Problem, mailscanner stops
Hi,
I'm runnning a mail server on debian sarge, postfix 2.1.5-9, mailscanner
4.41.3-2, spamassassin 3.0.3-2 and clamav volatile.
The load is about 5000 mails a day.
This has been working perfectly for months until this week when
mailscanner has stopped scanning mails on a couple of occasions.
Mailscanner seems to stop scanning postfixs HOLD queue. All processes -
postfixs as well as mailscanner etc - are running, but no mail is
transported from the HOLD queue which just grows. All other postfix
queues are processed. The problem thus seems to be in mailscanner.
Restarting postfix reveals an error stating that a "bogus file" is in
the HOLD queue directories. Removing the file and restarting mailscanner
solves the problem until it happens again. Inspecting the file reveals
it is a mail attachement(!!), that's thus is located in postfixs HOLD
queue directory! At all times the attachment has been of the form
tnef-<number>-1.doc, and thus seems to be a outlook/outlook express
attachement.
But why and how has the file been copied into postfixs HOLD queue?
Anyone else with the same problem and maybe a solution?
I can't find anything relevant in the log files (see below).
Inspecting the log files reveals:
a) the message id associated with the mail is much longer than normal -
about 430 bytes. Probably not the problem
b) the following:
May 19 17:25:17 mail MailScanner[13342]: Expanding TNEF archive at
/var/spool/MailScanner/incoming/13342/7C87619D19.0F598/winmail.dat
May 19 17:25:17 mail MailScanner[13342]: Corrupt TNEF winmail.dat that
cannot be analysed in message 7C87619D19.0F598
May 19 17:25:17 mail MailScanner[13342]: Virus and Content Scanning:
Starting
May 19 17:25:18 mail MailScanner[13342]:
/var/spool/MailScanner/incoming/13342/./7C87619D19.0F598/winmail.dat:
Input/Output error
May 19 17:25:18 mail MailScanner[13342]: ProcessClamAVOutput:
unrecognised line
"/var/spool/MailScanner/incoming/13342/./7C87619D19.0F598/wi
nmail.dat: Input/Output error". Please contact the authors!
Thank you!
/Erik Persson
Reply to: