Topic: Mail left in /var/spool/qpsmtpd

[Frank VB]

I had a problem with my 7.1.2 SME server this week. After an update of the Clamav signature database failed, users reported they couldn't send/receive any mails. Clamd was using a lot of CPU power and reported an error "Can't lock database directory: /var/clamav" every hour. I restarted the server which alleviated the problem.

Today I noticed that a number of mails are left behind in the /var/spool/qpsmtpd folder. The files are all named DDDDDDDDD:DDDDD:0 (where D is a decimal digit). If those mails are left in this folder, does this mean that they haven't been delivered? Most messages are spam, so I probably can delete those files, but how can I ensure that legitimate mails are delivered after all? How can I put them back in the mail queue and be sure they are (re)checked by Clamav?

Thanks

[Confucius]

In SME6 it was possible to inject mail again. I didn't see that function in SME7. I assumed that this means that it's done automatically.

In other posting about the locked dbase error I noticed that after a reboot systems seemed to function normal again for a period of time.

I suggest to try a reboot and check again if these mails get delivered or not.

Pls.. don't forget to post your findings for others here again.

Harro

[jfarschman]

Frank,

  There is a nice contrib that helps you manage the queue.  It's called "smeserver-saco-qmHandle"   Once installed it adds a server-manager panel that lets you do some of the basic things... like delete one at a time or resend messages.

  if you go into the command line and clean everything out with

  qmHandle -D

  Check it out.  It a nice way to manage the queue.

[dmay]

I had a problem with my 7.1.2 SME server this week. After an update of the Clamav signature database failed, users reported they couldn't send/receive any mails. Clamd was using a lot of CPU power and reported an error "Can't lock database directory: /var/clamav" every hour.

http://bugs.contribs.org/show_bug.cgi?id=2743
http://bugs.contribs.org/show_bug.cgi?id=2349

Add your comments to the relevant bugs.

Darrell

[dmay]

smeserver-saco-qmHandle

This is a nice qmail contrib. However I'm not sure if it has anything to do with qpsmtpd or the /var/spool/qpsmtpd folder.

Darrell

[Frank VB]

jfarschman, thanks for the tip. I installed the qmHandle but it indicates that there are no messages in the queue, so there's probably no point cleaning it.

Darrell, I tried to post my comments in the bugtracker but I'm not able to create a new account due to some internal server error. I think bug http://bugs.contribs.org/show_bug.cgi?id=2743 is probably related to what occured on my server.

I investigated my log files a little bit further. The freshclam log has the following error which was resolved (for the time being) after rebooting the server:

@40000000461c25fd09e491e4 daily.inc updated (version: 3065, sigs: 3293, f-level: 14, builder: sven)
@40000000461c25fd09e7f8fc Database updated (107793 signatures) from db.local.clamav.net (IP: 130.59.10.35)
@40000000461c25fd09f4456c Clamd successfully notified about the update.
@40000000461c340c30c849f4 Received signal: wake up
@40000000461c344d318183ec ERROR: Can't lock database directory: /var/clamav
@40000000461c425d16c0f574 Received signal: wake up
@40000000461c429e180354cc ERROR: Can't lock database directory: /var/clamav
@40000000461c50ad38d625e4 Received signal: wake up
@40000000461c50ee39568144 ERROR: Can't lock database directory: /var/clamav
@40000000461c5efe1e7e4834 Received signal: wake up
@40000000461c5f3f1f7f398c ERROR: Can't lock database directory: /var/clamav
@40000000461c6d4f04a552cc Received signal: wake up
@40000000461c6d90058951fc ERROR: Can't lock database directory: /var/clamav
@40000000461c7b9f26457664 Received signal: wake up
@40000000461c7be0270ad9a4 ERROR: Can't lock database directory: /var/clamav
@40000000461c89f015c065c4 Received signal: wake up
@40000000461c8a31170b509c ERROR: Can't lock database directory: /var/clamav
@40000000461c98410677efec Received signal: wake up
@40000000461c988437f45d1c ERROR: Can't lock database directory: /var/clamav
@40000000461ca13d100cc5b4 ClamAV update process started at Wed Apr 11 10:49:55 2007
@40000000461ca13d22e12d24 main.inc is up to date (version: 43, sigs: 104500, f-level: 14, builder: sven)
@40000000461ca13d231b0d8c daily.inc is up to date (version: 3065, sigs: 3293, f-level: 14, builder: sven)
@40000000461caf4d0931a14c Received signal: wake up

And my clamd log said:

@40000000461c17d50f9a77fc SelfCheck: Database modification detected. Forcing reload.
@40000000461c17d50f9a973c Reading databases from /var/clamav
@40000000461c182014861cbc Database correctly reloaded (128399 signatures)
@40000000461c1fdb24002214 SelfCheck: Database status OK.
@40000000461c2744366698fc SelfCheck: Database modification detected. Forcing reload.
@40000000461c27443666c3f4 Reading databases from /var/clamav
@40000000461c27451308c7a4 LibClamAV Error: cli_realloc(): Can't re-allocate memory to 864 bytes.
@40000000461c2745130b5bcc realloc_problem: Cannot allocate memory
@40000000461c2745130be86c LibClamAV Error: cli_ac_addpatt(): Unable to realloc nodetable (864 bytes)
@40000000461c2745130c6d3c LibClamAV Error: cli_parse_add(): Problem adding signature (2).
@40000000461c2745130cee24 LibClamAV Error: Problem parsing signature at line 22834
@40000000461c2745130d6b24 LibClamAV Error: Problem parsing database at line 22834
@40000000461ca11c085d327c Running as user clamav (UID 5047, GID 5047)
@40000000461ca11c085d4dd4 clamd daemon 0.90.1 (OS: linux-gnu, ARCH: i386, CPU: i386)
@40000000461ca11c085d615c Log file size limited to 1048576 bytes.
@40000000461ca11c085d70fc Reading databases from /var/clamav
@40000000461ca13b3aeac95c Loaded 107793 signatures.
@40000000461ca13c0062983c WARNING: Socket file /var/clamav/clamd.socket exists. Unclean shutdown? Removing...
@40000000461ca13c00668fdc Unix socket file /var/clamav/clamd.socket
@40000000461ca13c00675ee4 Setting connection queue length to 30
@40000000461ca13c00690c94 Listening daemon: PID: 3289
@40000000461ca13c0069c044 Archive: Archived file size limit set to 15728640 bytes.
@40000000461ca13c006a4ce4 Archive: Recursion level limit set to 8.
@40000000461ca13c006ad59c Archive: Files limit set to 1500.
@40000000461ca13c006b623c Archive: Compression ratio limit set to 300.
@40000000461ca13c006beaf4 Archive support enabled.
@40000000461ca13c006c7794 Algorithmic detection enabled.
@40000000461ca13c006d004c Portable Executable support enabled.
@40000000461ca13c006d851c ELF support enabled.
@40000000461ca13c006e15a4 Mail files support enabled.
@40000000461ca13c006ea62c Mail: Recursion level limit set to 64.
@40000000461ca13c006f2afc OLE2 support enabled.
@40000000461ca13c006fabe4 PDF support disabled.
@40000000461ca13c00702ccc HTML support enabled.
@40000000461ca13c0070b19c Self checking every 1800 seconds.
@40000000461ca94d083d5e0c No stats for Database check - forcing reload
@40000000461ca94d083d7964 Reading databases from /var/clamav
@40000000461ca96520f0da8c Database correctly reloaded (107793 signatures)
@40000000461cb1b31f2c04c4 SelfCheck: Database status OK.
@40000000461cb8ca12ec0074 SelfCheck: Database status OK.
@40000000461cbd5f2031340c Reading databases from /var/clamav
@40000000461cbd79268d220c Database correctly reloaded (107876 signatures)
@40000000461cc1560d4fd834 SelfCheck: Database status OK.

So to get back to my original question, anyone on what to do with the files left behind in the /var/spool/qpsmtpd directory?

[dmay]

Darrell, I tried to post my comments in the bugtracker but I'm not able to create a new account due to some internal server error.

This is a critical error that needs to be reported to contribs.org. Not left buried in a forum post. Did you do this?

Darrell

[Frank VB]

Darrell

As mentioned in my previous reply, I tried to open a new bugzilla account so I could report this error. I wasn't able to do so because I receive an internal server error on the bugzilla site! Perhaps someone could post it for me who already has a bugzilla account.

By the way, had to restart my server again today because I received again a message that the /var/clamav directory couldn't be locked. I also saw numerous error messages in the qpsmtpd log file telling me there are "too many connections 40 >= 40".

Frank

[dmay]

Darrell, I tried to post my comments in the bugtracker but I'm not able to create a new account due to some internal server error.

http://bugs.contribs.org/show_bug.cgi?id=2899

Darrell

[Frank VB]

Thank you, Darrell, for the bug posting. It was a kind of a catch 22.

[dmay]

So to get back to my original question, anyone on what to do with the files left behind in the /var/spool/qpsmtpd directory?

IIUC 'cause I'm just guessing...

This directory appears to be a temporary spool area I believe for plugins like clamav. In a perfect world this dir should be close to empty. Current incoming files being spooled, processed then deleted. However when clamav has issues, resulting in qpsmptd having issues, this leads people to reboot their servers and you get files left behind in this spool dir.

Maybe qmail-inject can be used.

When BugZilla is back to accepting new accounts (hopefully soon), you should open a bug on this specific topic.

Darrell

[Frank VB]

I think that the e-mail files that are left behind in the qpsmtpd folder can be deleted because they've been delivered. On friday my server was again showing the same clamav symptoms as before. I quickly sent an e-mail to my private e-mail account to test the situation. The e-mail file in question remained in the qpsmtpd folder but was successfully delivered to my (private) e-mail account.

I'll add my comment to bug 2743 on monday if I'm able to create a bugzilla account.

Frank