clamd/qmail-scanner not scanning tiny text messages?

Forum for getting help with Project Gamera, Spamassassin, Clamav, qmail-scanner and other anti-spam tools.
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

clamd/qmail-scanner not scanning tiny text messages?

Unread post by faris »

I've just come across a really weird clamd problem on my PG mailscanners and could do with some suggestions as to how to resolve it. If anybody has any ideas, no matter how off the wall, please post!

Essentially clamd does not seem to scan (or be called by qmail-scanner) when the incoming message is tiny/text, which means my Nagios automated test emails, which are tiny and text only) get through, even if clamd is down.

I only discovered this today. Basically clamd ran out of memory and fell over. In the logs, for each incoming messages, there was the expected message along the lines of "corrupt clamd or permissions problem" and the messages were rejected (I hope) .....EXCEPT that for each automated test message sent by to the PG boxes by my Nagios monitoring installation, there was no such error and the message was allowed through.

The end result was that I was blissfully unaware of any sort of problem, a situation which was made worse by the fact that this happened to both my PG mailscanner systems at the same time.

I've doubled the memory from 1Gb to 2Gb on both systems in the hope of alleviating the problem (though free -m showed a good 700Mb free on both!).

I've gone through /etc/clamd.conf and couldn't find a "minimum size" setting, in case the fact that the test messages were tiny text-only messages had anything to do with it.

I've also checked the qmail-scanner-queue.pl file to look for minimum sizes and can't find anything obvious.

But it must surely be something to do with the fact that the test emails are text only and tiny..... I can't think of anything else that it could be.

There are no settings-per-domain that might disable clamd scanning. The only custom setting is in spamassassin where I whitelist the "from" address on the test emails.

Suggestions would be appreciated!

p.s. psmon seems no longer to be in the ART repo for Centos 6?
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: clamd/qmail-scanner not scanning tiny text messages?

Unread post by faris »

Aha! I think I've found it:

in /usr/bin/qmail-scanner-queue.pl change:

my $skip_text_msgs=1;
to
my $skip_text_msgs=0;

I missed this previously because I was looking for a size, not for a skip text flag.

Obviously this will need to be re-edited after each reconfigure (or just edit the reconfigure script)

[Edit: Yes, this was definitely the problem.. altering that setting resolved the problem]
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
Post Reply