mails kommen erst nach stunden an ...

[tobiask]

Hi,

das problem ist, die mails kommen immer alle erst so 5-9h nachdem sie abgeschickt wurden an,
also wenn ich von aussen ne mail an unseren server schicke, stellt er diese erst nach einigen stunden an uns weiter, warum?
liegt das viel. am virenscanner?

hier mal bissel log zeugs:

Code: Select all

p15156934:/var/log # tail -20 mail.warn
Jun 12 17:06:36 p15156934 avgatefwd[32314]: Message 'outgoing/xf-01009-40489FA8' queued since Fri Mar 25 03:30:06 2005 .
Jun 12 17:06:36 p15156934 avgatefwd[32323]: Message 'outgoing/xf-15564-2FFD6C54' queued since Sat Mar 26 18:30:04 2005 .
Jun 12 17:06:37 p15156934 avgatefwd[32337]: Message 'outgoing/xf-25725-65685478' queued since Fri Mar  4 04:15:03 2005 .
Jun 12 17:06:37 p15156934 avgatefwd[32349]: Message 'outgoing/xf-24065-338B9D10' queued since Sat Mar 26 18:05:53 2005 .
Jun 12 17:06:37 p15156934 avgatefwd[32353]: Message 'outgoing/xf-11595-66B7DF7B' queued since Sat Jan  8 16:00:05 2005 .
Jun 12 17:06:38 p15156934 avgatefwd[32366]: Message 'outgoing/xf-12444-7A95B225' queued since Fri Feb  4 10:26:47 2005 .
Jun 12 17:06:39 p15156934 avgatefwd[32390]: Message 'outgoing/xf-04557-28877A79' queued since Sat Mar 26 18:13:08 2005 .
Jun 12 17:06:43 p15156934 avgatefwd[32514]: Message 'outgoing/xf-29348-184EAA56' queued since Sat Mar 26 18:07:45 2005 .
Jun 12 17:08:44 p15156934 avgatefwd[868]: Too many running child processes in 'outgoing'.
Jun 12 17:10:46 p15156934 avgatefwd[868]: Too many running child processes in 'outgoing'.
Jun 12 17:12:47 p15156934 avgatefwd[868]: Too many running child processes in 'outgoing'.
Jun 12 17:14:49 p15156934 avgatefwd[868]: Too many running child processes in 'outgoing'.
Jun 12 17:16:51 p15156934 avgatefwd[868]: Too many running child processes in 'outgoing'.
Jun 12 17:18:52 p15156934 avgatefwd[868]: Too many running child processes in 'outgoing'.
Jun 12 17:20:53 p15156934 avgatefwd[868]: Too many running child processes in 'outgoing'.
Jun 12 17:22:56 p15156934 avgatefwd[868]: Too many running child processes in 'outgoing'.
Jun 12 17:24:14 p15156934 postfix/smtp[19298]: warning: no MX host for ubot.com has a valid A record
Jun 12 17:24:57 p15156934 avgatefwd[868]: Too many running child processes in 'outgoing'.
Jun 12 17:26:59 p15156934 avgatefwd[868]: Too many running child processes in 'outgoing'.
Jun 12 17:29:00 p15156934 avgatefwd[868]: Too many running child processes in 'outgoing'.

Code: Select all

p15156934:/var/log # tail -20 mail.err
Jun 12 17:06:29 p15156934 avgatefwd[32160]: Message 'outgoing/xf-13539-551507CE' queued since Fri Feb  4 20:14:47 2005 .
Jun 12 17:06:29 p15156934 avgatefwd[32163]: Message 'outgoing/xf-19520-5EAFD7DB' queued since Thu Mar 24 11:00:06 2005 .
Jun 12 17:06:31 p15156934 avgatefwd[32198]: Message 'outgoing/xf-32518-5A3736CD' queued since Mon Feb 14 00:15:05 2005 .
Jun 12 17:06:31 p15156934 avgatefwd[32203]: Message 'outgoing/xf-01306-2E2F4A09' queued since Sat Mar  5 14:00:05 2005 .
Jun 12 17:06:31 p15156934 avgatefwd[32204]: Message 'outgoing/xf-32104-3BDD35B0' queued since Fri Feb 25 04:30:05 2005 .
Jun 12 17:06:31 p15156934 avgatefwd[32205]: Message 'outgoing/xf-14240-4C2A3707' queued since Thu Mar 10 11:45:05 2005 .
Jun 12 17:06:33 p15156934 avgatefwd[32241]: Message 'outgoing/xf-00410-2F2C2D9F' queued since Thu Feb 17 06:30:05 2005 .
Jun 12 17:06:33 p15156934 avgatefwd[32242]: Message 'outgoing/xf-30268-069BF758' queued since Wed Feb 23 16:00:05 2005 .
Jun 12 17:06:33 p15156934 avgatefwd[32245]: Message 'outgoing/xf-11388-2ED48C62' queued since Tue Mar  8 01:30:08 2005 .
Jun 12 17:06:34 p15156934 avgatefwd[32270]: Message 'outgoing/xf-25927-2156C805' queued since Tue Feb  1 04:47:48 2005 .
Jun 12 17:06:35 p15156934 avgatefwd[32303]: Message 'outgoing/xf-29389-67F00C8D' queued since Sat Mar 26 18:07:48 2005 .
Jun 12 17:06:35 p15156934 avgatefwd[32306]: Message 'outgoing/xf-08673-3C4CD6E6' queued since Fri Mar 11 02:45:03 2005 .
Jun 12 17:06:36 p15156934 avgatefwd[32314]: Message 'outgoing/xf-01009-40489FA8' queued since Fri Mar 25 03:30:06 2005 .
Jun 12 17:06:36 p15156934 avgatefwd[32323]: Message 'outgoing/xf-15564-2FFD6C54' queued since Sat Mar 26 18:30:04 2005 .
Jun 12 17:06:37 p15156934 avgatefwd[32337]: Message 'outgoing/xf-25725-65685478' queued since Fri Mar  4 04:15:03 2005 .
Jun 12 17:06:37 p15156934 avgatefwd[32349]: Message 'outgoing/xf-24065-338B9D10' queued since Sat Mar 26 18:05:53 2005 .
Jun 12 17:06:37 p15156934 avgatefwd[32353]: Message 'outgoing/xf-11595-66B7DF7B' queued since Sat Jan  8 16:00:05 2005 .
Jun 12 17:06:38 p15156934 avgatefwd[32366]: Message 'outgoing/xf-12444-7A95B225' queued since Fri Feb  4 10:26:47 2005 .
Jun 12 17:06:39 p15156934 avgatefwd[32390]: Message 'outgoing/xf-04557-28877A79' queued since Sat Mar 26 18:13:08 2005 .
Jun 12 17:06:43 p15156934 avgatefwd[32514]: Message 'outgoing/xf-29348-184EAA56' queued since Sat Mar 26 18:07:45 2005 .

Code: Select all

p15156934:/var/log # tail -20 mail
Jun 12 17:36:07 p15156934 avgated[31770]: connection to localhost.localdomain closed
Jun 12 17:36:07 p15156934 avgatefwd[31771]: Message 'incoming/xf-32345-0AE1A7C2' scheduled for scanning now.
Jun 12 17:36:07 p15156934 avgatefwd[31772]: Message 'incoming/xf-31770-2D127C23' scheduled for scanning now.
Jun 12 15:36:07 p15156934 postfix/smtpd[31602]: 44BD1C0DAA3: reject: RCPT from unknown[127.0.0.1]: 450 <93@p15156934.pureserver.info>: User unknown in local recipient table; from=<wwwrun@p15156934.pureserver.info> to=<93@p15156934.pureserver.info> proto=ESMTP helo=<localhost.localdomain>
Jun 12 17:36:07 p15156934 avgatefwd[31772]: Virus Scanner will process message 'incoming/qf-31770-2D127C23'.
Jun 12 17:36:07 p15156934 spamd[31649]: clean message (0.3/5.0) for web6p5:104 in 7.1 seconds, 1443 bytes.
Jun 12 17:36:07 p15156934 postfix/local[31628]: E296AC0DA9A: to=<web6p5@p15156934.pureserver.info>, relay=local, delay=8, status=sent ("|/usr/bin/procmail")
Jun 12 17:36:07 p15156934 spamd[31670]: razor2 check skipped: No such file or directory Insecure dependency in open while running with -T switch at /usr/lib/perl5/vendor_perl/5.8.1/i586-linux-thread-multi/Razor2/Client/Config.pm line 414, <GEN24860> line 1.
Jun 12 17:36:08 p15156934 spamd[31661]: razor2 check skipped: No such file or directory Insecure dependency in open while running with -T switch at /usr/lib/perl5/vendor_perl/5.8.1/i586-linux-thread-multi/Razor2/Client/Config.pm line 414, <GEN24860> line 1.
Jun 12 17:36:08 p15156934 spamd[31670]: clean message (0.0/5.0) for web0p1:104 in 7.1 seconds, 1259 bytes.
Jun 12 17:36:08 p15156934 postfix/local[31652]: 2C684C0DA9B: to=<web0p1@p15156934.pureserver.info>, orig_to=<root@p15156934.pureserver.info>, relay=local, delay=8, status=sent ("|/usr/bin/procmail")
Jun 12 17:36:08 p15156934 spamd[31676]: razor2 check skipped: No such file or directory Insecure dependency in open while running with -T switch at /usr/lib/perl5/vendor_perl/5.8.1/i586-linux-thread-multi/Razor2/Client/Config.pm line 414, <GEN24869> line 1.
Jun 12 15:36:08 p15156934 postfix/smtpd[31602]: 44BD1C0DAA3: reject: RCPT from unknown[127.0.0.1]: 450 <92@p15156934.pureserver.info>: User unknown in local recipient table; from=<wwwrun@p15156934.pureserver.info> to=<92@p15156934.pureserver.info> proto=ESMTP helo=<localhost.localdomain>
Jun 12 17:36:08 p15156934 spamd[31661]: clean message (0.3/5.0) for web1p8:104 in 8.2 seconds, 1843 bytes.
Jun 12 17:36:08 p15156934 postfix/local[31636]: 0B1A1C0DA9C: to=<web1p8@p15156934.pureserver.info>, relay=local, delay=8, status=sent ("|/usr/bin/procmail")
Jun 12 15:36:09 p15156934 postfix/smtpd[31602]: 44BD1C0DAA3: reject: RCPT from unknown[127.0.0.1]: 450 <91@p15156934.pureserver.info>: User unknown in local recipient table; from=<wwwrun@p15156934.pureserver.info> to=<91@p15156934.pureserver.info> proto=ESMTP helo=<localhost.localdomain>
Jun 12 17:36:09 p15156934 spamd[31676]: identified spam (16.3/5.0) for web1p3:104 in 8.6 seconds, 5454 bytes.
Jun 12 17:36:09 p15156934 postfix/local[31642]: 19F6CC0DA9E: to=<web1p3@p15156934.pureserver.info>, relay=local, delay=9, status=sent ("|/usr/bin/procmail")
Jun 12 15:36:10 p15156934 postfix/smtpd[31602]: 44BD1C0DAA3: reject: RCPT from unknown[127.0.0.1]: 450 <90@p15156934.pureserver.info>: User unknown in local recipient table; from=<wwwrun@p15156934.pureserver.info> to=<90@p15156934.pureserver.info> proto=ESMTP helo=<localhost.localdomain>
Jun 12 15:36:20 p15156934 postfix/smtpd[31602]: 44BD1C0DAA3: reject: RCPT from unknown[127.0.0.1]: 450 <8@p15156934.pureserver.info>: User unknown in local recipient table; from=<wwwrun@p15156934.pureserver.info> to=<8@p15156934.pureserver.info> proto=ESMTP helo=<localhost.localdomain>

[chris76]

Die Mails an 8, 90, 91, 93@p15156934.pureserver.info werden zurückgewiesen da die adressen unbekannt sind. Sind das gewünschte empfänger adressen?


Wie ist antivir Konfiguriert??

[tobiask]

Die Mails an 8, 90, 91, 93@p15156934.pureserver.info werden zurückgewiesen da die adressen unbekannt sind. Sind das gewünschte empfänger adressen?


Wie ist antivir Konfiguriert??

nein, das ist ja die server adresse von 1&1, die is aussen gar net bekannt, wird also spam sein, der soll ja auch weg
aber normale mails brauchen auch stunden, wenn wir sie verschicken und so ...

antivir conf is das:

Code: Select all

p15156934:~ # cat /etc/antivir.conf
#
# sample AntiVir configuration file
#

# You can receive email notifications of alerts using this
# directive. You must specify the email address to which the
# notification will be sent. There is no default value for
# this directive.
#EmailTo root@localhost

# Concerning activity may also be logged to a specified file
# (in addition to syslog). You must specify the file. There
# is no default value for this directive.
LogTo /var/log/antivir.log

# New engine and data files can be automatically
# updated via the internet. Please use only one of the
# following options as the last one will be taken. You
# can choose to have the automatic updates be every 2 hours
# or once a day. If neither directive is given, the
# automatic internet updater will be disabled.
# Note: Internet updates can also be done manually using
#       the --update parameter with the command line
#       scanner.
AutoUpdateEvery2Hours
#AutoUpdateDaily

# If automatic updates are done daily, you can specify
# at what time of day the updates should be done.
#AutoUpdateTime 4:23

# If your machine uses an HTTP proxy server, you must
# specify the proxy configuration settings in order to
# make internet updates.
#HTTPProxyServer proxy.domain.com
#HTTPProxyPort 8080
#HTTPProxyUsername username
#HTTPProxyPassword password

# Regardless of the above configuration settings, AntiVir
# will always log important information using syslog. It
# is possible to specify which syslog facility and
# priority you would like AntiVir to use. If not given,
# default values are facility:user priority:notice.
#SyslogFacility user
#SyslogPriority notice

# AntiVir supports GnuPG (http://www.gnupg.org) in order
# to verify the authenticity of internet update files.
# In order for the updater to utilize GnuPG, it must know
# where the executable is located. If you choose to take
# advantage of GnuPG, be aware that all updates will fail
# until the AntiVir public key (antivir.gpg) has been
# added to your keyring and signed.
#GnuPGBinary /usr/local/bin/gpg

# If you are utilizing GnuPG, you may also specify
# options that your particular setup might need.
# Normally no options are required.
#GnuPGOptions

# These settings allow for the detection of certain categories
# of software which are not viruses but might not be wanted.
# By default all these tests are turned off. They can be enabled
# by uncommenting the following keywords.
DetectDialer
DetectJoke
DetectGame
DetectPMS

# By default the updater drops the new software right into place.
# Should you wish to keep previous versions of the replaced files
# then activate this option.  When enabled the old versions will
# be kept inside "updater-backup-YYYYmmdd-HHMMSS" subdirectories.
# Note: You may need to schedule cleanup jobs when using this
#       feature so that your disk does not fill up.
#UpdaterKeepsBackups

[chris76]

Moin, ich vermute das bei dir was mit antivir schiefgeht.

Poste doch mal die Ausgabe von

Code: Select all

/usr/lib/AntiVir/antivir --version

ohne deine Kontaktdaten.

Dann mal ein Maillog wenn du eine Mail an dich schickst und wann diese zugestellt wird.

Liegen diese Mails in der zwischenzeit in der avq?

Hast du an der /etc/avmailgate.conf was abgeändert?

Poste doch auch mal die Ausgabe von

Code: Select all

 ps aux|grep antivir

.

[tobiask]

Code: Select all

p15156934:~ # /usr/lib/AntiVir/antivir --version
6.30.0.15
operating system: Linux (glibc 2.2)
product version:  2.1.3-40 +gui
engine version:   6.30.0.15
packlib version:  2.0.5.1 (supports 27 formats)
vdf version:      6.30.0.236

product:          AntiVir Workstation
key file:         avmgate.key
registered user:  *************
serial number:    *************
key expires:      31 May 2005
run mode:         PERSONAL

product:          AntiVir MailGate
key file:         avmgate.key
registered user:  ***********
serial number:    ***********
key expires:      31 May 2005
run mode:         PERSONAL

product:          AntiVir (command line scanner)
key file:         avmgate.key
registered user:  **************
serial number:    **************
key expires:      31 May 2005
run mode:         PERSONAL

und

Code: Select all

uucp      3537  0.0  0.1 10096  768 ?        SN   Jun07   0:04 /usr/lib/AntiVir/antivir --mailgate --temp=/var/tmp
root     15767  0.2  1.6 10252 8512 ?        S    13:03   0:00 /usr/lib/AntiVir/antivir --update -q
root     22930  0.0  0.1  1768  588 pts/0    S    13:09   0:00 grep antivir

kann es sein das es daran liegt das der key nicht mehr aktuell is, das hab ich gar nicht bemerkt!?

mailconf hab ich auch geändetr glaubsch, das die aktuelle:

Code: Select all

#######################################################################
##                        avmailgate.conf                            ##
#######################################################################

# This file lists all the available parameters. Lines beginning with '#'
# are comments and are ignored. When a parameter is not specified, some
# default value is used.  The default values are the values shown here,
# unless otherwise indicated.



###################################
# Parameters used by both daemons #
################################### 

# ------------------------------------------------------------------------
# Avgated and avgatefwd will switch to this user and group
# as soon as possible. Avgated will do this after opening
# the SMTP port and avgatefwd will do it immediately.

# User                            uucp 
# Group                           uucp


# ------------------------------------------------------------------------
# Who will get errors and virus alerts.

# Postmaster                      postmaster


# ------------------------------------------------------------------------
# MyHostName: FQDN of the local host.
# The default value, if not set in configuration file, is that
# obtained by gethostname(2), or if this fails, "localhost".

# MyHostName                      localhost


# ------------------------------------------------------------------------
# The spooldir must be owned by User:Group (as specified above)
# and must be accessible by only this user (mode = 0700).
# Both programs will yell and refuse to run if something is wrong.

# SpoolDir                        /var/spool/avmailgate


# ------------------------------------------------------------------------
# AntiVirDir: The antivir 'library' directory, where the VDF, 
# the key, and some other files are stored.

# AntiVirDir                      /usr/lib/AntiVir


# ------------------------------------------------------------------------
# TemporaryDir: Where the temporary files are stored 
# (for example, attachments while virus checking them).
# It needs enough space to hold uncompressed attachments 
# for each forwarder, and some more.
# Default: "/var/tmp" or else "/tmp".

# TemporaryDir                    /var/tmp


# ------------------------------------------------------------------------
# You can set this option to RECIPIENT, SENDER or BOTH to allow matching of 
# domain name of the recipient and/or sender mail address, to check if it's 
# to be considered local. 

# If MatchMailAddressForLocal is RECIPIENT, and the recipient address matches
# the domain given in "local:", mail will be accepted.
# If MatchMailAddressForLocal is SENDER, and the sender address matches the 
# domain given in "local:", mail will be accepted.
# If MatchMailAdressForLocal is BOTH, and the recipient or the sender adresses 
# matches the domain given in "local:" mail will be accepted. 

# MatchMailAddressForLocal      RECIPIENT


# ------------------------------------------------------------------------
# SMTP greeting message.   

# SMTPBanner                    "AntiVir MailGate"


# ------------------------------------------------------------------------
# Where the pid files of avgated and avgatefwd are stored.
# Default: "/var/tmp" or else "/tmp".

# PidDir                        /var/tmp


# ------------------------------------------------------------------------
# Specify a full path with a filename to which AntiVir MailGate
# will write its log messages. AntiVir MailGate still logs to syslog
# even if this option is set.

# Default: NO - dont use custom logfile.

# E.g.: LogFile /var/log/avmailgate.log

# LogFile		NO



##############################
# Parameters used by avgated #
##############################

# ------------------------------------------------------------------------
# Select the interface, the SMTP daemon will listen on.
# The default listen address of 0.0.0.0 means all interfaces.
# IF YOU ARE UNSURE JUST LEAVE IT AS IS! 

ListenAddress  127.0.0.1  port 10025


# ------------------------------------------------------------------------
# Limit the number of simultanous connections from remote sites.
# A limit of 0 disables this feature.

# MaxIncomingConnections          0


# ------------------------------------------------------------------------
# Number of seconds until a timeout occures in SMTP conversation.

# SMTPTimeout		300


# ------------------------------------------------------------------------
# Larger mails will be rejected.
# A limit of 0 means "no limit" (in bytes). 

# MaxMessageSize                  0


# ------------------------------------------------------------------------
# Refuse incoming connections if less free blocks are available
# on the filesystem containing the spool directory.

# MinFreeBlocks                   100


# ------------------------------------------------------------------------
# So many recipients can be accepted at once.

# MaxRecipientsPerMessage         100


# ------------------------------------------------------------------------
# Refuse 'MAIL FROM:<>'.
# Actually, RFC2821, RFC821 and RFC2505 explicitely note that 'MAIL FROM: <>'
# MUST be accepted.  It is strongly recommended not to change the 
# default setting.

# RefuseEmptyMailFrom             NO


# ------------------------------------------------------------------------
# When AllowSourceRouting  is NO,  if source routing  is present  in the
# given recipient address path, it's removed.

# When AllowSourceRouting  is YES, then  source routing is  honored, and
# the messages is forwared to the  first host specified in the route..

# AllowSourceRouting              NO


# ------------------------------------------------------------------------
# When InEnvelopeAddressesBangIs is REFUSED,  the presence of an unquoted
# "!" in the recipient envelope  address implies that the message will be
# refused.

# When InEnvelopeAddressesBangIs  is IGNORED,  any unquoted "!"   will be
# processed as any other non-special character of the address.

# When  InEnvelopeAddressesBangIs  is INTERPRETED,  then  the address  is
# rewritten in RFC821 standard form. An address such as:

# hostA!hostB!hostC!user

# is rewritten as:

# @hostA,@hostB:user@hostC

# Then,  if source  routing is  allowed,  the message  is transmited  to
# hostA, otherwise it's directly sent to hostC.

# Thus, this rewritting allow us  to discover the recipient host, in the
# case where all  the UUCP gateways on the  route would have interpreted
# the address the same way as us.  (If that were not the case, then this
# parameters should be set to IGNORED).

# InEnvelopeAddressesBangIs        REFUSED


# ------------------------------------------------------------------------
# When  InEnvelopeAddressesPercentIs  is  REFUSED,  the  presence  of  an
# unquoted "%" in the recipient envelope address implies that the message
# will be refused.

# When InEnvelopeAddressesPercentIs is IGNORED,  any unquoted "%" will be
# processed as any other non-special character of the address.

# When InEnvelopeAddressesPercentIs  is INTERPRETED, then  the address is
# rewritten in RFC821 standard form. An address such as:

# user%hostC%hostB@hostA

# is rewritten as:

# @hostA,@hostB:user@hostC

# Then,  if source  routing is  allowed,  the message  is transmited  to
# hostA, otherwise it's directly sent to hostC.

# Thus, this rewritting allow us  to discover the recipient host, in the
# case where  all the gateways on  the route would  have interpreted the
# address the  same way  as us. (If  that were  not the case,  then this
# parameters should be set to IGNORED).

# InEnvelopeAddressesPercentIs     REFUSED


# ------------------------------------------------------------------------
# When AcceptLooseDomainName is  NO, if the name of  the domain selected
# for delivery  (depending on source routing) does  not strictly conform
# it the domain name syntax,then it's refused.

# When AcceptLooseDomainName is YES, then no check is done on the domain
# name, apart of  interpretting the domain name syntax  for numerical IP
# addresses.

# AcceptLooseDomainName           NO


# ------------------------------------------------------------------------
# If AddressFilter is YES, the recipient address and/or the sender address of
# an email will be matched against a table of addresses.
# Two tables will be matched in a specified order (see option "FilterTableOrder").
# For more details please have a look at the MANUAL.
# (YES is only available in commercial mode)

# AddressFilter NO


# ------------------------------------------------------------------------
# If AddressFilter is set to yes one can specify which table has to be matched
# for a sender and/or recipient address first.
# Options are: scan,ignore | ignore,scan

# FilterTableOrder scan,ignore



################################
# Parameters used by avgatefwd #
################################

# ------------------------------------------------------------------------
# Number of forwarders running simultanously. 
# (All the forwarders are of the same class, as specified by 
# the following option).

# MaxForwarders                   10


# ------------------------------------------------------------------------
# Select how mail should be forwarded.
# Send mail by piping it thru sendmail (this is the default):

# ForwardTo /usr/lib/sendmail -oem -oi

# Or if you want the mail to be sent by SMTP:

ForwardTo SMTP: localhost port 10026


# ------------------------------------------------------------------------
# MIME nesting level. Maximum recursion depth of MIME mail. 

# MaxNestingLevel          20


# ------------------------------------------------------------------------
# Maximum number of attachments to scan in single MIME mail. 

# MaxAttachments                   100


# ------------------------------------------------------------------------
# Stop delivery of suspicious MIME mails. Occurs when MaxNestingLevel or 
# MaxAttachments has reached.

BlockSuspiciousMime              YES



# Block mails which are coded as a fragmented message.
# "Message Fragmentation and Reassembly" (RFC2046, section 5.2.2.1).

# BlockFragmentedMessage		NO                


# ------------------------------------------------------------------------
# Send virus alerts to recipients.

# If ExposeRecipientAlerts is NO, no virus alerts will be sent to recipients.
# If ExposeRecipientAlerts is LOCAL, virus alerts to recipients will only be
# sent when recipient is local to your domain.
# If ExposeRecipientAlerts is YES, virus alerts will always be sent to 
# recipients.

# (NO is only available in commercial mode)

# ExposeRecipientAlerts           LOCAL 


# ------------------------------------------------------------------------
# Send virus alerts to sender.

# If ExposeSenderAlerts is NO, no virus alerts will be sent to sender.
# If ExposeSenderAlerts is LOCAL, virus alerts to sender will only be
# sent when sender is local to your domain.
# If ExposeSenderAlerts is YES, virus alerts will always be sent to 
# sender.

# (NO is only available in commercial mode)

# ExposeSenderAlerts              LOCAL


# ------------------------------------------------------------------------
# Send virus alerts to Postmaster.

# This option is only available in commercial mode.

# ExposePostmasterAlerts	    YES 


# ------------------------------------------------------------------------
# User name of sender of virus alerts, if virus was found in a mail. 

# VirusAlertsUser                 AvMailGate 	     
# or
# VirusAlertsUser		someone@anywhere.tld


# ------------------------------------------------------------------------
# When AddStatusInBody is NO, no status notification is inserted in
# the body of the emails.

# When AddStatusInBody is YES:
# For  plain  rfc822 email  (non  MIME),  just  insert the  notification
# paragraph in the begining of the body.
# For  MIME   email,  transmit   the  checked  email   as  a   new  MIME
# multipart/mixed email, with a  first text/plain section containing the
# status  notification  paragraph,  and  with  a  second  message/rfc822
# section containgin the whole  original message.  Most headers from the
# orginal are copied to the transmited message.

# If a file named "body-state" exists in the templates directory,
# the text in this file will be inserted.
# Inserting custom text is only available in the commercial version.

# AddStatusInBody                 NO


# ------------------------------------------------------------------------
# When ForwardAllEmailAsMIME  is NO, incoming  emails that are  not MIME
# emails get out as they came, non-MIME.

# When ForwardAllEmailAsMIME is YES:
# The behaviour does not change for MIME emails.
# However,   plain  rfc822   emails   are  encapsulated   into  a   MIME
# message/rfc822 section  of a  multipart/mixed email that  will inherit
# all the  headers of  the user email.   If AddStatusInBody is  YES too,
# then our  text is added into  a text/plain entity  inserted before the
# message/rfc822 entity.

# ForwardAllEmailAsMIME           NO


# ------------------------------------------------------------------------
# If ScanInArchive is NO, no files in an archive will be scanned.

# If ScanInArchives is YES, all files in archives are going to be extracted
# and scanned, depending on the resctrictions given with 
# ArchiveMaxSize and ArchiveMaxRecursion. 

ScanInArchive       YES


# ------------------------------------------------------------------------
# If ArchiveMaxSize is 0, all files in an archive will be extracted,
# don't care of their unpacked size.  

# If ArchiveMaxSize is >0, all files up to the adjusted size will be
# extracted (in bytes).  

# ArchiveMaxSize	0


# ------------------------------------------------------------------------
# If the compression ratio is above the value specified here,
# the mail will not be scanned completely.  

# If MaxDecompressionRatio is 0, the mail be scanned completely.

# ArchiveMaxRatio	150


# ------------------------------------------------------------------------
# If ArchiveMaxRecursion is 0, recursive archives are going to be 
# unpacked with an unlimited recursion depth.

# If ArchiveMaxRecursion is >0, recursive archives are going to be
# unpacked up to the adjusted recursion depth.

# ArchiveMaxRecursion		5


# ------------------------------------------------------------------------
# If BlockSuspiciousArchive is NO, don't stop delivery of mails 
# containing archives with a suspicious recursion depth.

# If BlockSuspiciousArchive is YES, stop delivery of mails
# containing archives that reached the limits of ArchiveMaxRecursion,
# ArchiveMaxSize or ArchiveMaxRecursion.

BlockSuspiciousArchive          YES   


# ------------------------------------------------------------------------
# If BlockEncryptedArchive is NO, don't stop delivery of mails 
# containing encrypted files in archives.

# If BlockEncryptedArchive is YES, stop delivery of mails 
# containing encrypted files in an archive.

# BlockEncryptedArchive           NO 


# ------------------------------------------------------------------------
# PollPeriod specifies  the periodicity,  in seconds, of  the queue
# scanning done by avgatefwd.

# PollPeriod                      60 


# ------------------------------------------------------------------------
# User name of sender of error messages, if a mail couldn't be delivered via 
# MTA (bounce messages).

# BounceMessageUser               MAILER-DAEMON 	     


# ------------------------------------------------------------------------
# If AddXHeaderInfo is YES, information about scanning status is added
# to the header of checked mail. E.g.: "X-AntiVirus: Checked by ..."
# This option is only available in commercial mode.    

# AddXHeader			YES                


# ------------------------------------------------------------------------
# If AddReceivedByHeaderInfo is YES, a "Received by:" stamp is added to 
# the header of mail. 

# AddReceivedByHeader		YES                


# ------------------------------------------------------------------------
# ScanTimeout specifies the scan time of mail, in seconds, when to stop  
# scanning of mails. 

# ScanTimeout		 	300	


# ------------------------------------------------------------------------
# Call external program or script if virus was found. The argument is the id of
# rejected message.

#ExternalProgram             /etc/del_vir_mails.sh


# ------------------------------------------------------------------------
# Send notification mail every day 10 days before license will expire.
# 0 means no notification mail.

# NotifyEndOfLicense			10


# ------------------------------------------------------------------------
# If AddPrecedenceHeader is YES, a line (Precedence: junk) is added to the
# header of a notice-mail. If neither YES nor NO is given, the custom text
# will be inserted.
# This option causes some E-Mail-autoresponders to NOT respond
# to the received notice-mail. This option is only available in commercial mode.

# AddPrecedenceHeader		NO

# ------------------------------------------------------------------------
# The proxy feature in SAVAPI performs scans more efficiently
# by using and reusing a prepared pool of AntiVir scanners.  While this
# pool increases throughput this feature requires the pool size 
# to be wisely chosen -- too many scanners will put load on the
# machine without gaining more performance, too few scanners may
# have the SAVAPI using applications wait unnecessarily.

# UseProxy  NO


# ------------------------------------------------------------------------
# The number of prepared AntiVir scanners in the pool.
# See option "UseProxy"

# ProxyScanners 8


# ------------------------------------------------------------------------
# The maximum number of simultaneous allowed connections
# from AntiVir MailGate to the scanner pool.

# ProxyConnections 32


## Configuration file for AntiVir MailGate 2.0.2-5

[chris76]

Ein neuer Key könnte bestimmt nicht schaden ;)

http://free-av.de/unixreg_form_de.htm

Was spricht die avq und die logs wenn du eine Mail an den Server schickst?

[tobiask]

neue lizenz is drin:

Code: Select all

p15156934:/var/log # /usr/lib/AntiVir/antivir --version
6.30.0.15
operating system: Linux (glibc 2.2)
product version:  2.1.3-40 +gui
engine version:   6.30.0.15
packlib version:  2.0.5.1 (supports 27 formats)
vdf version:      6.30.0.236

product:          AntiVir Workstation
key file:         avmgate.key
registered user:  *************
serial number:    *************
key expires:      13 Jun 2006
run mode:         PERSONAL

product:          AntiVir MailGate
key file:         avmgate.key
registered user:  *************
serial number:    *************
key expires:      13 Jun 2006
run mode:         PERSONAL

product:          AntiVir (command line scanner)
key file:         avmgate.key
registered user:  *************
serial number:    *************
key expires:      13 Jun 2006
run mode:         PERSONAL

mail log beim versenden:

Code: Select all

p15156934:/var/log # tail -30 mail
Jun 13 13:41:04 p15156934 avgated[21356]: connection to localhost.localdomain closed
Jun 13 13:41:04 p15156934 avgatefwd[21357]: Message 'incoming/xf-32345-0AE1A7C2' scheduled for scanning now.
Jun 13 13:41:04 p15156934 avgatefwd[21358]: Message 'incoming/xf-21356-460EBD63' scheduled for scanning now.
Jun 13 13:41:04 p15156934 avgatefwd[21358]: Virus Scanner will process message 'incoming/qf-21356-460EBD63'.
Jun 13 13:41:06 p15156934 popper[21384]: Stats: web1p3 0 0 0 0 p548B401C.dip.t-dialin.net 84.139.64.28 [pop_updt.c:296]
Jun 13 13:41:12 p15156934 popper[21507]: Stats: web0 0 0 0 0 p548B401C.dip.t-dialin.net 84.139.64.28 [pop_updt.c:296]
Jun 13 13:41:37 p15156934 postfix/smtpd[21940]: connect from p548B401C.dip.t-dialin.net[84.139.64.28]
Jun 13 13:41:37 p15156934 postfix/smtpd[21940]: 71E6FC0DA8F: client=p548B401C.dip.t-dialin.net[84.139.64.28], sasl_method=LOGIN, sasl_username=web1p3
Jun 13 13:41:37 p15156934 postfix/cleanup[10256]: 71E6FC0DA8F: message-id=<005e01c5700c$aee48ee0$a602a8c0@xenon>
Jun 13 13:41:37 p15156934 postfix/qmgr[21852]: 71E6FC0DA8F: from=<tk@np-media.de>, size=999, nrcpt=1 (queue active)
Jun 13 13:41:37 p15156934 avgated[21949]: connection from localhost.localdomain
Jun 13 13:41:37 p15156934 avgated[21949]: spooled to 21949-5D880D26
Jun 13 13:41:37 p15156934 avgatefwd[21950]: Message 'incoming/xf-32345-0AE1A7C2' scheduled for scanning now.
Jun 13 13:41:37 p15156934 postfix/smtp[21210]: 71E6FC0DA8F: to=<webmaster@webmaster-eye.de>, relay=127.0.0.1[127.0.0.1], delay=0, status=sent (250 Mail accepted for delivery (queued as 21949-5D880D26).)
Jun 13 13:41:37 p15156934 avgated[21949]: connection to localhost.localdomain closed
Jun 13 13:41:37 p15156934 avgatefwd[21951]: Message 'incoming/xf-21949-5D880D26' scheduled for scanning now.
Jun 13 13:41:37 p15156934 avgatefwd[21951]: Virus Scanner will process message 'incoming/qf-21949-5D880D26'.
Jun 13 13:41:37 p15156934 postfix/smtpd[21940]: disconnect from p548B401C.dip.t-dialin.net[84.139.64.28]
Jun 13 13:41:39 p15156934 postfix/smtpd[21940]: connect from dd6336.kasserver.com[83.133.49.27]
Jun 13 13:41:39 p15156934 postfix/smtpd[21940]: 478E8C0DA8F: client=dd6336.kasserver.com[83.133.49.27]
Jun 13 13:41:39 p15156934 postfix/cleanup[10256]: 478E8C0DA8F: message-id=<005f01c5700c$af9d5790$a602a8c0@xenon>
Jun 13 13:41:39 p15156934 postfix/qmgr[21852]: 478E8C0DA8F: from=<webmaster@webmaster-eye.de>, size=1213, nrcpt=1 (queue active)
Jun 13 13:41:39 p15156934 postfix/smtpd[21940]: disconnect from dd6336.kasserver.com[83.133.49.27]
Jun 13 13:41:39 p15156934 avgated[21963]: connection from localhost.localdomain
Jun 13 13:41:39 p15156934 avgated[21963]: spooled to 21963-6F2287E2
Jun 13 13:41:39 p15156934 avgatefwd[21965]: Message 'incoming/xf-32345-0AE1A7C2' scheduled for scanning now.
Jun 13 13:41:39 p15156934 postfix/smtp[21210]: 478E8C0DA8F: to=<web1p3@p15156934.pureserver.info>, orig_to=<webmaster@mynickpage.de>, relay=127.0.0.1[127.0.0.1], delay=0, status=sent (250 Mail accepted for delivery (queued as 21963-6F2287E2).)
Jun 13 13:41:39 p15156934 avgated[21963]: connection to localhost.localdomain closed
Jun 13 13:41:39 p15156934 avgatefwd[21966]: Message 'incoming/xf-21963-6F2287E2' scheduled for scanning now.
Jun 13 13:41:39 p15156934 avgatefwd[21966]: Virus Scanner will process message 'incoming/qf-21963-6F2287E2'.

empfangen:

Code: Select all

Jun 13 13:41:37 p15156934 avgatefwd[21951]: Message 'incoming/xf-21949-5D880D26' scheduled for scanning now.
Jun 13 13:41:37 p15156934 avgatefwd[21951]: Virus Scanner will process message 'incoming/qf-21949-5D880D26'.
Jun 13 13:41:37 p15156934 postfix/smtpd[21940]: disconnect from p548B401C.dip.t-dialin.net[84.139.64.28]
Jun 13 13:41:39 p15156934 postfix/smtpd[21940]: connect from dd6336.kasserver.com[83.133.49.27]
Jun 13 13:41:39 p15156934 postfix/smtpd[21940]: 478E8C0DA8F: client=dd6336.kasserver.com[83.133.49.27]
Jun 13 13:41:39 p15156934 postfix/cleanup[10256]: 478E8C0DA8F: message-id=<005f01c5700c$af9d5790$a602a8c0@xenon>
Jun 13 13:41:39 p15156934 postfix/qmgr[21852]: 478E8C0DA8F: from=<webmaster@webmaster-eye.de>, size=1213, nrcpt=1 (queue active)
Jun 13 13:41:39 p15156934 postfix/smtpd[21940]: disconnect from dd6336.kasserver.com[83.133.49.27]
Jun 13 13:41:39 p15156934 avgated[21963]: connection from localhost.localdomain
Jun 13 13:41:39 p15156934 avgated[21963]: spooled to 21963-6F2287E2
Jun 13 13:41:39 p15156934 avgatefwd[21965]: Message 'incoming/xf-32345-0AE1A7C2' scheduled for scanning now.
Jun 13 13:41:39 p15156934 postfix/smtp[21210]: 478E8C0DA8F: to=<web1p3@p15156934.pureserver.info>, orig_to=<webmaster@mynickpage.de>, relay=127.0.0.1[127.0.0.1], delay=0, status=sent (250 Mail accepted for delivery (queued as 21963-6F2287E2).)
Jun 13 13:41:39 p15156934 avgated[21963]: connection to localhost.localdomain closed
Jun 13 13:41:39 p15156934 avgatefwd[21966]: Message 'incoming/xf-21963-6F2287E2' scheduled for scanning now.
Jun 13 13:41:39 p15156934 avgatefwd[21966]: Virus Scanner will process message 'incoming/qf-21963-6F2287E2'.
Jun 13 13:42:29 p15156934 avgatefwd[22760]: Message 'incoming/xf-32345-0AE1A7C2' scheduled for scanning now.
Jun 13 13:42:53 p15156934 avgatefwd[868]: Too many running child processes in 'outgoing'.
Jun 13 13:42:59 p15156934 popper[23133]: Stats: web1p3 0 0 0 0 p548B401C.dip.t-dialin.net 84.139.64.28 [pop_updt.c:296]
Jun 13 13:43:04 p15156934 postfix/pickup[10510]: 99FDBC0DA90: uid=0 from=<root>
Jun 13 13:43:04 p15156934 postfix/cleanup[10256]: 99FDBC0DA90: message-id=<20050613114304.99FDBC0DA90@p15156934.pureserver.info>
Jun 13 13:43:04 p15156934 postfix/qmgr[21852]: 99FDBC0DA90: from=<root@p15156934.pureserver.info>, size=584, nrcpt=1 (queue active)
Jun 13 13:43:04 p15156934 avgated[23229]: connection from localhost.localdomain
Jun 13 13:43:04 p15156934 avgated[23229]: spooled to 23229-2E6E0F7D
Jun 13 13:43:04 p15156934 avgatefwd[23230]: Message 'incoming/xf-32345-0AE1A7C2' scheduled for scanning now.
Jun 13 13:43:04 p15156934 postfix/smtp[21210]: 99FDBC0DA90: to=<root@p15156934.pureserver.info>, orig_to=<root>, relay=127.0.0.1[127.0.0.1], delay=0, status=sent (250 Mail accepted for delivery (queued as 23229-2E6E0F7D).)
Jun 13 13:43:04 p15156934 avgated[23229]: connection to localhost.localdomain closed
Jun 13 13:43:04 p15156934 avgatefwd[23231]: Message 'incoming/xf-23229-2E6E0F7D' scheduled for scanning now.
Jun 13 13:43:04 p15156934 avgatefwd[23231]: Virus Scanner will process message 'incoming/qf-23229-2E6E0F7D'.
Jun 13 13:43:05 p15156934 popper[23219]: Stats: web0 0 0 0 0 p548B401C.dip.t-dialin.net 84.139.64.28 [pop_updt.c:296]

[chris76]

Code: Select all

Jun 13 13:43:04 p15156934 avgatefwd[23231]: Virus Scanner will process message 'incoming/qf-23229-2E6E0F7D'.

was passiert danach mit der Mail liegt die immer noch in der queue von antivir? Wann ist Sie zugestellt worden?

[tobiask]

Code: Select all

Jun 13 13:43:04 p15156934 avgatefwd[23231]: Virus Scanner will process message 'incoming/qf-23229-2E6E0F7D'.

was passiert danach mit der Mail liegt die immer noch in der queue von antivir? Wann ist Sie zugestellt worden?

nein, die ist raus da, aber zugestellt wurd sie auch nich o.O
also /var/spool/avmailgate/incoming is leer ...
in rejected ist sie auch nicht ...

die leigt jetzt in outgoing
/var/spool/avmailgate/outgoing/qf-23229-2E6E0F7D
seh ich grad ...

[chris76]

Darum hab ich auch ich zweiten Posting schon nach der avq gefragt.
Dein /usr/sbin/avgatefwd läuft nicht.
Starte mal avgate neu und schau dann mit

Code: Select all

ps ax|grep av

und

Code: Select all

ps ax | grep anti

nach ob es läuft, wenn nicht dann mal in die Logs sehen.

[tobiask]

aber warum läuft der net o.O

Code: Select all

p15156934:/var/spool/avmailgate/outgoing # ps ax|grep av
  689 ?        S      0:00 /sbin/startpar -f -- /etc/init.d/rc3.d/S11avgate
  857 ?        S      0:12 /usr/sbin/avgated
  867 ?        S      0:00 /usr/sbin/avgatefwd
14375 pts/6    S      0:00 grep av

Code: Select all

p15156934:/var/spool/avmailgate/outgoing # ps ax | grep anti
 5247 ?        SN     0:00 /usr/lib/AntiVir/antivir --mailgate --temp=/var/tmp
19065 pts/0    R      8:33 /usr/lib/AntiVir/antivir --allfiles -s -z --archive-max-size=50000 --archive-max-recursion=2 -r1 --scan-in-mbox -del /
14933 pts/6    S      0:00 grep anti

da scann ich grad manuell, daher is da was drin!

läuft der jetzt oder nicht`?


edit: der ordner outgoing is auch sehr sehr voll !!!

[chris76]

schon mal den avgate komplett gestoppt? Auch kontrolliert das er wiklich weg ist? Dann neu Starten.

[tobiask]

schon mal den avgate komplett gestoppt? Auch kontrolliert das er wiklich weg ist? Dann neu Starten.

avgated stop
und
avgated start

tuns irgendwie net ...

nach nem stop läuft das immernoch:

Code: Select all

p15156934:/var/spool/avmailgate/outgoing # ps ax|grep av
  689 ?        S      0:00 /sbin/startpar -f -- /etc/init.d/rc3.d/S11avgate
  857 ?        S      0:12 /usr/sbin/avgated
  867 ?        S      0:00 /usr/sbin/avgatefwd
 6372 pts/6    R      0:00 grep av

und

Code: Select all

p15156934:/var/spool/avmailgate/outgoing # ps ax | grep anti
17087 ?        SN     0:00 /usr/lib/AntiVir/antivir --mailgate --temp=/var/tmp
 7022 pts/6    S      0:00 grep anti

wie kann ich den sicher einmal schliessen und dann neu starten?

[chris76]

man kill

[tobiask]

hab alles gekillt

nur wie muss ich /usr/sbin/avgatefwd jetzt neustrraten?
ohne parameter?

bei usage steht:

Code: Select all

usage is: avgatefwd [-C config-file] [-A acl-file]  [-D debug-level] [-V|--version]

muss ich die alle angeben?
steh grad irgendwie aufm schlauch

also zZ läuft das:

Code: Select all

p15156934:~ # ps ax|grep av
29968 pts/0    S      0:00 grep av

p15156934:~ # ps ax | grep anti
30222 pts/0    S      0:00 grep anti

also gar nichts im grunde


edit:
habs jetzt doch geschaft, ohne param.

Code: Select all

p15156934:/var/log # ps ax | grep anti
 1032 ?        SN     0:00 /usr/lib/AntiVir/antivir --mailgate --temp=/var/tmp
 3263 pts/0    S      0:00 grep anti
p15156934:/var/log # ps ax|grep av
 1119 ?        S      0:00 avgated start
 3449 pts/0    S      0:00 grep av

aber mails kommen immernoch net reichtig an
brauchen wohl immernoch stunden
jedenfalls is sie nach 5 min noch net da ...

[chris76]

Bei der installation wirst du gefragt wo dein initscript liegen soll.
in der Regel /etc/avgate.
Das wenn Du startest, dann kommt auch der avgatefwd mit hoch.

[tobiask]

Bei der installation wirst du gefragt wo dein initscript liegen soll.
in der Regel /etc/avgate.
Das wenn Du startest, dann kommt auch der avgatefwd mit hoch.

ah, danke, jetzt läufts wieder...
aber leider brauchen die mails weiterhin stunden ...
jedenfalls kommen sie nicht innerhalb von 10 min. an ...