> Amavisd-new (ver 2.5.2)
> The version of Perl I'm using is 5.8.0,and relevant perl modules:
> Net::Server v0.97; Mail::SpamAssassin v3.002003.
> At start up, amavisd-new reports "Unicode aware, LANG=en_US.UTF-8".
A brave man, running Perl 5.8.0 in an UTF-8 environment - either of
the two is worrying by itself, the combination could be deadly.
> Oct 24 13:05:44 HOSTNAME amavis: (06732-01) smtp resp to MAIL
> (pip): 250 2.1.0 Ok
> Oct 24 13:05:44 HOSTNAME amavis: (06732-01) smtp resp to RCPT
> (pip) (<quarantine_virus@...>): 250 2.1.5 Ok, id=06732-01,
> from MTA([127.0.0.1]:10025): 250 2.1.5 Ok
> Oct 24 13:05:44 HOSTNAME
> amavis: (06732-01) smtp resp to DATA: 354 End data with
> Oct 24 13:05:44 HOSTNAME amavis: TIMING [total 8 ms] - bdb-open:
> 8 (100%)100, rundown: 0 (0%)100
> Oct 24 13:05:44 HOSTNAME postfix/smtpd: lost connection after
> DATA from HOSTNAME[127.0.0.1]
> As can be seen, process amavis dies suddenly without sending the
> proper end of data sequence, so process postfix reports the lose
> of connection, ...
> In this case, the behavior shown
> follows the detection of a "virus" (the EICAR test file), but
> a similar response can be obtained if, as a result of content
> filtering, the e-mail is banned.
Are you saying that a clean mail does pass through normally?
It seems the above log was captured at log level 4 (not 5),
or that syslogd trimmed the lowest level log entries.
Was the above log obtained from syslog, or was a process
running nondetached (# amavisd debug ) ? What OS is this?
It would be interesting to see strace or truss output before
the crash point. Do not forget the -f option, which extends
strace/truss to forked processes, e.g.:
# su vscan
$ truss -f amavisd debug
Before spending too much on low-level debugging, it could
save time to first upgrade perl to 5.8.8 (or at least 5.8.2).