[Mimedefang] Problem running virus scanner

[Steve Sizemore]

On Wed, Mar 09, 2005 at 09:30:45PM -0500, David F. Skoll wrote:
> On Wed, 9 Mar 2005, Steve Sizemore wrote:
> 
> > Mar  9 02:37:29 mail mimedefang.pl[79764]: Problem running virus scanner: code=6, category=swerr, action=tempfail
> 
> > In case it matters, the virus scanner in use is uvscan (NAI) coupled
> > with perl File::Scan, although I've also added some others since the
> > problems surfaced.
> 
> uvscan is exiting with an exit code of 6, which (according to what little
> documentation I have) means "A general problem occurred".  (The comment
> in mimedefang.pl adds a harsh retort.)
> 
> You need to file a bug report with NAI asking them to write decent
> software, or at least document their return codes a little better so
> you can take prudent action.
> 
> If you find that these are all false positives, you can edit the
> routine interpret_nai_code to return OK if uvscan exits with an
> exit code of 6.

OK, this was enough for me to solve the immediate problem. I simply
turned off NAI and switched to clamav, which is working fine. (It would
be nice, though, to run both.)

However, I still don't understand how this failure can shut down
mimedefang altogether.

On Wed, Mar 09, 2005 at 11:28:16AM -0800, Steve Sizemore wrote:
> I'm seeing periods of failures, marked by entries in the log files
> similar to this:
> 
> Mar  9 02:37:29 mail mimedefang.pl[79764]: Problem running virus scanner: code=6, category=swerr, action=tempfail
> Mar  9 02:37:29 mail sm-mta[88575]: j29AbTkY088575: Milter: data, reject=451 4.3.0 Problem running virus-scanner
> Mar  9 02:37:29 mail sm-mta[88575]: j29AbTkY088575: to=<steve at math.berkeley.edu>, delay=00:00:00, pri=215450, stat=Problem running virus-scanner
> 
> These occur in bunches, and persist for an hour or more until things
> return to normal. So far, I haven't been able to correlate them with
> any specific cause. I'm guessing that it's some sort of timeout, but
> I've tried fiddling with all of the various timeouts that I can find,
> and in general, changing things makes the problem worse, rather than
> better.
> 
> It's a serious problem, because during these periods certain mail
> clients can't send outgoing mail.

In case it wasn't clear, when these failure periods happened, all
incoming and outgoing mail was deferred (temp fail), not just some
messages which presumably triggered this bad behavior by uvscan.

Thanks.
Steve
-- 
Steve Sizemore <steve (at) ls.berkeley.edu>, (510) 642-8570
Unix System Manager
    Dept. of Mathematics and College of Letters and Science
    University of California, Berkeley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
URL: <https://lists.mimedefang.org/pipermail/mimedefang_lists.mimedefang.org/attachments/20050313/e74eab17/attachment.sig>