I found the issue. Someone executed a clean on mdefang-* using incrond when a specific file changes.
Sorry for wasting your time with this, but your assistance is much appreciated. On Fri, 19 Nov 2021 at 08:09, Ernst du Plooy <[email protected]> wrote: > >>Or could you have a cron job or some other thing that's cleaning up > >>/var/spool/MIMEDefang? > > >Not that I am aware of, I checked cron and could not find anything. To > verify I'll configure ionotify to monitor the directory > > Something is deleting the directory (see the ionotify log lebow). It's > not in mimedefang-filter: > [root@relay spool]# cat /etc/mail/mimedefang-filter |grep -e unlink -e > rmdir -e 'rm -f' -e 'rm -r' > [root@relay spool]# > > I stopped cron > [root@relay spool]# service crond stop > Redirecting to /bin/systemctl stop crond.service > > Nov 19 07:03:17 relay2 mimedefang[3446]: 1AJ53DgE003322: Could not open > /var/spool/MIMEDefang/mdefang-1AJ53DgE003322/INPUTMSG: No such file or > directory > Nov 19 07:03:17 relay2 mimedefang[3446]: 1AJ53DgE003322: > lstat(/var/spool/MIMEDefang/mdefang-1AJ53DgE003322) failed: No such file or > directory > Nov 19 07:03:17 relay2 mimedefang[3446]: 1AJ53DgE003322: failed to clean > up /var/spool/MIMEDefang/mdefang-1AJ53DgE003322: No such file or directory > > #ionotify log > [root@relay2 root]# cat /tmp/log.log |grep 1AJ53DgE003322 > [07:03:16.133489489]: /var/spool/MIMEDefang CREATE,ISDIR > mdefang-1AJ53DgE003322 > [07:03:17.251536596]: /var/spool/MIMEDefang OPEN,ISDIR > mdefang-1AJ53DgE003322 > [07:03:17.252682974]: /var/spool/MIMEDefang CLOSE_NOWRITE,CLOSE,ISDIR > mdefang-1AJ53DgE003322 > [07:03:17.253830299]: /var/spool/MIMEDefang OPEN,ISDIR > mdefang-1AJ53DgE003322 > [07:03:17.254962143]: /var/spool/MIMEDefang CLOSE_NOWRITE,CLOSE,ISDIR > mdefang-1AJ53DgE003322 > [07:03:17.256036660]: /var/spool/MIMEDefang DELETE,ISDIR > mdefang-1AJ53DgE003322 > > >
_______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. MIMEDefang mailing list [email protected] https://lists.mimedefang.org/mailman/listinfo/mimedefang_lists.mimedefang.org
