Re: [gentoo-server] amavisd-new disaster

From: Jonathan Nichols <jnichols(at)pbp.net>
Date: Fri Aug 03 2007 - 18:18:45 EDT

Ben Munat wrote:
> After my last hair-pulling experience with amavis, here's what I would
> do: amavisd usually logs to /var/amavis/amavis.log; check in there for
> error messages.
>
> If there's anything in there about permissions (or could not read file,
> or something like that), then you've probably been bitten by the
> amavis/clamd ownership issues like I was. If amavisd is is running as
> the amavis user, then there is clamd stuff needs to be writable by
> amavis... meaning either give it a common group or just chown it to amavis.
>
> Sorry I can't remember the specifics, but this should nudge you in the
> right direction...uh, unless it's not a permission thing at all of course.
>
> Hope this helps,
>
> Ben
>

Yeah, I have it logging to syslog. It's been doing a great job of that. Everything that I do see in the logfiles looks great. That's the thing.

right now this is killing me. 100% of the spam is flowing through, users are screaming at me, and I can't find a solution. :(

here's what I get out of the logs:

Aug 3 15:14:45 mailgate amavis[732]: starting. /usr/sbin/amavisd at mailgate.pbp.net amavisd-new-2.4.1 (20060508), Unicode aware Aug 3 15:14:45 mailgate amavis[732]: user=, EUID: 0 (0); group=, EGID: 0 27 26 20 11 10 6 4 3 2 1 0 (0 27 26 20 11 10 6 4 3 2 1 0); log_level=2 Aug 3 15:14:45 mailgate amavis[732]: Perl version 5.008008 Aug 3 15:14:46 mailgate amavis[732]: INFO: no optional modules:

Sys::Hostname::Long Mail::SPF::Query Net::CIDR::Lite 
Mail::SpamAssassin::Plugin::DomainKeys Mail::DomainKeys::Header 
Mail::DomainKeys::Message Mail::DomainKeys::Policy 
Mail::DomainKeys::Signature Mail::DomainKeys::Key 
Mail::DomainKeys::Key::Public Crypt::OpenSSL::RSA 
auto::Crypt::OpenSSL::RSA::new_public_key 
auto::Crypt::OpenSSL::RSA::load_public_key 
auto::Crypt::OpenSSL::RSA::_new auto::Crypt::OpenSSL::RSA::DESTROY 
IP::Country::Fast

Aug 3 15:14:46 mailgate amavis[732]: SpamControl: init_pre_chroot done Aug 3 15:14:46 mailgate amavis[732]: Net::Server: 2007/08/03-15:14:46 Amavis (type Net::Server::PreForkSimple) starting! pid(732) Aug 3 15:14:46 mailgate amavis[732]: Net::Server: Binding to UNIX socket file /var/run/amavis/amavisd.sock using SOCK_STREAM Aug 3 15:14:47 mailgate amavis[732]: Net::Server: Binding to TCP port 10024 on host 127.0.0.1
Aug 3 15:14:47 mailgate amavis[732]: Net::Server: Setting gid to "10025 10025"

Aug  3 15:14:47 mailgate amavis[732]: Net::Server: Setting uid to "10025"
Aug  3 15:14:47 mailgate amavis[732]: Module Amavis::Conf        2.065
Aug  3 15:14:47 mailgate amavis[732]: Module Archive::Tar        1.32
Aug  3 15:14:47 mailgate amavis[732]: Module Archive::Zip        1.16
Aug  3 15:14:47 mailgate amavis[732]: Module BerkeleyDB          0.27
Aug  3 15:14:47 mailgate amavis[732]: Module Compress::Zlib      1.41
Aug  3 15:14:47 mailgate amavis[732]: Module Convert::TNEF       0.17
Aug  3 15:14:47 mailgate amavis[732]: Module Convert::UUlib      1.06
Aug  3 15:14:47 mailgate amavis[732]: Module DBD::mysql          2.9007
Aug  3 15:14:47 mailgate amavis[732]: Module DBI                 1.50
Aug  3 15:14:47 mailgate amavis[732]: Module DB_File             1.814
Aug  3 15:14:47 mailgate amavis[732]: Module Digest::MD5         2.33
Aug  3 15:14:47 mailgate amavis[732]: Module MIME::Entity        5.417
Aug  3 15:14:47 mailgate amavis[732]: Module MIME::Parser        5.417
Aug  3 15:14:47 mailgate amavis[732]: Module MIME::Tools         5.417
Aug  3 15:14:47 mailgate amavis[732]: Module Mail::Header        1.67
Aug  3 15:14:47 mailgate amavis[732]: Module Mail::Internet      1.67
Aug  3 15:14:47 mailgate amavis[732]: Module Mail::SpamAssassin  3.002001
Aug  3 15:14:47 mailgate amavis[732]: Module Net::Cmd            2.28
Do you need help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:
Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related lists.gentoo.org Links
gentoo-security
gentoo-server
gentoo-user
Request more information about Pantek
Aug  3 15:14:47 mailgate amavis[732]: Module Net::DNS            0.60
Aug  3 15:14:47 mailgate amavis[732]: Module Net::SMTP           2.31
Aug  3 15:14:47 mailgate amavis[732]: Module Net::Server         0.96
Aug  3 15:14:47 mailgate amavis[732]: Module Razor2::Client::Version 2.81
Aug  3 15:14:47 mailgate amavis[732]: Module Time::HiRes         1.9707
Aug  3 15:14:47 mailgate amavis[732]: Module Unix::Syslog        0.100
Aug  3 15:14:47 mailgate amavis[732]: Amavis::DB code      loaded
Aug  3 15:14:47 mailgate amavis[732]: Amavis::Cache code   loaded
Aug  3 15:14:47 mailgate amavis[732]: SQL base code        loaded
Aug  3 15:14:48 mailgate amavis[732]: SQL::Log code        NOT loaded
Aug  3 15:14:48 mailgate amavis[732]: SQL::Quarantine      NOT loaded
Aug  3 15:14:48 mailgate amavis[732]: Lookup::SQL code     loaded
Aug  3 15:14:48 mailgate amavis[732]: Lookup::LDAP code    NOT loaded
Aug  3 15:14:48 mailgate amavis[732]: AM.PDP-in proto code loaded
Aug  3 15:14:48 mailgate amavis[732]: SMTP-in proto code   loaded
Aug  3 15:14:48 mailgate amavis[732]: Courier proto code   NOT loaded
Aug  3 15:14:48 mailgate amavis[732]: SMTP-out proto code  loaded
Aug  3 15:14:48 mailgate amavis[732]: Pipe-out proto code  NOT loaded
Aug  3 15:14:48 mailgate amavis[732]: BSMTP-out proto code NOT loaded
Aug  3 15:14:48 mailgate amavis[732]: Local-out proto code loaded
Aug  3 15:14:48 mailgate amavis[732]: OS_Fingerprint code  NOT loaded
Aug  3 15:14:48 mailgate amavis[732]: ANTI-VIRUS code      loaded
Aug  3 15:14:48 mailgate amavis[732]: ANTI-SPAM code       loaded
Aug  3 15:14:48 mailgate amavis[732]: ANTI-SPAM-SA code    loaded
Aug  3 15:14:48 mailgate amavis[732]: Unpackers code       loaded
Aug  3 15:14:48 mailgate amavis[732]: Found $file            at 
Do you need more help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:
Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related lists.gentoo.org Links
gentoo-security
gentoo-server
gentoo-user
Request more information about Pantek
/usr/bin/file
Aug  3 15:14:48 mailgate amavis[732]: No $dspam,             not using it
Aug  3 15:14:48 mailgate amavis[732]: Internal decoder for .mail
Aug  3 15:14:48 mailgate amavis[732]: Internal decoder for .asc
Aug  3 15:14:48 mailgate amavis[732]: Internal decoder for .uue
Aug  3 15:14:48 mailgate amavis[732]: Internal decoder for .hqx

Aug 3 15:14:48 mailgate amavis[732]: Internal decoder for .ync Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .F at /usr/bin/unfreeze
Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .Z at /usr/bin/uncompress
Aug 3 15:14:49 mailgate amavis[732]: Internal decoder for .gz Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .gz at /bin/gzip -d (backup, not used)
Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .bz2 at /bin/bzip2 -d
Aug 3 15:14:49 mailgate amavis[732]: No decoder for .lzo tried: lzop -d
Aug 3 15:14:49 mailgate amavis[732]: No decoder for .rpm tried: rpm2cpio.pl, rpm2cpio
Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .cpio at /bin/cpio
Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .tar at /bin/cpio
Aug 3 15:14:49 mailgate amavis[732]: Internal decoder for .tar (backup, not used)
Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .deb at /usr/bin/ar
Aug 3 15:14:49 mailgate amavis[732]: Internal decoder for .zip Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .rar at /usr/bin/unrar
Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .arj at /usr/bin/unarj
Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .arc at /usr/bin/arc
Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .zoo at /usr/bin/zoo
Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .lha at /usr/bin/lha
Aug 3 15:14:49 mailgate amavis[732]: Found decoder for .cab at /usr/bin/cabextract

Aug  3 15:14:49 mailgate amavis[732]: No decoder for       .tnef tried: tnef
Aug  3 15:14:49 mailgate amavis[732]: Internal decoder for .tnef
Aug  3 15:14:49 mailgate amavis[732]: Found decoder for    .exe  at 

/usr/bin/unrar; /usr/bin/lha; /usr/bin/unarj Aug 3 15:14:49 mailgate amavis[732]: Found secondary av scanner ClamAV-clamscan at /usr/bin/clamscan
Aug 3 15:14:49 mailgate amavis[732]: Found secondary av scanner FRISK F-Prot Antivirus at /usr/bin/f-prot
Aug 3 15:14:49 mailgate amavis[732]: (!!) TROUBLE in pre_loop_hook: No TEMPBASE directory: /var/run/amavis/tmp at /usr/sbin/amavisd line 6812.

-- 
gentoo-server@gentoo.org mailing list

Received on Fri Aug 3 18:19:42 2007