help! i'm a newbie and just broke our spam assassin / clamav

[mrj <mr...@gmail.com>]

hello,
hope someone can help me. basically i'm new to all this and never setup this
freebsd box (with spam assassin and clam av). we use this box to filter mail
before it is sent to our exchange box, and now i broke it.

i was running out of space and normally i clear up the /var/spool/mqueue
folder, but this time i did something and forgot to backup before hand and
deleted these items (i'm not sure if that's what broke it).

1)
/var/log/-l   there was this wierd 72MB file that was named '-l'  and the
only way to remove it was rm -- -l
Is this (dash L) file any important log that needs to be there?

2)
/var/log/messages  i moved these off to another server.. to clear up space.
it seems it has recreated

3)
/var/spool/MD-Quarantine  -- i deleted all the subfolders and files in here,
but i'm guessing i wasn't supposed to and now in the message log i'm getting
an error all the time:   

mimedefang uid 26 on /var ... out of inodes.

how do i get the MD-Quarantine to spool the stuff again.

help! thanks for any help...
-- 
View this message in context: http://www.nabble.com/help%21-i%27m-a-newbie-and-just-broke-our-spam-assassin---clamav-tf3340176.html#a9289622
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: help! i'm a newbie and just broke our spam assassin / clamav

[Jonas Eckerman <jo...@frukt.org>]

mrj wrote:

> i was running out of space and normally i clear up the /var/spool/mqueue
> folder,

If I were you I would check if there is something else you could
 clear up before starting to forcefully delete queued mail.

Also, if your disk regularly fills up due to queued mail you need
to find out why an inordinate anount of mail gets queued or put
in more disk (or both). As an example, if the gateway accepts
mail for users that are unknown to the Exchange server you will
end up with loads of outgoing bounces of witch some will annoy
people and others will sit in your queue till the gateway gives
up on them.

How big is the partition /var/spool resides on?

Since this is a mail gateway (probably running MIMEDefang), you
need enough space for /var/spool to handle the mailqueue, the
quarantine dir and the gateways work files. It's quite possible
that /var/spool needs more space than the default size of /var.

> 2)
> /var/log/messages  i moved these off to another server.. to clear up space.
> it seems it has recreated

It should recreate. Do you have a cron job that rotate the log
files? Unless you have lots of disk, your log files should be
rotated regularly (usually nightly).

> 3)
> /var/spool/MD-Quarantine  -- i deleted all the subfolders and files in here,
> but i'm guessing i wasn't supposed to

That's probably a MIMEDefang quarantine directory. In that case
it's perfectly fine to delete the contents of that directory.

Actually, if you set up MIMEDefang to quarantine a significant
amount of mail I suggest you regularly remove old stuff from the
quarantine (either manually or with a cron job).

> mimedefang uid 26 on /var ... out of inodes.

Check for directories with lots of files on /var.

You have allready checked /var/spool/MD-Quarantine and
/var/spool/mqueue. Check any other /var/spool/*queue* and also
see if there are a bunch of /var/spool/MIMEDefang/mdefang-* left
bnehind.

Note 1: Do not clear the /var/spool/MIMEDefang directory
completely, but delete old /var/spool/MIMEDefang/mdefang-* if
they are there.

Note 2: The /var/spool/*mqueue directories are probably
sendmail's queue directory. You can use sendmail to see what's in
them and to manipulate them.

Regards
/Jonas
-- 
Jonas Eckerman, FSDB & Fruktträdet
http://whatever.frukt.org/
http://www.fsdb.org/
http://www.frukt.org/

Re: help! i'm a newbie and just broke our spam assassin / clamav

[Matt Kettler <mk...@verizon.net>]

mrj wrote:
> hello,
> hope someone can help me. basically i'm new to all this and never setup this
> freebsd box (with spam assassin and clam av). we use this box to filter mail
> before it is sent to our exchange box, and now i broke it.
>
> i was running out of space and normally i clear up the /var/spool/mqueue
> folder, but this time i did something and forgot to backup before hand and
> deleted these items (i'm not sure if that's what broke it).
>
> 1)
> /var/log/-l   there was this wierd 72MB file that was named '-l'  and the
> only way to remove it was rm -- -l
> Is this (dash L) file any important log that needs to be there?
>   
No.. looks like someone screwed up trying to use the cp command with the
-l flag.

> 2)
> /var/log/messages  i moved these off to another server.. to clear up space.
> it seems it has recreated
>   
That works in a pinch, but generally you should use a tool to do this
automatically, such as logrotate.

Also, if you don't use a tool to do this, it is advisable to send a HUP
signal to your syslogd so it knows to recreate the file.
> 3)
> /var/spool/MD-Quarantine  -- i deleted all the subfolders and files in here,
> but i'm guessing i wasn't supposed to and now in the message log i'm getting
> an error all the time:   
>
> mimedefang uid 26 on /var ... out of inodes.
>   

Generally 3) should actually HELP with the problem your having, not hurt it.

Out of inodes basically means there's  too many files on the particular
filesystem for the filesystem to track. This is usually caused by
directories with lots of small files

You might try looking for directories under /var that have lots of small
files.. this should work if memory serves me correctly:

*find /var -size -3 -print*