Package: p3scan Version: 2.1-2 (sarge)
Consider this sequence of events...
1. Linuxbox running p3scan crashes because of power failure.
2. Some files are left in /var/spool/p3scan/children/
3. Box reboots...
4. p3scan seems to work fine for a while
5. p3scan re-uses a pid which was left as a dirname in the spool dir
6. p3scan crashes unexpectedly because it seems it can't handle so an unexpected event...
Some logs from this morning:
p3scan[1282]: Session done (Clean Exit). Mails: 0 Bytes: 0
p3scan[1283]: Connection from 192.168.xx.244:2021
p3scan[1283]: Real-server adress is xx.84.240.98:110
p3scan[1283]: USER 'xxxxxxx'
p3scan[1283]: Session done (Clean Exit). Mails: 0 Bytes: 0
p3scan[1294]: Connection from 192.168.xx.248:49294
p3scan[1294]: Real-server adress is xx.46.243.2:110
p3scan[1295]: Connection from 192.168.xx.248:49295
p3scan[1295]: Real-server adress is xx.46.243.2:110
p3scan[1296]: Connection from 192.168.xx.248:49296
p3scan[1296]: Real-server adress is xx.247.60.79:110
p3scan[1297]: Connection from 192.168.xx.248:49297
p3scan[1297]: Real-server adress is xx.239.177.240:110
p3scan[1298]: Connection from 192.168.xx.248:49298
p3scan[1298]: Real-server adress is xx.46.243.2:110
p3scan[1294]: USER 'xxxxxx3'
p3scan[1295]: USER 'xxxxxx3'
p3scan[1296]: USER '[EMAIL PROTECTED]'
p3scan[1296]: Session done (Clean Exit). Mails: 0 Bytes: 0
p3scan[1297]: USER '[EMAIL PROTECTED]'
p3scan[1298]: USER 'xxxxxx3'
p3scan[1299]: File Error! Could not erase /var/spool/p3scan/children/1299/p3scan.SB49fU.dir
p3scan[1299]: Exiting now...
p3scan[896]: File Error! Could not erase /var/spool/p3scan/children/1299/p3scan.SB49fU.dir
p3scan[896]: Exiting now...
p3scan[1295]: Session done (Clean Exit). Mails: 0 Bytes: 0
p3scan[1298]: Session done (Clean Exit). Mails: 0 Bytes: 0
p3scan[1294]: Session done (Clean Exit). Mails: 0 Bytes: 0
p3scan[1297]: Session done (Clean Exit). Mails: 0 Bytes: 0
Now all p3scan processes are gone, and the users in the office behind this mailgateway start complaining they can't read mail... :)
Looking in /var/spool/p3scan/children shows there are some directories left from earlier p3scan processes. The 19-04 11:08 are left after the p3scan crash which the above logs show. The others are older and those with drwx------ are from before p3scan 2.1-1.
vuurkorf.2 /var/spool/p3scan/children# ll total 7 drwxr-x--- 2 p3scan p3scan 48 Apr 19 11:08 1294 <- crash drwxr-x--- 2 p3scan p3scan 48 Apr 19 11:08 1295 this drwxr-x--- 2 p3scan p3scan 48 Apr 19 11:09 1297 morning drwxr-x--- 2 p3scan p3scan 48 Apr 19 11:09 1298 drwx------ 3 p3scan p3scan 88 Feb 3 19:10 1299 <- clash [EMAIL PROTECTED]@ drwx------ 2 p3scan p3scan 80 Oct 6 2004 18503 drwxr-x--- 2 p3scan p3scan 48 Apr 19 17:40 2661 <- running drwxr-x--- 2 p3scan p3scan 48 Apr 19 17:40 2662 now! drwxr-x--- 2 p3scan p3scan 48 Apr 19 17:40 2663 drwxr-x--- 2 p3scan p3scan 48 Apr 19 17:40 2664 drwx------ 2 p3scan p3scan 80 Oct 26 19:20 310 <- old ones drwx------ 2 p3scan p3scan 80 Oct 26 19:21 311 drwx------ 2 p3scan p3scan 80 Sep 14 2004 945 drwx------ 2 p3scan p3scan 80 Sep 14 2004 969
I guess they're left there because of power failure. (sigh) This box only runs iptables, p3scan and postfix, and the above shows clearly there was a p3scan process with pid 1299, which clashed with a new p3scan with pid 1299.
p3scan should clean up files in the spool dir when starting up, because they have no meaning anymore at that time, and on busy p3scan boxes, these clashes because of pid-reuse will happen.
For today: I stopped p3scan, rm-rf-ed the contents of /var/spool/p3scan/children/, and started p3scan again.
Hans van Kranenburg The Netherlands
-- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
