[vps-mail] VPS2 - various hassles with clamav & procmail

[Abigail Marshall <abigail@xxxxxxxxxxxx>]

Scott,
I'm running into a lot of problems with various issues on
the VPS2 - I think this may be a permissions or privileges
issue, but I could use help with debugging.

1. SA is working o.k., but I'm seeing this lock file logging error
repeatedly:

> procmail: Lock failure on "/var/mail/spam.lock"
> From fquinn_yu@xxxxxxxxxxxx  Fri Mar 26 18:56:10 2004
>  Subject: [Spam Score: 11.43] Internet Pharmacy - Cheap Prices
>   Folder: /var/mail/spam                                                   4066
> procmail: Lock failure on "/var/mail/spam.lock"
> From gagibbons_aj@xxxxx  Fri Mar 26 19:22:45 2004
>  Subject: [Spam Score: 13.94] Internet Pharmacy - Cheap Prices
>   Folder: /var/mail/spam                                                   4084

Basically, I need to know what that error means. The spam
seems to being delivered o.k. to the spam box.

2.  ClamAV - seems to have caught one virus, but the ClamAV
log looks like this:

Possible virus Exploit.IFrame.Gen FOUND
procmail: Lock failure on "/var/mail/quarantine/clamav.lock"
procmail: Error while writing to "/var/mail/quarantine/clamav"

Permissions for the file are set to 777.

3. Just a note:
ClamAV also failed to catch several instances of
W32.Netsky.D - the headers on these emails show:
X-ClamAV: clean

This appears to be an issue with ClamAV - because it also
came up negative on the online scanner at
http://www.gietl.com/test-clamav/

Symantec says this virus was discovered March 1, 2004.

So basically I'm just noting that ClamAV is obviously is not
all that reliable. Ordinarily, I would never see this
particular worm because it is coming in a .pif file -
usually I /dev/null all those - but I deliberately set my
procmail AV recipe for suspect attachments on my VPS1 to
forward to the VPS2 account for testing purposes.

-Abigail

======================================================================
This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
Before posting a question, please search the archives (see above URL).