gmane.mail.virus.mailscanner

Re: Loads of stale zero byte tmp files?

Steve Campbell — 2012-05-23T12:21:42

I don't do that much patching. Could you provide the command I need to 
run to get this done, please?

Also, thanks for spending the time in researching and fixing this, Mark.

steve campbell

On 5/22/2012 8:15 PM, Mark Sapiro wrote:

Re: Excess number of children

Martin Hepworth — 2012-05-23T11:03:00

could be related the Perl issues as you're runnning old Mailscanner on a
newer Perl distro and there's been lots of small fixed in MS to fix the
taint issues that modern perl highlights.

have you tried running latest MailScanner as 4.79 is quite old

Excess number of children

Johan — 2012-05-23T09:31:26

I have previously used mailscanner on Ubuntu with out any problems on a
handful computers. I have been using version 4.79.11 with perl 5.12.4.

Now I have upgraded one computer to Ubuntu 12.04 and I have had several
small problems but the major problem is that mailscanner creates and
leaves a large number of children (reported på mailwatch). After a while
I must reboot the computer to get the system functioning again.

Im using the same config-file as before. Max number of children has been
and still is set to 1 in the config-file.

Any idea about how to solve the problem?

/Johan Pålsson

johan< at >system-b:~$ sudo MailScanner -v
Using a hash as a reference is deprecated at /usr/sbin/MailScanner line 590.
Running on
Linux system-b 2.6.32-22-generic #36-Ubuntu SMP Thu Jun 3 22:02:19 UTC
2010 i686                                                    athlon i386
GNU/Linux
This is Perl version 5.014002 (5.14.2)

This is MailScanner version 4.79.11
Module versions are:
1.00    AnyDBM_File
1.30    Archive::Zip
0.27

Loads of stale zero byte tmp files?

Mark Sapiro — 2012-05-23T00:15:10

I have an issue with MailScanner-4.84.5-2 / SpamAss on CentOS 6.2. The
setup seems to be working ok but i have an issue on 2 boxes that temp
files do not get deleted.  In /tmp stuff like this is piling up quickly:
-rw-------. 1 root    root         94 May 20 22:55 K2M0qbNwv6
-rw-------. 1 root    root          0 May 21 05:08 tmp.1t3DQ6ZFaU
-rw-------. 1 root    root          0 May 21 06:14 tmp.9ZRV7VB41Y
-rw-------. 1 root    root          0 May 21 04:17 tmp.DmqX7lvDJS
-rw-------. 1 root    root          0 May 21 04:17 tmp.HwtJIyJImI
-rw-------. 1 root    root          0 May 21 06:14 tmp.MdrrIsMqGa
-rw-------. 1 root    root          0 May 21 05:08 tmp.ToMnIIFMf1


The above files are left behind by the
/etc/cron.hourly/update_virus_scanners process. This runs
/usr/sbin/update_virus_scanners every hour which in turn goes through
all the configured virus scanners checking if the scanner is installed
and then, if it is, running its update process.

Two of the check processes:

/usr/lib/MailScanner/bitdefender

Re: Re: Loads of stale zero byte tmp files?

Joolee — 2012-05-22T07:29:07

Julian told us we had to contact him when we wanted a new version released.
He'd approve the pull request and update the information on the website.

< at >Julian: Isn't it better to let someone else take over those
responsibilities?

On 22 May 2012 01:30, <funk.gabor< at >hunetkft.hu> wrote:

VÁ: Re: Loads of stale zero byte tmp files?

2012-05-21T23:30:53

Re: Loads of stale zero byte tmp files?

Phil Hale — 2012-05-21T22:52:30

I just checked on the github page 
(https://github.com/julesfm/MailScanner) and there is 1 pull request 
that was posted 2 months ago that has fixes for TNEF regression and a 
few other things.  So far it has not  been pulled into the master 
branch.  The only other activity is the initial commit of the master 
branch 4 months ago.  Is the github branch not being used to continue 
development?

Phil


On 05/21/2012 05:04 PM, Remco Barendse wrote:

RE: Loads of stale zero byte tmp files?

Remco Barendse — 2012-05-21T22:04:58


Slowly i am getting the feeling that MailScanner is turning into 
abandonware...   The problems with TNEF have been reported ages ago and i 
do remember seeing some fixes posted to the mailing list but don't think 
they ever got incorporated in the latest release of MS.

Pity, MS has always been doing a great job for me

Re: Loads of stale zero byte tmp files?

Vincent Verhagen — 2012-05-21T12:10:30

Hm,
seeing the same here, running CentOS 6.1, MS 4.84.3, ClamAV 0.97.4.
For now deleting them hourly from cron, but a fix would be nice :)

On 21-5-2012 13:33, Richard Mealing wrote:

RE: Loads of stale zero byte tmp files?

Richard Mealing — 2012-05-21T11:33:37

I would check in your mailq.in folder also as you might find tnef files there too.

I raised this a couple of weeks ago, but no-one got back to me, so I rolled all my machines back to 4.83.5.


-----Original Message-----
From: mailscanner-bounces< at >lists.mailscanner.info [mailto:mailscanner-bounces< at >lists.mailscanner.info] On Behalf Of Remco Barendse
Sent: 21 May 2012 06:23
To: MailScanner mailing list
Subject: Loads of stale zero byte tmp files?

Hi list

I have an issue with MailScanner-4.84.5-2 / SpamAss on CentOS 6.2. The setup seems to be working ok but i have an issue on 2 boxes that temp files do not get deleted.  In /tmp stuff like this is piling up quickly:
-rw-------. 1 root    root         94 May 20 22:55 K2M0qbNwv6
-rw-------. 1 root    root          0 May 21 05:08 tmp.1t3DQ6ZFaU
-rw-------. 1 root    root          0 May 21 06:14 tmp.9ZRV7VB41Y
-rw-------. 1 root    root          0 May 21 04:17 tmp.DmqX7lvDJS
-rw-------. 1 root    root          0 May 21 04:17 tmp.HwtJIyJImI
-rw-------. 1 root    roo

RE: Loads of stale zero byte tmp files?

M A Young — 2012-05-21T11:24:43

I am seeing the ones in /tmp . For me they match with the regular virus 
update run (as logged in /var/log/maillog ), and probably clamav.

 Michael Young

Loads of stale zero byte tmp files?

Remco Barendse — 2012-05-21T05:22:47

Hi list

I have an issue with MailScanner-4.84.5-2 / SpamAss on CentOS 6.2. The 
setup seems to be working ok but i have an issue on 2 boxes that temp 
files do not get deleted.  In /tmp stuff like this is piling up quickly:
-rw-------. 1 root    root         94 May 20 22:55 K2M0qbNwv6
-rw-------. 1 root    root          0 May 21 05:08 tmp.1t3DQ6ZFaU
-rw-------. 1 root    root          0 May 21 06:14 tmp.9ZRV7VB41Y
-rw-------. 1 root    root          0 May 21 04:17 tmp.DmqX7lvDJS
-rw-------. 1 root    root          0 May 21 04:17 tmp.HwtJIyJImI
-rw-------. 1 root    root          0 May 21 06:14 tmp.MdrrIsMqGa
-rw-------. 1 root    root          0 May 21 05:08 tmp.ToMnIIFMf1

and in /var/spool/MailScanner/incoming/SpamAssassin-Temp :
-rw-------. 1 root root 0 May 21 06:31 MailScanner.UfuR0E
-rw-------. 1 root root 0 May 21 05:58 MailScanner.vpJ3tf
-rw-------. 1 root root 0 May 21 03:34 MailScanner.zmZPln
-rw-------. 1 root root 0 May 21 03:34 MailScanner.zTSxkI
-rw-------. 1 root root 0 May 21 05:42 tmp.1t1IU

Re: External spamassassin

Martin Hepworth — 2012-05-18T14:36:50

And of course you can cluster MS quite nicely anyway.

I put a little how-to get best out of SA on the wiki a few years ago, some
of which is still relavent (local caching DNS etc)..

http://wiki.mailscanner.info/doku.php?id=maq:index#getting_the_best_out_of_spamassassin

and the previous section on that page is also useful..

http://wiki.mailscanner.info/doku.php?id=maq:index#optimization_tips

Depends how many messages you need to run, but you can crop alot at the
incoming MTA byt things like delay helo, recipient checks, greylisting and
the like. I've seen people drop well over 80% of spam that way well before
it hits your actual spam checks.

Re: Incorrect logging

Marek Šimon — 2012-05-18T12:02:45

Empty sender is fine, empty reciever makes no sence. It is postfix 2.9.1-2~bpo60+1 from debian squeeze-backport version. Seems it moves reciver from O to R record. If still not enough info, I can send the whole config. I fix it that empty R record is ignored. 


Marek Šimon 

----- Původní zprávy -----

Od: "Glenn Steen" <glenn.steen< at >gmail.com> 
Komu: "MailScanner discussion" <mailscanner< at >lists.mailscanner.info> 
Odeslané: Čtvrtek, 17. Květen 2012 23:44:55 
Předmět: Re: Incorrect logging 


... But empty records should be fine (empty sender == MAILER-DAEMON...), so that'd be a non-fix. Question is why your PF is inserting an empty record there...? What version of PF? Built or packaged? 
Cheers

Re: External spamassassin

Ian Knight — 2012-05-18T07:54:02

Did think that was the case - hence asking on the mailinglist if there 
was a way around it, its nice to offload services to other servers 
sometimes hence the reason we have a seperate servers setup purly for 
spamassasin with tmpfs filesystems and such for speeding things up.

And yes already use bayes in mysql on some servers so this should work 
to move over i guess without too much issues, just would have rather 
moved the whole spamassassin part to its own setup for service seperation.

--
Ian Knight

Re: Incorrect logging

Glenn Steen — 2012-05-17T21:44:55

... But empty records should be fine (empty sender == MAILER-DAEMON...), so
that'd be a non-fix. Question is why your PF is inserting an empty record
there...? What version of PF? Built or packaged?

Cheers

Re: Incorrect logging

Martin Hepworth — 2012-05-17T19:40:19

Sounds like postfix could be mangling the data incoming as it should be
getting this simple info from your example correctly

One thing to check is to run mailscanner in debug mode against a sample
message in the holding queue (su to postfix furst) and see if you get any
clues there

Theres lots of people running ms and postfix together so its not the
combination thats unhappy

Martin

On Thursday, 17 May 2012, Marek Šimon wrote:

Re: External spamassassin

Martin Hepworth — 2012-05-17T19:21:40

Not possible as mailscanner calls spamassin via its perl api

If you want a shared bayes then move bayes to a mysql database and change
the local spamassassins to use that rather than the inbuilt file based bayes

Martin

On Thursday, 17 May 2012, Ian Knight  wrote:

External spamassassin

Ian Knight — 2012-05-17T15:49:10

Hi,

We run a number of seperate mailscanner servers mainly for outgoing 
smtp, we would like to run a shared spamd process on these (on a 
seperate server) we do this with other servers just wondering if this is 
possible with MailScanner - mainly so it takes use of a shared bayes 
setup and so we can guarantee all emails through all servers would be 
getting the same spam scores etc?

--
Ian

Re: Incorrect logging

Marek Šimon — 2012-05-17T12:01:16

I descented into Postfix.pm, line 387. MailScanner recognises the Original recipient and stops recognizing other recipients when it finds it. But in my postfix there is no original recipient, the original recipient record is empty. But Mailscanner consider this empty record as valid and there is the whole problem. So I add an 'if test' which skips empty records. 
Marek 


----- Původní zprávy -----

Od: "Marek Šimon" <marek.simon< at >casablanca.cz> 
Komu: "MailScanner discussion" <mailscanner< at >lists.mailscanner.info> 
Odeslané: Čtvrtek, 17. Květen 2012 9:26:58 
Předmět: Re: Incorrect logging 



Hi 
I am refering to envelope address. I send the message by pushing it via nc to the mail server, the message is like this: 

echo 'ehlo clienthostname' 

echo 'mail from:<marek.simon< at >casablanca.cz>' 

echo 'rcpt to:<pletiplot< at >xyz.cz>' 

echo 'data' 

echo 'some spam and html fragments to test the antispam procesing' 
echo '.' 

echo quit 
) | nc -t serverhostname 25 


The clienthostname and serverhostname are

Re: Incorrect logging

Marek Šimon — 2012-05-17T07:26:58

Hi 
I am refering to envelope address. I send the message by pushing it via nc to the mail server, the message is like this: 

echo 'ehlo clienthostname' 

echo 'mail from:<marek.simon< at >casablanca.cz>' 

echo 'rcpt to:<pletiplot< at >xyz.cz>' 

echo 'data' 

echo 'some spam and html fragments to test the antispam procesing' 
echo '.' 

echo quit 
) | nc -t serverhostname 25 


The clienthostname and serverhostname are placeholders of course. 
There is "To: envelope address" and "From: the envelope address" and no regular headers as you see (no headers increase the spam score, which is what I wanted). The message is read by the MailScanner but in MailScanner records in mail.log there is empty space where the recipient should be and there is sender address where sender server hostname should be. I debuged the Message.pm and message->{to} is empty there. I am not a perl guru so I just try to print some values. The To: address is empty in localy generated messages too. I was very upset yesterday while debuging it.