On Sat, Apr 24, 2010 at 06:36:48PM -0400, Wietse Venema wrote: > Here is my reconstruction from this inadequate logging sample. > > > Apr 24 13:20:10 doctor doctor[31]: postfix/smtpd[17053]: 0762D12CFB0D: > > client=defout.telus.net[204.209.205.55] > > Apr 24 13:20:41 doctor doctor[31]: postfix/cleanup[17311]: 0762D12CFB0D: > > message-id=<6ef179d262924e5a8c03336971544...@taskercomp> > > At 13:22:00, a different Postfix SMTPD process reports a queue file > write error. This Postfix SMTPD process is missing from the logfile. > Also missing is the logging for the postmaster notice delivery. > > > Apr 24 13:22:04 doctor doctor[31]: postfix/qmgr[4921]: 0762D12CFB0D: > > from=<sender>, size=5104017, nrcpt=1 (queue active) > > Apr 24 13:22:04 doctor clamsmtpd: 100B1C: from=sender, to=recipient, > > status=CLEAN > > The logging shows a clamsmtpd filter, but the logging is missing > for the process that sends the message into the clamsmtpd filter. > > Let's assume that this missing process was the same missing Postfix > SMTPD process that reported a queue file write error. That is > admittedly optimistic, considering that you left out most of the > relevant information. > > Then, we have the following timeline: > > 13:20:10 The missing Postfix SMTPD process receives a connection. > > 13:20:10 The missing Postfix SMTPD process connects to a before-queue > filter (clamsmtpd). > > 13:20:10 The before-queue filter (clamsmtpd) connects to Postfix > SMTPD process 17053. > > 13:20:41 The before-queue filter (clamsmtpd) sends the message > header and perhaps the first part of the message body. > > 13:22:00 The missing Postfix SMTPD process times out (smtpd_proxy_timeout) > and sends a postmaster notification. I already mentioned > that the postmaster notification is missing in the logging. > > 13:22:04 The before-queue filter (clamsmtpd) finishes after two > and a half minute. This is long after the missing Postfix > SMTPD process has given up. > > If this timeline is correct then you have too many body_checks > rules, or you have a clamsmtpd setup that is taking too much time. > > But it is more likely that you left out a whole lot of other > relevant information with your selective logfile reporting. > > Wietse
Let me see if I can find the thorough transaction. I have amavisd-ng on 10024 and clamsmtpd on 10125. Problem is that this is not the only piece of e-mail being inspected at that time frame. -- Member - Liberal International This is doc...@nl2k.ab.ca Ici doc...@nl2k.ab.ca God, Queen and country! Never Satan President Republic! Beware AntiChrist rising! http://twitter.com/rootnl2k http://www.facebook.com/dyadallee UK Time for a Common Sense change vote Liberal Democrat / Alliance
