Delete spam if score is above - causes quota problems

Hi All

I wonder if somebody can tell me what causes the following problem and what I can do about it.

Due to high levels of spam I have used the option to delete spam if the score is above a certain level. The amount of spam emails in the mailboxes are dramatically reduced but the amount of disk space used by the users is increasing very quickly - increasing from a few kb to over 50 MB within a few hours. The mail boxes themselves are only small, so I wonder if the junkmail is not deleted immediately - is it held in temp files on the server before deleted and still under ownership of the user?

I would appreciate if somebody could point me into the right direction to stop the disk space used for these users from increasing.

Thanks in advance!!!

I’m not really sure, that doesn’t make too much sense :slight_smile:

In theory, the option you’re setting should cause the email to be deleted immediately.

Can you find where the space is being used on the file system?

Perhaps there’s some other explanation as to where the space is going – such as a user uploading some files, or a handful of large email attachments?

-Eric

Thanks for your reply.

These users are email only users and don’t upload files, and the situation also only comes up after the option to delete spam has been set, so I am convinced that it is related. I have checked what files are owned by one of the users but the output didn’t help (for me), as I don’t know what to expect as normal.

Hi,
OnTheRoadInWales
if you go to you logs
Webmin ->System->System Logs

you should see a list of logs and you will find:
File /var/log/maillog

If you view it and then copy some of the lines and paste them into the
post, I am sure Eric will tell you if they are normal or not.

Hope that helps.

Here are the files for two users - both on the same server, same domain, both have email and virus checks enabled:

find / -user keith.dch -ls
23792411 4 drwx------ 4 keith.dch dch 4096 Aug 28 08:20 /home/dch/homes/keith.dch
23792417 4 drwx------ 3 keith.dch dch 4096 Aug 26 09:26 /home/dch/homes/keith.dch/.usermin
23792418 4 drwx------ 2 keith.dch dch 4096 Sep 2 10:37 /home/dch/homes/keith.dch/.usermin/mailbox
23792663 4 -rw-r–r-- 1 keith.dch dch 30 Sep 2 10:37 /home/dch/homes/keith.dch/.usermin/mailbox/inbox.imap
23792425 4 drwx------ 5 keith.dch dch 4096 Sep 25 13:58 /home/dch/homes/keith.dch/Maildir
23792426 4 drwx------ 2 keith.dch dch 4096 Sep 25 12:39 /home/dch/homes/keith.dch/Maildir/cur
23792432 20 -rw------- 1 keith.dch dch 17408 Sep 25 12:39 /home/dch/homes/keith.dch/Maildir/dovecot.index.cache
23793638 4 -rw------- 1 keith.dch dch 791 Sep 25 12:39 /home/dch/homes/keith.dch/Maildir/dovecot-uidlist
23792429 8 -rw------- 1 keith.dch dch 5812 Sep 25 13:58 /home/dch/homes/keith.dch/Maildir/dovecot.index.log
23792428 4 drwx------ 2 keith.dch dch 4096 Sep 25 11:36 /home/dch/homes/keith.dch/Maildir/tmp
23793637 4 -rw------- 1 keith.dch dch 144 Sep 25 12:39 /home/dch/homes/keith.dch/Maildir/dovecot.index
23792427 4 drwx------ 2 keith.dch dch 4096 Sep 25 12:39 /home/dch/homes/keith.dch/Maildir/new
find: /proc/11791/task/11791/fd/4: No such file or directory
find: /proc/11791/fd/4: No such file or directory
14123737 0 -rw------- 1 keith.dch mail 0 Sep 2 10:39 /var/spool/mail/keith.dch

There is no problem with the above account, the next one is one with high disk usage:

find / -user hiredesk.dch -ls
23168152 4 drwxr-xr-x 3 hiredesk.dch dch 4096 Dec 12 2008 /home/dch/homes/hiredesk
23232518 4 drwxr-xr-x 5 hiredesk.dch dch 4096 Oct 5 14:32 /home/dch/homes/hiredesk/Maildir
23233473 4 drwx------ 2 hiredesk.dch mail 4096 Oct 5 14:32 /home/dch/homes/hiredesk/Maildir/cur
23246516 24 -rw------- 1 hiredesk.dch dch 20905 Oct 5 10:54 /home/dch/homes/hiredesk/Maildir/cur/1254736486.31086_0.www.m8ty.co.uk:2,
23246530 24 -rw------- 1 hiredesk.dch dch 20900 Oct 5 10:54 /home/dch/homes/hiredesk/Maildir/cur/1254736487.31091_0.www.m8ty.co.uk:2,
23233485 36 -rw------- 1 hiredesk.dch dch 36864 Oct 5 09:59 /home/dch/homes/hiredesk/Maildir/dovecot.index.cache
23246440 4 -rw------- 1 hiredesk.dch dch 369 Oct 5 09:59 /home/dch/homes/hiredesk/Maildir/dovecot-uidlist
23233454 96 -rw------- 1 hiredesk.dch dch 91224 Oct 5 14:32 /home/dch/homes/hiredesk/Maildir/dovecot.index.log
23233474 4 drwx------ 2 hiredesk.dch mail 4096 Oct 5 18:35 /home/dch/homes/hiredesk/Maildir/tmp
23246435 4 -rw------- 1 hiredesk.dch dch 168 Oct 5 14:32 /home/dch/homes/hiredesk/Maildir/dovecot.index
23233472 4 drwx------ 2 hiredesk.dch mail 4096 Oct 5 14:32 /home/dch/homes/hiredesk/Maildir/new
5309306 4 -rw-r–r-- 1 hiredesk.dch dch 82 Oct 5 15:10 /etc/webmin/mailboxes/maildircache/_home_dch_homes_hiredesk_Maildir
find: /proc/6208/task/6208/fd/4: No such file or directory
find: /proc/6208/fd/4: No such file or directory
34111501 4 drwx------ 2 hiredesk.dch dch 4096 Oct 5 15:52 /tmp/clamav-4e3bc146804af1eee693484589ea0b97
34111505 744 -rw------- 1 hiredesk.dch dch 754493 Oct 5 15:52 /tmp/clamav-4e3bc146804af1eee693484589ea0b97/main.hdb
34111502 20 -rw------- 1 hiredesk.dch dch 17992 Oct 5 15:52 /tmp/clamav-4e3bc146804af1eee693484589ea0b97/COPYING
34111506 5308 -rw------- 1 hiredesk.dch dch 5423104 Oct 5 15:52 /tmp/clamav-4e3bc146804af1eee693484589ea0b97/main.mdb
34111503 4 -rw------- 1 hiredesk.dch dch 318 Oct 5 15:52 /tmp/clamav-4e3bc146804af1eee693484589ea0b97/main.info
34111504 4636 -rw------- 1 hiredesk.dch dch 4731255 Oct 5 15:52 /tmp/clamav-4e3bc146804af1eee693484589ea0b97/main.db
34242607 4 drwx------ 2 hiredesk.dch dch 4096 Oct 5 18:35 /tmp/clamav-c55398478a3e83d4f62814361fcfbccd
34242611 744 -rw------- 1 hiredesk.dch dch 754493 Oct 5 18:35 /tmp/clamav-c55398478a3e83d4f62814361fcfbccd/main.hdb
34242608 20 -rw------- 1 hiredesk.dch dch 17992 Oct 5 18:35 /tmp/clamav-c55398478a3e83d4f62814361fcfbccd/COPYING
34242612 15072 -rw------- 1 hiredesk.dch dch 15413248 Oct 5 18:35 /tmp/clamav-c55398478a3e83d4f62814361fcfbccd/main.mdb
34242609 4 -rw------- 1 hiredesk.dch dch 318 Oct 5 18:35 /tmp/clamav-c55398478a3e83d4f62814361fcfbccd/main.info
34242610 4636 -rw------- 1 hiredesk.dch dch 4731255 Oct 5 18:35 /tmp/clamav-c55398478a3e83d4f62814361fcfbccd/main.db
34111489 4 drwx------ 2 hiredesk.dch dch 4096 Oct 5 11:44 /tmp/clamav-c01fdc66dcabd2468650b69017b2170d
34111493 744 -rw------- 1 hiredesk.dch dch 754493 Oct 5 11:44 /tmp/clamav-c01fdc66dcabd2468650b69017b2170d/main.hdb
34111490 20 -rw------- 1 hiredesk.dch dch 17992 Oct 5 11:44 /tmp/clamav-c01fdc66dcabd2468650b69017b2170d/COPYING
34111494 14384 -rw------- 1 hiredesk.dch dch 14708736 Oct 5 11:44 /tmp/clamav-c01fdc66dcabd2468650b69017b2170d/main.mdb
34111491 4 -rw------- 1 hiredesk.dch dch 318 Oct 5 11:44 /tmp/clamav-c01fdc66dcabd2468650b69017b2170d/main.info
34111492 4636 -rw------- 1 hiredesk.dch dch 4731255 Oct 5 11:44 /tmp/clamav-c01fdc66dcabd2468650b69017b2170d/main.db
14123670 0 -rw------- 1 hiredesk.dch mail 0 Dec 12 2008 /var/spool/mail/hiredesk.dch

The main difference seems to be the temporary clamav files with today’s date. - any idea why this is happening?

Thanks

Ok … here is an idea

these amounts of disk space used haven’t changed significantly for a few hours now, which looks strange if you consider that they have gone up very quickly initially. Is it possible that these temporary files have not been deleted because the quota was reached during processing - ie that no further modifications of the file system was possible at that point? Looks like I have to eat my words - it is then not the spam deletion causing a problem but the virus scan. If this is the case, is there a recommended size for a mail box - probably not, considering they all receive different amounts of traffic - so any idea how to prevent the problem in the future? Also, should I / can I delete the temp files manually or will the system housekeeping take care of it?

Yes, looks like my last post was right, here is a link to a thread on this forum which discusses the same problem: https://www.virtualmin.com/node/6255 - which then causes my next question:

As there are quite large files created by clamav, does this mean that having this enabled is generally resource hungry in respect of memory and disk space? Would it be a problem to have this enabled for all domains on a server (approx 80)?

Any advice would be appreciated. Thanks!!

Clam can use a decent amount of CPU and/or RAM. That’s just a by-product of virus scanning an email :slight_smile:

If you set it to run as a daemon, it uses more RAM but saves on CPU. If you set it to run standalone, it can use a lot more CPU, and only uses RAM in bursts as emails come in.

I tend to recommend the daemon mode when possible :slight_smile:

Can Clam work for 80 domains? Sure! I’ve seen it work for hundreds of domains on a server. But it also comes down to how much email you’re receiving.

Also, you could write up a script of some sort to run from cron to delete temp files created by clam that are older than a week or so, if you feel clam is using up too much space in /tmp.

-Eric