Procmail WARNING

I am seeing this frequently in my log. I have seen the bug report from 2006 but I assume that this particular issue has been fixed since then. Nonetheless, it’s still cropping up.

WARNING: System limit for file size is lower than maxfilesize or


procmail: Program failure (1) of "/etc/webmin/virtual-server/"

Two different problems?


Yeah, there’s a brand new bug report for that here it looks like:

Which distro are you using?

In the clamav init script in /etc/init.d, do you see a ulimit setting? If so, I’m curious what it’s set to.

Linux on x86_64, updated from CentOS 5.2

I changed the Spam and Virus Scanning from standalone to server(clamdscan). Error messages are now gone. I left spamassassin at standalone.

I don’t have clamav in /etc/rc.d/init.d but there is clamd and there is no ulimit setting in the script.


Indeed, in most circumstances, the Clam server is the better option anyhow.

Standalone is only desirable on very low-memory systems.

Spoke too soon. The procmail error is popping up again.

Bummer, thought I had it licked. At least the WARNING System Limit is gone.

Can you clarify exactly what error you’re seeing now?

Can’t seem to edit, keeps crashing.

It is now only the following error that is appearing im my logs:

procmail: Program failure (1) of "/etc/webmin/virtual-server/"

It occurs after each procmail entry in the log most of the time. Haven’t figured out whether its only obvious junk rather than legitimate mail. I would think that a program failure would be bad in any case.

Yeah, that definitely shouldn’t be happening regardless of the kind of email.

A few questions for you:

  • What distro/version are you using

  • What Virtualmin version do you have installed

  • Can you verify that the clam daemon is running?

  • If you look in the mail log (/var/log/maillog or /var/log/mail.log), do you see any procmail or procmail-wrapper related errors showing up in there (I’m assuming that the error you showed above was in the procmail.log)?

I’ll have to check tomorrow AM for some of the answers to your questions. But I can tell you:

-clamd is running
-Webmin 1.450 (just did fresh installed two weeks ago)
-don’t know the exact version of procmail
-I’ll have to check the logs

BTW, the error message says something about wrappers. Is this possibly a TCP Wrappers issue?


The “wrapper” you’re seeing is probably the “procmail-wrapper” program.

I wait to hear some more details tomorrow – have a good evening,

Yes, the failure entry is from the procmail log

rpm -qa procmail*


Last part of a procmail entry in maillog shows:

relay=local, delay=0.84, delays=0.42/0/0/0.42, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME)

Notice these two emails from the procmail log. One fails and the other doesn’t. They are both spam from the same sender but within 2 seconds of each other. Is there a clue here?

From Sat Feb 28 12:16:29 2009
Subject: [SPAM] Bags and wallets
Folder: /dev/null 4262
Time:1235852190 User:jjp.xxxxx Size:4262 Dest:/dev/null Mode:Spam

From Sat Feb 28 12:16:27 2009
Subject: [SPAM] Bags and wallets
Folder: /dev/null 4262
Time:1235852190 User:jjp.xxxxx Size:4262 Dest:/dev/null Mode:Spam
procmail: Program failure (1) of "/etc/webmin/virtual-server/"

I have also seen other entries with same spam sender (different from last example). Where the first entry there is no procmail failure but the second one fails. Time stamp in the above case is equal.

Almost seems like there coming in to fast to handle.

So I am thinking that this is a problem with

procmail manual states:

Program failure (nnn) of "x"
Program that was started by proc-
mail returned nnn instead of EX-
IT_SUCCESS (=0); if nnn is nega-
tive, then this is the signal the
program died on.

Do I need to examine to find the problem if I even can?

In the absence of a reply, perhaps you guys can give me a simple yes or no.

procmail: Program failure (1) is not really an error, it is just mislabeled I guess. returns an exit(1) when a virus is found (according to the script). Procmail is interpreting the return code as a program failure when it is really exiting normally.

If this is true then it should be corrected somewhere so folks like me don’t think it is a problem. I take “failure” quite literally.

Would an “I don’t know” work? :slight_smile:

I don’t recall seeing failures in our maillogs, but I don’t pay much attention when things are working correctly. I’ll ask Jamie to have a look at this thread.

The program failure message is a little misleading - it doesn’t mean that anything has actually failed, but rather than Virtualmin’s clamav wrapper has detected a virus. The way it sets up the procmail rules, a non-zero exit status from that script is used to tell the next rule to send the email to /dev/null .

This only happens for viruses, so spam or regular email will not generate a program failure message.

Thanks for the replies.

I actually think "Program Failure" is more than just a little misleading. It is actually a successful operation of the script and as you mention trashes the virus infected email to /dev/null/.

This should be put on the list of "minor things to do" when you get around to procmail changes.

Thanks again

Are you seeing a case where a program failure caused a non-virus email to be sent to /dev/null ? That would be a more serious problem…