan: .scr is attachment number 2 > 2007-04-04 18:26:45.155521500 simscan: .wsh is attachment number 3 > 2007-04-04 18:26:45.155538500 simscan: .hta is attachment number 4 > 2007-04-04 18:26:45.155555500 simscan: .pif is attachment number 5 > 2007-04-04 18:26:45.155590500 simscan: starting: work dir: /var/ > qmail/simscan/1175725605.155567.6415 > > thats the last message I see in smtpd/current log, > > turning to pid list, I see this clamav 6415 0.0 0.0 1696 > 444 ? S 18:26 0:00 /var/qmail/bin/simscan > > total other simscan pid's: > > clamav 31820 0.0 0.0 1696 444 ? S 18:04 0:00 /var/ > qmail/bin/simscan > clamav 32614 0.0 0.0 1696 444 ? S 18:08 0:00 /var/ > qmail/bin/simscan > clamav 501 0.0 0.0 1696 444 ? S 18:09 0:00 /var/ > qmail/bin/simscan > clamav 708 0.0 0.0 1696 444 ? S 18:09 0:00 /var/ > qmail/bin/simscan > clamav 1469 0.0 0.0 1696 444 ? S 18:12 0:00 /var/ > qmail/bin/simscan > clamav 4938 0.0 0.0 1696 444 ? S 18:22 0:00 /var/ > qmail/bin/simscan > clamav 6415 0.0 0.0 1696 444 ? S 18:26 0:00 /var/ > qmail/bin/simscan > clamav 7000 0.0 0.0 1696 444 ? S 18:28 0:00 /var/ > qmail/bin/simscan > clamav 7352 0.0 0.0 1696 444 ? S 18:29 0:00 /var/ > qmail/bin/simscan
