efa-project.org

Thanks for the help with this shawniverson I havent had any repeat of these issues since I ran these commands on live.

shawniverson wrote: 09 May 2024 11:04 A better option would be to change this setting in /etc/MailScanner/MailScanner.conf:

Code: Select all

Still Deliver Unscannable Messages = yes

and restart mailscanner.

maybe this option too?

OK Thanks mate - I ran it with LIMIT 10000 and it ran in 0.9s

So I ran it again, and it only affected 3997 rows, so I'm guessing thats it sorted.

I will make sure I'm sorted with this and then do it on live.

Ok - so if it times out I reduce that number.

And potentially run it multiple times?

Thanks for this I really appreciate the help

ran amended command


ERROR 1205 (HY000): Lock wait timeout exceeded; try restarting transaction

ran it twice, same result.

Is there something wrong with the second command too?

DELETE FROM mtalog m WHERE m.timestamp < (NOW() - INTERVAL 14 DAY);

i get "you have an error in your syntax, check the manual that corresponds to your MariaDB server version for the right syntax to use near 'm WHERE m.timestamp < (NOW ...

shawniverson wrote: 17 May 2024 10:38 Oh my bad, missing a command, I'll edit the post

Thanks my man.

When I tried these commands on a test box I got " Error 1046 (3D000): No Database selected"
screenshot:
https://boltonuni-my.sharepoint.com/:i: ... w?e=qZQHaQ

Here's what to do in detail:

Execute the following. Set the interval to however long you retain data. It is 14 days in this example. The first delete may take a while, so be patient.


sudo mysql -u root

USE mailscanner;

DELETE FROM mtalog_ids WHERE smtp_id not in (SELECT msg_id FROM mtalog ...

So two questions -

how tf do I run the mysqlrecovery thing that post refers to?
Will it Break Things?

Also - that sounds like it might account for the PHP fatal errors in var log messages (which happens multiple times a day) , but not for eFa not logging anything (which has happened twice in a ...

MailWatch Version: 1.2.23

Operating System Version: CentOS Linux 7 (Core)

Postfix Version: 3.5.9

MailScanner Version: 5.5.1

ClamAV Version: 0.103.11

SpamAssassin Version: 3.4.6

PHP Version: 7.4.33

MySQL Version: 5.5.5-10.4.25-MariaDB

GeoIP Database Version: GeoLite2 Country database 2024-04 ...

Weird issue since updating all packages last week, eFA has stopped showing messages a couple of times. Email is being passed, but not logged in the appliance.

For example right now the last message logged is 2315 last night, so anything thats in quarantine etc I need to look at since then I have no ...

Something weird is going on here - I'm now seeing messages which I know are OK saying
Other Infection: Y

Report: Mailscanner: message attempted to kill MailScanner

clamd was using all of the CPU so maybe there was some kind of DOS going on. I've updated now and its churning through the queue.

thanks, appreciate the v fast response.

Hi
I think there might be an iffy clamav sig out - all of my incoming mail is getting "Virus (Denial of Service attack in message! )"

is there any way to (temporarily) disable the clamav scanning? (not ideal but in the circumstances I'll rely on further AV checking downstream)

Ian

I appear to be seeing this or at least something v similar today - dodgy clam sig?

I see various genuine messages being flagged by efa as "Virus (Denial of Service attack in message! )"

Not sure how to fix

Thanks for the reply Shawn

I'm not mad keen on putting another level of software on my box as a complication.

I'm tempted to play with the post-fix rate-limiting settings, I dont think there are many well-behaved senders who would be pissed off.

Will have a dig, though. Thanks

This is a filetype rule that is firing...

/etc/MailScanner/filetype.rules.conf

deny executable No executables No programs allowed



Hi Shawn

I'm seeing lots of instances where mailscanner sees .dat files and blocks them as executable - I could do with excluding dat extension as executable ...

Hi

Have searched forum, apologies if I've missed this...

We have a bit of an issue where our SU is contacting >7k recipients here using an external company who send via sendgrid (urgh).
They dump >7k messages in the inbound milter queue in a short space of time, leading to delays for other mail ...

shawniverson wrote: 25 Nov 2021 22:14 eFa-4.0.4-26 released with fix

Thanks v much shawn I will update next week.

Possible workaround for this crude detection of DOS:

/etc/MailScanner/MailScanner.conf
Ignore Denial Of Service = yes

This doesn't solve the problem but it does keep messages from getting quarantined. As for getting to the root cause, can anyone determine if any thing else stands out in any ...

Hi

No, I never got to the bottom of what was wrong with my first attempt. I think I'd broken it somehow by trying to be clever. I had done all sorts like install webmin before installing efa - in the end I scrapped it, went for a minimum install, let it get to anywhere on any port in my edge ...

shawniverson wrote: 17 Jun 2021 15:30 https://github.com/trusteddomainproject ... issues/179

Hi Shawn will this fix for opendmarc make it into the repo for yum to get hold of? Not sure I have it in me to compile a patch etc unless there are noddy instructions.

bizzare, my opendmarc was crashing all over the weekend and always restarted itself.

There is another way to do it in opendamrc.conf, where you can configure restart auto restart behaviour, max attempts, rates, etc.