> Quoting Brian (bcook-exim@???):
>
>> Why does this happen from time to time?
>> root@b [/var/spool/exim/scan/1BSLbs-0007od-7t]# 54 > du -sh *
>
> This is a temporary directory made by the Exiscan patch, in which parts
> from a message with attachments are stored to be checked for viruses
> and other malware or spam.
>
>> 4.1M 1BSLbs-0007od-7t.eml
>
> Aparently this is a very large message containing a lot of attachments.
>
>> root@b [/var/spool/exim/scan/1BSLbs-0007od-7t]# 60 > file *
>> 30852 spamd 28 0 365M 181M RUN 1:49 0.00% 0.00% perl
>
> More important would be if you see messages that can indicate something
> went wrong while Exiscan was checking the contents, or why it didn't
> remove the temporary directory.
>
>> can someone offer some help as to what I can debug to find out why this
>> does this from time to time?
>
> Is there still a message in your mailq with that same message ID?
> Grep your logs for it, and let us know.
>
> Sander.
> --
> | You will experience a strong urge to do good; but it will pass.
> | 1024D/08CEC94D - 34B3 3314 B146 E13C 70C8 9BDB D463 7E41 08CE C94D
>
> --
>
> ## List details at http://www.exim.org/mailman/listinfo/exim-users Exim
> details at http://www.exim.org/ ##
>
>
I just noticed this again..
trying to deal with it..
load on the box is like 68% :/
root@b [/var/spool/exim/scan/1BSTFC-000FK9-4f]# 32 > du -sh *
4.1M 1BSTFC-000FK9-4f-00000
2.0K 1BSTFC-000FK9-4f-00000.com
3.0M 1BSTFC-000FK9-4f-00000.txt
2.0K 1BSTFC-000FK9-4f-00001
2.0K 1BSTFC-000FK9-4f-00001.com
2.0K 1BSTFC-000FK9-4f-00002
2.0K 1BSTFC-000FK9-4f-00002.com
4.1M 1BSTFC-000FK9-4f-00003
4.1M 1BSTFC-000FK9-4f-00003.com
4.1M 1BSTFC-000FK9-4f-00004
2.0K 1BSTFC-000FK9-4f-00004.com
2.0K 1BSTFC-000FK9-4f-00005
2.0K 1BSTFC-000FK9-4f-00005.com
2.0K 1BSTFC-000FK9-4f-00006
2.0K 1BSTFC-000FK9-4f-00006.com
2.0K 1BSTFC-000FK9-4f-00007
2.0K 1BSTFC-000FK9-4f-00007.com
3.0M 1BSTFC-000FK9-4f-00008
4.1M 1BSTFC-000FK9-4f.eml
again it happens.. same host.. looks like an exchange 6 box..
[/var/spool/exim/scan/1BSTFC-000FK9-4f]# 34 > grep -ci Content-Type *
1BSTFC-000FK9-4f-00000:9
1BSTFC-000FK9-4f-00000.com:0
1BSTFC-000FK9-4f-00000.txt:0
1BSTFC-000FK9-4f-00001:0
1BSTFC-000FK9-4f-00001.com:0
1BSTFC-000FK9-4f-00002:0
1BSTFC-000FK9-4f-00002.com:0
1BSTFC-000FK9-4f-00003:6
1BSTFC-000FK9-4f-00003.com:6
1BSTFC-000FK9-4f-00004:5
1BSTFC-000FK9-4f-00004.com:0
1BSTFC-000FK9-4f-00005:3
1BSTFC-000FK9-4f-00005.com:0
1BSTFC-000FK9-4f-00006:0
1BSTFC-000FK9-4f-00006.com:0
1BSTFC-000FK9-4f-00007:1
1BSTFC-000FK9-4f-00007.com:1
1BSTFC-000FK9-4f-00008:0
1BSTFC-000FK9-4f.eml:10
does this mean anything?
Received: from mail.thompson.com ([207.226.10.50]
helo=dcexchange.thompson.local)
by b.mwall.bsdwebsolutions.com with esmtp (Exim 4.34; FreeBSD)
id 1BSTFC-000FK9-4f
for mhw@???; Tue, 25 May 2004 00:09:14 -0400
From: postmaster@???
To: mhw@???
Date: Mon, 24 May 2004 15:27:19 -0400
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="9B095B5ADSN=_01C44155A34F86F100002877dcexchange.thomp"
X-DSNContext: 335a7efd - 4446 - 00000001 - 80040546
Message-ID: <39fXcChYP00006101@???>
Subject: Delivery Status Notification (Failure)
This is a MIME-formatted message.
Portions of this message may be unreadable without a MIME-capable mail
program.
--9B095B5ADSN=_01C44155A34F86F100002877dcexchange.thomp
Content-Type: text/plain; charset=unicode-1-1-utf-7
This is an automatically generated Delivery Status Notification.
Delivery to the following recipients failed.
jeremy.pierce@???
--9B095B5ADSN=_01C44155A34F86F100002877dcexchange.thomp
Content-Type: message/delivery-status
(etc..)
Trying 207.226.10.50...
Connected to mail.thompson.com.
Escape character is '^]'.
220 dcexchange.thompson.local Microsoft ESMTP MAIL Service, Version:
6.0.3790.0 ready at Tue, 25 May 2004 00:25:27 -0400
anyhelp would be greatly appreciated...
This is the same message and same host that made this happen the last time..
- Brian
