Corrupted messages Postfix

Discussion:

David Valin Alonso

2013-05-30 08:10:20 UTC

Hello,
i got a server runing ubuntu 10.04 lts x64 + postfix 2.10 + cyrus 2.2 +
Mailscanner 4.84 + Spamassasin and all was working really great til a
couple of days that began to send mails to corrupt folder
/var/spool/postfix/corrupt. It complains about a missing record and it
rejects the mail moving from active to corrupt queue.
I don't know what happend and the configurations of postfix and mailscanner
didn't change as it was working really great.

What could happened?

Regards,

David
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130530/01291ffd/attachment.html

David Valin Alonso

2013-05-30 08:20:01 UTC

Permalink

Martin Hepworth

2013-05-30 11:21:22 UTC

Permalink

what do the logs say for the messages in question?
check the postfix logs and the mailscanner logs.
Also try running mailscanner in debug mode (see the wiki)
--
Martin Hepworth, CISSP
Oxford, UK

Post by David Valin Alonso
Hello,
i got a server runing ubuntu 10.04 lts x64 + postfix 2.10 + cyrus 2.2 +
Mailscanner 4.84 + Spamassasin and all was working really great til a
couple of days that began to send mails to corrupt folder
/var/spool/postfix/corrupt. It complains about a missing record and it
rejects the mail moving from active to corrupt queue.
I don't know what happend and the configurations of postfix and
mailscanner didn't change as it was working really great.
What could happened?
Regards,
David
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130530/1251bb01/attachment.html

David Valin Alonso

2013-05-31 07:18:59 UTC

Permalink

Hi Martin,
this is a copy/pste from my mail.log:
May 29 11:02:21 server postfix/cleanup[27995]: 19D6CDFD3F: message-id=<
201305290411.3.5607.30342.2445274 at cog.lumata.com>
May 29 11:02:21 server postfix/smtpd[27991]: disconnect from
unknown[213.92.42.10]
May 29 11:02:22 server MailScanner[24390]: New Batch: Scanning 1 messages,
4532 bytes
May 29 11:02:22 server MailScanner[24390]: Virus and Content Scanning:
Starting
May 29 11:02:36 server MailScanner[24390]: Requeue: 19D6CDFD3F.AEAD7 to
C6CEEDFD46
May 29 11:02:36 server MailScanner[24390]: Uninfected: Delivered 1 messages
May 29 11:02:36 server postfix/qmgr[3507]: C6CEEDFD46: from=<>, size=3885,
nrcpt=1 (queue active)
May 29 11:02:36 server postfix/qmgr[3507]: warning: C6CEEDFD46: message
rejected: missing end record
May 29 11:02:36 server postfix/qmgr[3507]: warning: saving corrupt file
"C6CEEDFD46" from queue "active" to queue "corrupt"
May 29 11:02:36 server MailScanner[24390]: Deleted 1 messages from
processing-database

Not all mails go to corrupt, for example if a mail comes to 1 person i
handles well the first time, the next time it sends to corrupt, i am
loosing the 60-75% in the corrupt queue, yesterday i had to stop
MailScanner and reconfig headers_checks to bypass the problem till i find a
solution because everything was working great.

Regards,

David
2013/5/30 Martin Hepworth <maxsec at gmail.com>

Post by Martin Hepworth
what do the logs say for the messages in question?
check the postfix logs and the mailscanner logs.
Also try running mailscanner in debug mode (see the wiki)
--
Martin Hepworth, CISSP
Oxford, UK

--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130531/e0fd01e9/attachment.html

Glenn Steen

2013-06-07 12:04:43 UTC

Permalink

Hello David,

This problem you have may be stemming from the change of locking
scheme in Postfix 2.10. It was also a problem (in the past) when we
did the two-postfix deferred queue thing to implement MailScanner
(prior to the hold queue thing we usually do now).
Check wether your postfix is using fifo or unix locks in master.cf,
and consider going back to fifo in that (with appropriat restart of
Postfix afterwards, of course)... OR change MailScanner.conf
accordingly and restart MailScanner (setting is "Lock Type").

I would think it fairly safe&easy to do the PF change.

Cheers
--
-- Glenn

Post by David Valin Alonso
Hi Martin,
message-id=<201305290411.3.5607.30342.2445274 at cog.lumata.com>
May 29 11:02:21 server postfix/smtpd[27991]: disconnect from
unknown[213.92.42.10]
May 29 11:02:22 server MailScanner[24390]: New Batch: Scanning 1 messages,
4532 bytes
Starting
May 29 11:02:36 server MailScanner[24390]: Requeue: 19D6CDFD3F.AEAD7 to
C6CEEDFD46
May 29 11:02:36 server MailScanner[24390]: Uninfected: Delivered 1 messages
May 29 11:02:36 server postfix/qmgr[3507]: C6CEEDFD46: from=<>, size=3885,
nrcpt=1 (queue active)
May 29 11:02:36 server postfix/qmgr[3507]: warning: C6CEEDFD46: message
rejected: missing end record
May 29 11:02:36 server postfix/qmgr[3507]: warning: saving corrupt file
"C6CEEDFD46" from queue "active" to queue "corrupt"
May 29 11:02:36 server MailScanner[24390]: Deleted 1 messages from
processing-database
Not all mails go to corrupt, for example if a mail comes to 1 person i
handles well the first time, the next time it sends to corrupt, i am loosing
the 60-75% in the corrupt queue, yesterday i had to stop MailScanner and
reconfig headers_checks to bypass the problem till i find a solution because
everything was working great.
Regards,
David
2013/5/30 Martin Hepworth <maxsec at gmail.com>

Post by David Valin Alonso
Hello,
i got a server runing ubuntu 10.04 lts x64 + postfix 2.10 + cyrus 2.2 +
Mailscanner 4.84 + Spamassasin and all was working really great til a couple
of days that began to send mails to corrupt folder
/var/spool/postfix/corrupt. It complains about a missing record and it
rejects the mail moving from active to corrupt queue.
I don't know what happend and the configurations of postfix and
mailscanner didn't change as it was working really great.
What could happened?
Regards,
David
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se

David Valin Alonso

2013-06-07 12:53:02 UTC

Permalink

Hi Glenn,

i think i am using fifo lock if you mean the qmgr line:
qmgr fifo n - n 300 1 qmgr

So the correct lock type in mailscanner.conf for postfix 2.10 should be
flock or posix??

Thanks for your reply.

Regards,

David

2013/6/7 Glenn Steen <glenn.steen at gmail.com>

Post by Glenn Steen
Hello David,
This problem you have may be stemming from the change of locking
scheme in Postfix 2.10. It was also a problem (in the past) when we
did the two-postfix deferred queue thing to implement MailScanner
(prior to the hold queue thing we usually do now).
Check wether your postfix is using fifo or unix locks in master.cf,
and consider going back to fifo in that (with appropriat restart of
Postfix afterwards, of course)... OR change MailScanner.conf
accordingly and restart MailScanner (setting is "Lock Type").
I would think it fairly safe&easy to do the PF change.
Cheers
--
-- Glenn

messages,

Post by David Valin Alonso
4532 bytes
Starting
May 29 11:02:36 server MailScanner[24390]: Requeue: 19D6CDFD3F.AEAD7 to
C6CEEDFD46
May 29 11:02:36 server MailScanner[24390]: Uninfected: Delivered 1

messages

Post by David Valin Alonso
May 29 11:02:36 server postfix/qmgr[3507]: C6CEEDFD46: from=<>,

size=3885,

Post by David Valin Alonso
nrcpt=1 (queue active)
May 29 11:02:36 server postfix/qmgr[3507]: warning: C6CEEDFD46: message
rejected: missing end record
May 29 11:02:36 server postfix/qmgr[3507]: warning: saving corrupt file
"C6CEEDFD46" from queue "active" to queue "corrupt"
May 29 11:02:36 server MailScanner[24390]: Deleted 1 messages from
processing-database
Not all mails go to corrupt, for example if a mail comes to 1 person i
handles well the first time, the next time it sends to corrupt, i am

loosing

Post by David Valin Alonso
the 60-75% in the corrupt queue, yesterday i had to stop MailScanner and
reconfig headers_checks to bypass the problem till i find a solution

because

Post by David Valin Alonso
everything was working great.
Regards,
David
2013/5/30 Martin Hepworth <maxsec at gmail.com>

Post by David Valin Alonso
Hello,
i got a server runing ubuntu 10.04 lts x64 + postfix 2.10 + cyrus 2.2 +
Mailscanner 4.84 + Spamassasin and all was working really great til a

couple

Post by David Valin Alonso

Post by Martin Hepworth

Post by David Valin Alonso
of days that began to send mails to corrupt folder
/var/spool/postfix/corrupt. It complains about a missing record and it
rejects the mail moving from active to corrupt queue.
I don't know what happend and the configurations of postfix and
mailscanner didn't change as it was working really great.
What could happened?
Regards,
David
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130607/4e3bad87/attachment.html

Glenn Steen

2013-06-07 15:27:55 UTC

Permalink

Post by David Valin Alonso
Hi Glenn,
qmgr fifo n - n 300 1 qmgr

pickup as well...

Post by David Valin Alonso
So the correct lock type in mailscanner.conf for postfix 2.10 should be
flock or posix??

Just leaving it empty *should* be fine.
--
-- Glenn

Post by David Valin Alonso
Thanks for your reply.
Regards,
David
2013/6/7 Glenn Steen <glenn.steen at gmail.com>

Post by David Valin Alonso
Hello,
i got a server runing ubuntu 10.04 lts x64 + postfix 2.10 + cyrus 2.2 +
Mailscanner 4.84 + Spamassasin and all was working really great til a couple
of days that began to send mails to corrupt folder
/var/spool/postfix/corrupt. It complains about a missing record and it
rejects the mail moving from active to corrupt queue.
I don't know what happend and the configurations of postfix and
mailscanner didn't change as it was working really great.
What could happened?
Regards,
David
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se

Roger Ide

2013-06-04 21:45:45 UTC

Permalink

unsubscribe

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130604/9b39bddb/attachment.html

Mikael Syska

2013-06-05 00:18:11 UTC

Permalink

List-Unsubscribe:
<http://lists.mailscanner.info/mailman/listinfo/mailscanner>,
<mailto:mailscanner-request at lists.mailscanner.info?subject=unsubscribe>

mvh
Mikael Syska

unsubscribe****
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130605/bc327c7a/attachment.html