I am seeing this frequently in my log. I have seen the bug report from 2006 but I assume that this particular issue has been fixed since then. Nonetheless, it’s still cropping up.
WARNING: System limit for file size is lower than maxfilesize or
maxscansize
AND
procmail: Program failure (1) of "/etc/webmin/virtual-server/clam-wrapper.pl"
It occurs after each procmail entry in the log most of the time. Haven’t figured out whether its only obvious junk rather than legitimate mail. I would think that a program failure would be bad in any case.
Yeah, that definitely shouldn’t be happening regardless of the kind of email.
A few questions for you:
What distro/version are you using
What Virtualmin version do you have installed
Can you verify that the clam daemon is running?
If you look in the mail log (/var/log/maillog or /var/log/mail.log), do you see any procmail or procmail-wrapper related errors showing up in there (I’m assuming that the error you showed above was in the procmail.log)?
Notice these two emails from the procmail log. One fails and the other doesn’t. They are both spam from the same sender but within 2 seconds of each other. Is there a clue here?
I have also seen other entries with same spam sender (different from last example). Where the first entry there is no procmail failure but the second one fails. Time stamp in the above case is equal.
Almost seems like there coming in to fast to handle.
So I am thinking that this is a problem with clam-wrapper.pl
procmail manual states:
Program failure (nnn) of "x"
Program that was started by proc-
mail returned nnn instead of EX-
IT_SUCCESS (=0); if nnn is nega-
tive, then this is the signal the
program died on.
Do I need to examine clam-wrapper.pl to find the problem if I even can?
In the absence of a reply, perhaps you guys can give me a simple yes or no.
procmail: Program failure (1) is not really an error, it is just mislabeled I guess. clam-wrapper.pl returns an exit(1) when a virus is found (according to the script). Procmail is interpreting the return code as a program failure when it is really exiting normally.
If this is true then it should be corrected somewhere so folks like me don’t think it is a problem. I take “failure” quite literally.
I don’t recall seeing failures in our maillogs, but I don’t pay much attention when things are working correctly. I’ll ask Jamie to have a look at this thread.
The program failure message is a little misleading - it doesn’t mean that anything has actually failed, but rather than Virtualmin’s clamav wrapper has detected a virus. The way it sets up the procmail rules, a non-zero exit status from that clam-wrapper.pl script is used to tell the next rule to send the email to /dev/null .
This only happens for viruses, so spam or regular email will not generate a program failure message.
I actually think "Program Failure" is more than just a little misleading. It is actually a successful operation of the script and as you mention trashes the virus infected email to /dev/null/.
This should be put on the list of "minor things to do" when you get around to procmail changes.