Can't SEND/RECEIVE mails after CLAMAV Upgrade

[phoenix]

Are all the services running? What does the following show:

zmcontrol status

What errors do you see in the log files?

[xforcis]

Hi,

I'm running a production server. details are as follows:
1) Release 6.0.9_GA_2686.UBUNTU10_64 UBUNTU10_64 FOSS edition.
2) Linux mail.domain.com 2.6.32-26-server #48-Ubuntu SMP Wed Nov 24 10:28:32 UTC 2010 x86_64 GNU/Linux
3) Ubuntu Lucid Lynx 10.04.1 LTS

Everything was working fine until I started facing this problem BUG42870

So I did those changes and also decided to update my CLAMAV version to prevent further disruption of the production server from this WIKI

The problem only started after I updated the CLAMAV from clamav-0.96.1 to clamav-0.96.5

Now when I run postqueue -p, the queue just keeps increasing and postqueue -f can't remove the mails in queue.

Please help me urgently, I'm running a production server and I've tried almost everything otherwise I won't be posting here. Thanks.

[xforcis]

Hi Thank you so much for the response.

Host mail.domain.com
antispam Running
antivirus Running
ldap Running
logger Running
mailbox Running
mta Running
snmp Running
spell Running
stats Running

Part of the zimbra.log is as follows:
Dec 15 01:00:09 mail postfix/smtp[5217]: 92ED81A801DF: to=<manimuthu@domain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=3942, delays=3901/1.9/0/39, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 From MTA([127.0.0.1]:10025) during fwd-connect (Negative greeting: at (eval 110) line 596.): id=03240-04 (in reply to end of DATA command))
Dec 15 01:00:09 mail postfix/smtp[5217]: 92ED81A801DF: to=<musri@domain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=3942, delays=3901/1.9/0/39, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 From MTA([127.0.0.1]:10025) during fwd-connect (Negative greeting: at (eval 110) line 596.): id=03240-04 (in reply to end of DATA command))
Dec 15 01:00:09 mail postfix/smtp[5217]: 92ED81A801DF: to=<mustapha@domain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=3942, delays=3901/1.9/0/39, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 From MTA([127.0.0.1]:10025) during fwd-connect (Negative greeting: at (eval 110) line 596.): id=03240-04 (in reply to end of DATA command))
Dec 15 01:00:09 mail postfix/smtp[5217]: 92ED81A801DF: to=<rwgops@domain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=3942, delays=3901/1.9/0/39, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 From MTA([127.0.0.1]:10025) during fwd-connect (Negative greeting: at (eval 110) line 596.): id=03240-04 (in reply to end of DATA command))
Dec 15 01:00:09 mail postfix/smtp[5217]: 92ED81A801DF: to=<shikin@domain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=3942, delays=3901/1.9/0/39, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 From MTA([127.0.0.1]:10025) during fwd-connect (Negative greeting: at (eval 110) line 596.): id=03240-04 (in reply to end of DATA command))
Dec 15 01:00:09 mail postfix/smtp[5217]: 92ED81A801DF: to=<wanie@domain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=3942, delays=3901/1.9/0/39, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 From MTA([127.0.0.1]:10025) during fwd-connect (Negative greeting: at (eval 110) line 596.): id=03240-04 (in reply to end of DATA command))
Dec 15 01:00:09 mail amavis[3240]: (03240-04-2) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20101215T005827-03240: <notification+zrdohddiroff@facebookmail.com> -> <transport@domain.com> SIZE=2383 Received: from mail.domain.com ([127.0.0.1]) by localhost (mail.domain.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <transport@domain.com>; Wed, 15 Dec 2010 01:00:09 +0800 (MYT)
Dec 15 01:00:09 mail amavis[3240]: (03240-04-2) Checking: yMiUFL1yY7yO [66.220.144.135] <notification+zrdohddiroff@facebookmail.com> -> <transport@domain.com>
Dec 15 01:00:10 mail amavis[3244]: (03244-03) (!)rw_loop: leaving rw loop, no progress, last event (select) 5.005 s ago
Dec 15 01:00:10 mail amavis[3244]: (03244-04) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20101215T005827-03244: <nintcs@domain.com> -> <aikszooi@domain.com> SIZE=21999 Received: from mail.domain.com ([127.0.0.1]) by localhost (mail.domain.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <aikszooi@domain.com>; Wed, 15 Dec 2010 01:00:10 +0800 (MYT)
Dec 15 01:00:10 mail amavis[3244]: (03244-04) Checking: pMQxT-fdnHCW [218.208.200.53] <nintcs@domain.com> -> <aikszooi@domain.com>
Dec 15 01:00:22 mail amavis[3243]: (03243-02-2) (!)rw_loop: leaving rw loop, no progress, last event (select) 15.012 s ago
Dec 15 01:00:23 mail postfix/smtpd[5464]: connect from 41-184-112-97.rv.ipnxtelecoms.com[41.184.112.97]
Dec 15 01:00:23 mail postfix/smtp[8191]: 40D081A8017E: to=<SQC149_@alliancebg.com.my>, relay=jrcexsvr.alliancebg.com.my[210.19.13.2]:25, delay=34525, delays=34469/0.03/40/15, dsn=4.4.2, status=deferred (lost connection with jrcexsvr.alliancebg.com.my[210.19.13.2] while sending RCPT TO)
Dec 15 01:00:23 mail postfix/smtp[8191]: 40D081A8017E: to=<cpseb@alliancebg.com.my>, relay=jrcexsvr.alliancebg.com.my[210.19.13.2]:25, delay=34525, delays=34469/0.03/40/15, dsn=4.4.2, status=deferred (lost connection with jrcexsvr.alliancebg.com.my[210.19.13.2] while sending RCPT TO)
Dec 15 01:00:23 mail postfix/smtp[8191]: 40D081A8017E: to=<zulizzi@alliancebg.com.my>, relay=jrcexsvr.alliancebg.com.my[210.19.13.2]:25, delay=34525, delays=34469/0.03/40/15, dsn=4.4.2, status=deferred (lost connection with jrcexsvr.alliancebg.com.my[210.19.13.2] while sending RCPT TO)
Dec 15 01:00:23 mail amavis[3242]: (03242-02-2) (!)rw_loop: leaving rw loop, no progress, last event (select) 15.006 s ago
Dec 15 01:00:24 mail amavis[3241]: (03241-02-2) (!)rw_loop: leaving rw loop, no progress, last event (select) 15.015 s ago
Dec 15 01:00:25 mail amavis[3248]: (03248-02-2) (!)rw_loop: leaving rw loop, no progress, last event (select) 15.015 s ago
Dec 15 01:00:25 mail amavis[3240]: (03240-04-2) (!)rw_loop: leaving rw loop, no progress, last event (select) 15.014 s ago

[phoenix]

After applying the changes from the bug report and updating clamav, did you reboot the server?

[xforcis]

Hi Bill,

Yes multiple times, but it's still the same. Mail is stuck in queue.

I have jus tried to fall back to the old CLAMAV version but it seems like the issue is still there.

[xforcis]

the error shown in postfix -p is as below for normal mail which used to go through:

DA0891A801D5 3275 Tue Dec 14 23:40:58 jc@domain.com
(host 127.0.0.1[127.0.0.1] said: 451 4.5.0 From MTA([127.0.0.1]:10025) during fwd-connect (Error writing to socket: Broken pipe at (eval 110) line 200.): id=09430-02-20
(in reply to end of DATA command))
jtan@somewhere.net.my

[xforcis]

Hi Bill,

I finally managed to solve the issue and I would like to share the events and history with other zimbra users.

Before CLAMAV update my setting was:
in /opt/zimbra/postfix/conf/master.cf.in
-o mynetworks=127.0.0.0/8, X.X.X.X
email working normally

AfterCLAMAV update my setting was:
in /opt/zimbra/postfix/conf/master.cf.in
-o mynetworks=127.0.0.0/8, X.X.X.X
nothing changed. email didn't work

I then removed the config to be as below:
in /opt/zimbra/postfix/conf/master.cf.in
-o mynetworks=127.0.0.0/8
email started working again

Thanks Bill for your fast response, really appreciate your help.

[phoenix]

Glad you've fixed it. Having the Trusted Networks with just the loopback address in there shouldn't be necessary, you normally have the LAN subnet in there as well (assuming you're on a LAN). Anyway as long as it all working and just having the loopback won't do any harm.

[xforcis]

Ok, thanks for the advise Bill

Just for information. The mail server is located in a datacenter with
localhost having 127.0.0.1
mail.domain.com having X.X.X.X (PUBLIC IP)

so all mail accounts are actually outside of any internal network, meaning mobile internet users.

[phoenix]

Originally Posted by xforcis

Ok, thanks for the advise Bill

Just for information. The mail server is located in a datacenter with
localhost having 127.0.0.1
mail.domain.com having X.X.X.X (PUBLIC IP)

so all mail accounts are actually outside of any internal network, meaning mobile internet users.

A I mentioned, the configuration you have should be fine and as you're not on a LAN then not having the public IP won't cause you any problems.