On Sat, 27 Sep 2003, Frank DeChellis DSL wrote:
| Can anybody tell me what this directory does? We are using Exim 4.2 with
| SpamAssassin and I use the ACL to scan for .exe files becuase of that
| worm.
|
| This directory /var/spool/exim/scan gets very large, very fast.
Something is wrong - mails should always be deleted from /scan after
they've been scanned. According to the changelog, exiscan -12 fixes a bug
in this area if you use a "discard" ACL verb.
Is mail being delivered OK despite this ?
For the record, we had /scan filling up *very* fast when I stupidly
started exim from a shell with filesize limit 200MB. The config said:
# log the spam score:
warn log_message = Spam score: $spam_score
spam = nobody:true
to scan and log score of every message.
Something was crashing on trying to append to the rejectlog, which had
grown to 200MB. Callers were seeing connection drop before the 5xx/2xx
response to DATA.
Then when more than 32768 items were present in /scan, no more files could
be created and scanning later stopped altogether.
All this was down to stupidly starting exim with a filesize limit. But I
do wonder if something in exiscan is not checking a return value properly.
exim 4.22, exiscan -12, solaris 9
--
Chris Edwards, Glasgow University Computing Service
