邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: 有没有qmail+clamav的兄弟帮个忙啊！ [打印本页]

作者: liuchouchong 时间: 2006-9-19 14:41
标题: 有没有qmail+clamav的兄弟帮个忙啊！
今天我发现我的机器
top - 11:59:26 up 9 days,  1:30,  2 users,  load average: 1.64, 1.77, 1.66
Tasks:  88 total, 3 running,  85 sleeping, 0 stopped, 0 zombie
Cpu(s): 50.2% us,  0.2% sy,  0.0% ni, 49.3% id,  0.3% wa,  0.0% hi,  0.0% si
Mem: 4090124k total,  4008592k used, 81532k free, 69160k buffers
Swap:  2096440k total, 62320k used,  2034120k free, 209956k cached

  PID USER    PR  NI  VIRT  RES  SHR S %CPU %MEM TIME+  COMMAND
29349 qscand 25 0  488m 486m  844 R 99.8 12.2 1159:45 clamscan

为了防止内存溢出，我用pkil clamscan命令停止了这些clamscam
同时想起来了上周一在/var/log/messages中的一个错误：
lmail kernel: out of memory :killed process 12490(clamscam)
不知道有关系没有

当时我检查日志在/var/log/maillog中
以cat maillog | grep clamscan
输出结果：
Sep 13 10:23:19 mail X-Qmail-Scanner-1.25: [mail.xxx.com11581123904954166] clamscan: corrupt or unknown ClamAV scanner error or memory/resource/perms problem - exit status 0

我在/var/spool/qmailscan/qmail-queue.log下寻找发现了一个没有结束进程的LOG

Tue, 19 Sep 2006 16:12:24 CST:26447: +++ starting debugging for process 26447 by uid=508
Tue, 19 Sep 2006 16:12:24 CST:26447: setting UID to EUID so subprocesses can access files generated by this script
Tue, 19 Sep 2006 16:12:24 CST:26447: program name is qmail-scanner-queue.pl, version 1.25
Tue, 19 Sep 2006 16:12:24 CST:26447: incoming SMTP connection from via SMTP from 85.100.31.150
Tue, 19 Sep 2006 16:12:24 CST:26447: w_c: mkdir /var/spool/qmailscan/tmp/mail.xxx.com115865354449526447
Tue, 19 Sep 2006 16:12:24 CST:26447: w_c: start dumping incoming msg into /var/spool/qmailscan/working/tmp/mail.xxx.com115865354449526447 [0.000833]
Tue, 19 Sep 2006 16:12:24 CST:26447: c_a_g: found MIME attachment
Tue, 19 Sep 2006 16:12:24 CST:26447: w_c: primary Content-Type of multipart/related found
Tue, 19 Sep 2006 16:12:24 CST:26447: w_c: found a top-level boundary definition of \-\-\-\-\=_NextPart_000_0004_01C6DBDC\.6C65B250
Tue, 19 Sep 2006 16:12:24 CST:26447: w_c: attachment  1: Content-Type of multipart/alternative found
Tue, 19 Sep 2006 16:12:24 CST:26447: w_c: attachment  2: Content-Type of text/plain found
Tue, 19 Sep 2006 16:32:25 CST:26447: w_c: rename new msg from /var/spool/qmailscan/working/tmp/mail.xxx.com115865354449526447 to /var/spool/qmailscan/working/new/mail.xxx.com115865354449526447 [1200.856504]
Tue, 19 Sep 2006 16:32:25 CST:26447: d_m: starting /usr/local/bin/reformime  -x/var/spool/qmailscan/tmp/mail.xxx.com115865354449526447/ </var/spool/qmailscan/working/new/mail.xxx.com115865354449526447 [0.000378]
Tue, 19 Sep 2006 16:32:25 CST:26447: d_m: finished /usr/local/bin/reformime  -x/var/spool/qmailscan/tmp/mail.xxx.com115865354449526447/ [0.018379]
Tue, 19 Sep 2006 16:32:25 CST:26447: d_m: unpacking message took 0.018629 seconds
Tue, 19 Sep 2006 16:32:25 CST:26447: unsetting QMAILQUEUE env var
Tue, 19 Sep 2006 16:32:25 CST:26447: g_e_h: no sender and no recips.
Tue, 19 Sep 2006 16:32:25 CST:26447: cleanup: /bin/rm -rf /var/spool/qmailscan/tmp/mail.xxx.com115865354449526447/ /var/spool/qmailscan/working/new/mail.xxx.com115865354449526447

  大家谁能帮我解决一下啊！！！

[ 本帖最后由 liuchouchong 于 2006-9-20 12:02 编辑 ]

作者: zjww 时间: 2006-9-19 16:19

孩子，
难那

好好看看日志文件吧

日志文件很重要

作者: liuchouchong 时间: 2006-9-19 17:58
老大是看/var/spool/qmailscan/qmail-queue.log的日志吗？

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://5dmail.cn/bbs/)