[TriLUG] Amavis disappearing - How to debug?

[Aaron S. Joyner]

Rick DeNatale wrote:

>I've been having a problem where every so often amavisd-new goes away
>on me.  This causes postfix to stop receiving incoming mail.
>
>I'm at a loss to figure out how to get to the bottom of this.  There's
>nothing obvious in my mail or sys logs.
>
>amavis is using clamav and spamassassin to filter the mail.
>
>Any ideas?
>--
>Rick DeNatale
>
>Visit the Project Mercury Wiki Site
>http://www.mercuryspacecraft.com/
>  
>
Well it sort of depends on how often it's dying, and how much disk space 
you have available.  If it dies reasonably often (say, once a day, or 
every couple days) you might consider turning up the logging on amavis, 
and waiting for it to happen again.  One critical point here is being 
able to discern in the mail logs what time mail stopped working, so you 
need a reasonable steady stream of mail.  If you don't naturally have 
that, you can setup a monitoring agent ala Nagios, or you can simply 
cron up a mail to be sent through the mail server.  The Nagios route 
will give you alerting to boot, but it's certainly a larger setup time 
than a single cron job.

So how to turn up the logging?  Check out the log section (III) in 
amavis.conf:
#NOTE: levels are not strictly observed and are somewhat arbitrary
# 0: startup/exit/failure messages, viruses detected
# 1: args passed from client, some more interesting messages
# 2: virus scanner output, timing
# 3: server, client
# 4: decompose parts
# 5: more debug details
$log_level = 2;           # (defaults to 0)

I'd suggest going up to 3, but if you have a high volume mail server, be 
sure to keep an eye on disk space, because this may make a big mess of 
your logs.  If that doesn't get you closer to the source, write back and 
we'll come up with some other ideas.  :)

Best of luck!
Aaron S. Joyner