On Fri, 2005-06-03 at 05:47 -0700, John W. Baxter wrote:
> On 6/3/05 5:05 AM, "John Horne" <John.Horne@???> wrote:
>
> > What I couldn't understand was why this suddenly started - literally
> > about 30 mins ago. The server had been running and sending/receiving
> > mail for the past few days. Looking at /var/spool/exim/scan showed it
> > had over 30,000 directories in it! These dated back to when the system
> > basically came on-line. It seemed that the errors were because the
> > directory was too big - there is bags of disk space available before
> > anyone asks! Next thought was that exim/SA wasn't deleting the
> > directories for some reason.
>
> Out of inodes? (If using a filesystem which suffers from that.) You didn't
> say what was in the 30,000 directories.
>
Nah, 'df -i' shows several million free :-)
Typical example:
drwxr-x--- 2 exim exim 4096 Jun 3 13:55 1DeBhY-0006o4-Ra
'ls -l 1DeBhY-0006o4-Ra' shows:
[root@tracy scan]# ls -l 1DeBhY-0006o4-Ra
total 16
-rw-rw-rw- 1 exim exim 379 Jun 3 13:55 1DeBhY-0006o4-Ra-00000
-rw-rw-rw- 1 exim exim 1354 Jun 3 13:55 1DeBhY-0006o4-Ra.eml
The '.eml' is the message body and headers. The '00000' file is just the
body. I assume it would be a mime attachment, but this is just a plain
text message:
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
What is a bit annoying is that I cannot find any reference to the
message or the sending host/IP address in our exim logs, but there is a
received: header line (line below wrapped):
Received: from cpe-065-191-069-073.nc.res.rr.com ([65.191.69.73])
by tracy.csd.plymouth.ac.uk with esmtp (Exim 4.51)
id 1DeBhY-0006o4-Ra
for stephen.hailey@???; Fri, 03 Jun 2005
13:55:05 +0100
As such I suspect that the problem is coming via us using the 'spam =
nobody:true' statement in the data acl.
Doh! I've just seen what I have written. We call spamd as user 'nobody'
no doubt, but 'nobody' doesn't have access to /var/spool/exim so I'm
wondering if that is the problem? Perhaps I should use something like
'spam = exim:true'?
John.
--
---------------------------------------------------------------
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: John.Horne@??? Fax: +44 (0)1752 233839
