Big bug!!! System runs out of disc space in minutes!!!

[daxis]

This morning one of my systems got updated.
Since then logs are overflowed with errors.
So much errors that disc space runs out in minutes! Gigs are added by the second!

Error:
PHP message: PHP Warning: readdir() expects parameter 1 to be resource, bool given in /var/www/html/mailscanner/postfix.inc.php on line 32

In /var/log/php-fpm/www-error.log
And /var/log/httpd/ssl_error_log

Not sure it already was simultaneously or the second replaced the first after I disables logging in /etc/php-fpm.d/www.conf

This occurred after these updates:
MailScanner 5.5.1-1.eFa.el8 --> 5.5.1-4.eFa.el8
MailWatch 1.2.18-5.eFa.el8 --> 1.2.21-1.eFa.el8
eFa 4.0.4-40.eFa.el8 --> 4.0.4-41.eFa.el8
postfix_eFa 3.5.9-1.eFa.el8 --> 3.5.23-1.eFa.el8

My systems are running CentOS Stream Linux 8.

[daxis]

I think I found the source, RPC.

My other machine received error 500 with RPC from the updated machine.
Looks like this overflowed logging in the updated machine like a mad man.

After clearing the logs and disabling RPC between the 2 machines all went quiet again.

Strangely enough the updated machine didn't received error 500 with RPC from the not-updated machine.

[shawniverson]

For some reason your machine choked on this function. This function is indeed called by RPC. Based on the PHP warning, it couldn't open the /var/spool/postfix/hold directory.

Code: Select all

function postfixinq()
{
    $handle = opendir('/var/spool/postfix/hold/');
    $inq = 0;
    while (false !== ($file = readdir($handle))) {
        // evaluate each entry, removing the . & .. entries
        if ('.' !== $file && '..' !== $file) {
            ++$inq;
        }
    }
    closedir($handle);

    return $inq;
}

Please run

Code: Select all

ls -lZ /var/spool/postfix

and see if your hold directory looks like this:

Code: Select all

drwxr-x---. 2 postfix mtagroup system_u:object_r:postfix_spool_t:s0           6 Sep 26 14:20 hold

Also check and make sure apache is a member of mtagroup in /etc/group.

Finally, check for any SELinux denials in /var/log/audit/audit.log relating to the /var/spool/postfix/hold directory.