<div dir="ltr"><div dir="ltr">>I see no way that MIME::Tools could possibly be relevant.</div><div>Agree, but I found a very old reference where someone had a similar problem and it was apparently fixed by reinstalling MIME::Tools<br></div><div dir="ltr"><br></div><div dir="ltr">>Do you see these events if you put that on real disk?</div><div>I moved the spool directory to a physical drive, and the error still happens.<br></div><div><br></div><div>>So: why was that working directory missing mid-scan? Or was it never <br>
>created? I have no ideas. Is /var/spool/MIMEDefang writeable by the user <br>
>running mimedefang? Could SELinux or AppArmor be interfering?</div><div><br></div><div>It seems the directory is never created - I will add some code tomorrow to verify this. Remember it works for 99%+ of e-mails. Only some emails fail which disqualifies SELinux, permissions, etc. Just for information sake, the permissions and owner is as follows:</div><div><br></div><div>drwxr-xr-x 6 defang root 135168 Nov 18 22:44 MIMEDefang</div><div><br></div><div>Here is a process showing the user is defang.</div><div></div><div>36414 defang 20 0 301728 63992 6524 S 10.9 0.1 0:01.51 <a href="http://mimedefang.pl">mimedefang.pl</a></div><div><br></div><div><br></div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, 18 Nov 2021 at 21:51, Bill Cole via MIMEDefang <<a href="mailto:mimedefang@lists.mimedefang.org">mimedefang@lists.mimedefang.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 2021-11-18 at 11:28:08 UTC-0500 (Thu, 18 Nov 2021 18:28:08 +0200)<br>
Ernst du Plooy via MIMEDefang <<a href="mailto:mimedefang@lists.mimedefang.org" target="_blank">mimedefang@lists.mimedefang.org</a>><br>
is rumored to have said:<br>
<br>
> I tried to reinstall MIME::Tools, but the issue remains.<br>
<br>
I see no way that MIME::Tools could possibly be relevant.<br>
<br>
> No space issues<br>
> root@relay2 ~]# df -h |grep MIMEDefang<br>
> tmpfs 4.0G 3.4M 4.0G 1% /var/spool/MIMEDefang/<br>
<br>
Do you see these events if you put that on real disk?<br>
<br>
> The inital example I've sent is extremely confusing and I can't really <br>
> wrap<br>
> my head around it. To make things easier and to first look at the<br>
> directory problem I extracted another example:<br>
<br>
I do not see more than one queue ID in these log lines.<br>
<br>
> [root@relay2 ~]# cat /var/log/maillog |grep 1AIFm3xE022061<br>
> Nov 18 17:48:05 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17432]: 1AIFm3xE022061: SPF <br>
> Result:<br>
> *pass*pass*<a href="http://nightsbridge.co.za" rel="noreferrer" target="_blank">nightsbridge.co.za</a>: 34.193.196.229 is authorized to use '<br>
> <a href="mailto:xxx@nightsbridge.co.za" target="_blank">xxx@nightsbridge.co.za</a>' in 'mfrom' identity (mechanism 'mx'<br>
> matched)*34.193.196.229*<<a href="mailto:booking@nightsbridge.co.za" target="_blank">booking@nightsbridge.co.za</a>>*<a href="http://mail.nightsbridge.com" rel="noreferrer" target="_blank">mail.nightsbridge.com</a><br>
> Nov 18 17:48:05 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17432]: 1AIFm3xE022061: NOTICE: <br>
> All<br>
> Filter Recipient tests passed<br>
> Nov 18 17:48:06 relay2 sendmail[22061]: 1AIFm3xE022061: from=<<br>
> <a href="mailto:booking@nightsbridge.co.za" target="_blank">booking@nightsbridge.co.za</a>>, size=2719, class=0, nrcpts=1,<br>
> msgid=<172494053.52128.1637250479567@localnode>, proto=ESMTP, <br>
> daemon=MTA,<br>
> relay=<a href="http://mail1.nightsbridge.com" rel="noreferrer" target="_blank">mail1.nightsbridge.com</a> [34.193.196.229]<br>
> Nov 18 17:48:06 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17375]: 1AIFm3xE022061:<br>
> MDLOG,1AIFm3xE022061,RECEIVE (sbn),,,<<a href="mailto:xxx@nightsbridge.co.za" target="_blank">xxx@nightsbridge.co.za</a>>,<<br>
> <a href="mailto:xxx@villabali.co.za" target="_blank">xxx@villabali.co.za</a>>,Booking for Villa Bali Boutique Hotel (xxx) - <br>
> xxxn%2C<br>
> arriving 15 Dec 2021<br>
> Nov 18 17:48:06 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17375]: 1AIFm3xE022061: Rules <br>
> Used:<br>
> <a href="http://xxx.co.za" rel="noreferrer" target="_blank">xxx.co.za</a><br>
> Nov 18 17:48:06 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17375]: 1AIFm3xE022061: DKIM <br>
> Domain:<br>
> <a href="http://xxx.co.za" rel="noreferrer" target="_blank">xxx.co.za</a><br>
> Nov 18 17:48:06 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17375]: 1AIFm3xE022061: Executing<br>
> DMARC for Domain (<a href="http://nightsbridge.co.za" rel="noreferrer" target="_blank">nightsbridge.co.za</a>) and IP (34.193.196.229).<br>
> Nov 18 17:48:06 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17375]: 1AIFm3xE022061: DKIM pass<br>
> DMARC: v=DMARC1; p=reject; rua=mailto:<a href="mailto:mailmaster@nightsbridge.com" target="_blank">mailmaster@nightsbridge.com</a>;<br>
> ruf=mailto:<a href="mailto:mailmaster@nightsbridge.com" target="_blank">mailmaster@nightsbridge.com</a>; adkim=s; aspf=s<br>
> Nov 18 17:48:06 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17375]: 1AIFm3xE022061: Clamd <br>
> returned<br>
> error: File path check failure: No such file or directory.<br>
> Nov 18 17:48:06 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17375]: 1AIFm3xE022061: <br>
> Anti-Virus:<br>
> Running virus scanner<br>
> Nov 18 17:48:06 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17375]: 1AIFm3xE022061: <br>
> Anti-Virus:<br>
> result: From: <<a href="mailto:xxx@nightsbridge.co.za" target="_blank">xxx@nightsbridge.co.za</a>> | Message: 999 swerr | Action:<br>
> tempfail | Virus-Name: | Complete-Message:<br>
> Nov 18 17:48:06 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17375]: 1AIFm3xE022061: <br>
> Anti-Virus:<br>
> scanner tempfail!<br>
> Nov 18 17:48:06 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17375]: 1AIFm3xE022061: High Load<br>
> Server<br>
> Nov 18 17:48:06 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17375]: 1AIFm3xE022061: NOTICE: <br>
> All<br>
> Filter tests passwd<br>
> Nov 18 17:48:06 relay2 <a href="http://mimedefang.pl" rel="noreferrer" target="_blank">mimedefang.pl</a>[17375]: 1AIFm3xE022061: NOTICE: <br>
> Scan<br>
> complete.<br>
> Nov 18 17:48:06 relay2 mimedefang[10998]: 1AIFm3xE022061: Filter did <br>
> not<br>
> create RESULTS file<br>
> Nov 18 17:48:06 relay2 mimedefang[10998]: 1AIFm3xE022061:<br>
> lstat(/var/spool/MIMEDefang/mdefang-1AIFm3xE022061) failed: No such <br>
> file or<br>
> directory<br>
> Nov 18 17:48:06 relay2 mimedefang[10998]: 1AIFm3xE022061: failed to <br>
> clean<br>
> up /var/spool/MIMEDefang/mdefang-1AIFm3xE022061: No such file or <br>
> directory<br>
> Nov 18 17:48:06 relay2 sendmail[22061]: 1AIFm3xE022061: Milter: data,<br>
> reject=451 4.3.2 Please try again later<br>
> Nov 18 17:48:06 relay2 sendmail[22061]: 1AIFm3xE022061: to=<<br>
> <a href="mailto:res@villabali.co.za" target="_blank">res@villabali.co.za</a>>, delay=00:00:01, pri=32719, stat=Please try again <br>
> later<br>
<br>
The only oddity I see here is that something whacked the MD working <br>
directory for 1AIFm3xE022061 while MD was still working with it.<br>
<br>
[...]<br>
<br>
> Maybe we should look at the new example to simplify things for now.<br>
<br>
OK, but it does have the difference of NOT having any issue with <br>
multiple queue IDs.<br>
<br>
So: why was that working directory missing mid-scan? Or was it never <br>
created? I have no ideas. Is /var/spool/MIMEDefang writeable by the user <br>
running mimedefang? Could SELinux or AppArmor be interfering?<br>
<br>
<br>
<br>
<br>
-- <br>
Bill Cole<br>
<a href="mailto:bill@scconsult.com" target="_blank">bill@scconsult.com</a> or <a href="mailto:billcole@apache.org" target="_blank">billcole@apache.org</a><br>
(AKA @grumpybozo and many *@<a href="http://billmail.scconsult.com" rel="noreferrer" target="_blank">billmail.scconsult.com</a> addresses)<br>
Not Currently Available For Hire<br>
<br>
_______________________________________________<br>
NOTE: If there is a disclaimer or other legal boilerplate in the above<br>
message, it is NULL AND VOID. You may ignore it.<br>
<br>
MIMEDefang mailing list <a href="mailto:MIMEDefang@lists.mimedefang.org" target="_blank">MIMEDefang@lists.mimedefang.org</a><br>
<a href="https://lists.mimedefang.org/mailman/listinfo/mimedefang_lists.mimedefang.org" rel="noreferrer" target="_blank">https://lists.mimedefang.org/mailman/listinfo/mimedefang_lists.mimedefang.org</a><br>
</blockquote></div></div>