MSCHECK renders cpanel service down.

[Sergio]

Hi Sarah,
today mailscanner started to do a lot of rare things, it started to left emails on its queue without checking them, so, I started to check on it following instructions on:

http://www.configserver.com/techfaq/index.php?faqid=14
http://www.configserver.com/techfaq/index.php?faqid=84

All this without any positive results.

The weird thing is that there was no errors at all on maillog:

Jan 13 11:45:23 server1 MailScanner: New Batch: Found 42 messages waiting
Jan 13 11:45:23 server1 MailScanner: New Batch: Forwarding 1 unscanned messages, 8993 bytes
Jan 13 11:45:23 server1 MailScanner: Unscanned: Delivered 1 messages
Jan 13 11:45:23 server1 MailScanner: Deleted 1 messages from processing-database
Jan 13 11:45:23 server1 MailScanner: New Batch: Found 42 messages waiting
Jan 13 11:45:23 server1 MailScanner: New Batch: Scanning 1 messages, 1167852 bytes
Jan 13 11:45:23 server1 MailScanner: Logging message 1YB5Tk-001Gp8-7p to SQL
Jan 13 11:45:23 server1 MailScanner: Unscanned: Delivered 1 messages
Jan 13 11:45:23 server1 MailScanner: Deleted 1 messages from processing-database
Jan 13 11:45:23 server1 MailScanner: Logging message 1YB5Wg-001I0q-PC to SQL

And all the email were stuck in the mailscanner queue.

So, I made a Force MailScanner Update from the GUI and when it finished it crashed cpanel services and I had to do a service cpanel restart.

So, I started to check what was going on and found that when I ran:
/usr/mscpanel/mscheck.pl
cpanel crashes and I had to do a restart.

Unfortunately MailScanner continues with the same error and I had to left MailScanner running but with Scan Messages disabled.

I had tried to set VIRUS SCANS = NONE to check if it was an error due to the clamd, even with that the emails are not delivered.

One thing that caught my attention is that today cpanel has an update to 11.46.2 and I found the following lines on the /var/log/messages:
Jan 13 02:46:13 server1 lfd[645206]: cPanel upgrade detected, restarting MailScanner

Jan 13 02:46:15 server1 MailScanner: MailScanner setting GID to mail (12)
Jan 13 02:46:15 server1 MailScanner: MailScanner setting UID to mailnull (47)
Jan 13 08:25:10 server1 MailScanner: MailScanner setting GID to mail (12)
Jan 13 08:25:10 server1 MailScanner: MailScanner setting UID to mailnull (47)
Jan 13 08:25:24 server1 MailScanner: MailScanner setting GID to mail (12)
Jan 13 08:25:24 server1 MailScanner: MailScanner setting UID to mailnull (47)
Jan 13 08:44:37 server1 MailScanner: MailScanner setting GID to mail (12)
Jan 13 08:44:37 server1 MailScanner: MailScanner setting UID to mailnull (47)
Jan 13 08:46:16 server1 MailScanner: MailScanner setting GID to mail (12)
Jan 13 08:46:16 server1 MailScanner: MailScanner setting UID to mailnull (47)
Jan 13 08:47:01 server1 MailScanner: MailScanner setting GID to mail (12)
Jan 13 08:47:01 server1 MailScanner: MailScanner setting UID to mailnull (47)
Jan 13 08:47:36 server1 MailScanner: MailScanner setting GID to mail (12)
Jan 13 08:47:36 server1 MailScanner: MailScanner setting UID to mailnull (47)
Jan 13 08:48:18 server1 MailScanner: MailScanner setting GID to mail (12)
Jan 13 08:48:18 server1 MailScanner: MailScanner setting UID to mailnull (47)
Jan 13 08:51:51 server1 MailScanner: MailScanner setting GID to mail (12)
Jan 13 08:51:51 server1 MailScanner: MailScanner setting UID to mailnull (47)
Jan 13 08:54:00 server1 MailScanner: MailScanner setting GID to mail (12)
Jan 13 08:54:00 server1 MailScanner: MailScanner setting UID to mailnull (47)
Jan 13 08:59:49 server1 MailScanner: MailScanner setting GID to mail (12)
Jan 13 08:59:49 server1 MailScanner: MailScanner setting UID to mailnull (47)

So many lines of the same, the list continues but just was to show you an example.

Sergio

[Sarah]

Hi Sergio,

Check that you have not run out of disk space, and if that is not the problem please log a ticket on the helpdesk with access details so we can take a look.

Regards,
Sarah

[Sergio]

Thankyou Sarah,
I doubled check that before posting the message, that the server had space on it and I think it has plenty of space.

I will send you a ticket, regards.

Sergio

[Sergio]

Sarah,
I am seeing at /var/spool/MailScanner/incoming/ a lot of files from yesterday, are them debris from yesterday as I don't have any emails pending on the queue from yesterday? If so, how do I get rid of them?