[Mimedefang] "cmd read returned"

[Joseph Brennan]

>From two weeks ago:

> The error message: cmd read returned 0, expecting 5
> 
> means that the Sendmail end of the milter state machine expected to read
> 5 characters from mimedefang, but got EOF instead.


Solved. Or at least, explained.

It finally happened again yesterday, and this time I noticed the following
lines in /var/log/messages:

Jun  1 15:58:20 sendprodmail01 rsyslogd-2177: imuxsock begins to drop
messages from pid 2032 due to rate-limiting

Jun  1 15:58:20 sendprodmail01 kernel: mimedefang.pl invoked oom-killer:
gfp_mask=0x200da, order=0, oom_adj=0, oom_score_adj=0


So we lost mimedefang.sock because the system killed mimedefang. I now
believe that "cmd read returned 0, expecting 5" was just sendmail getting
no response, which makes sense when the milter has disappeared.

Why was imuxsock so busy? SELinux defaults (which are new to me). Imagine
trying to record in audit.log every time a file is created and deleted in
/var/spool, on a busy mail server. Dear readers, I hope you come no closer
to it than your imagination.

--Joseph Brennan
Columbia University