amavisd-release not working after upgrade to 10.9 Mavericks

Question

Level 1

0 points

amavisd-release not working after upgrade to 10.9 Mavericks

I just upgraded from 10.8 to 10.9 and the amavisd services suddenly started making most of the messages as containing a virus and quarantining them into the /Library/Server/Mail/data/scanner/quarantine directory. I stopped the services for virus pocessing on the messages which has stopped the quarantine from happening, but I can not get the messages to release back into the mail queue using amavisd-release to reprocess the ones that were already moved.

This is what I get when i run amavisd-release from the terminal...

amavisd-release banned-fX3ORr9nexcG

Can't connect to UNIX socket /var/amavis/amavisd.sock: No such file or directory at /Applications/Server.app/Contents/ServerRoot/usr/bin/amavisd-release line 260.

Any ideas as to how to get it working?

Posted on May 17, 2014 1:00 PM

Reply

Answer 1

Kappy

Level 10

361,741 points

May 17, 2014 1:04 PM in response to JCinTX

If you desire to continue using that software, then you will probably need to get a newer version or contact the developer to provide you with a solution. Meanwhile, I would uninstall the software. Except in certain security situations anti-malware software is not required.

Uninstalling Software: The Basics

Most OS X applications are completely self-contained "packages" that can be uninstalled by simply dragging the application to the Trash. Applications may create preference files that are stored in the /Home/Library/Preferences/ folder. Although they do nothing once you delete the associated application, they do take up some disk space. If you want you can look for them in the above location and delete them, too.

Some applications may install an uninstaller program that can be used to remove the application. In some cases the uninstaller may be part of the application's installer, and is invoked by clicking on a Customize button that will appear during the install process.

Some applications may install components in the /Home/Library/Applications Support/ folder. You can also check there to see if the application has created a folder. You can also delete the folder that's in the Applications Support folder. Again, they don't do anything but take up disk space once the application is trashed.

Some applications may install a startupitem or a Log In item. Startupitems are usually installed in the /Library/StartupItems/ folder and less often in the /Home/Library/StartupItems/ folder. Log In Items are set in the Accounts preferences. Open System Preferences, click on the Accounts icon, then click on the LogIn Items tab. Locate the item in the list for the application you want to remove and click on the "-" button to delete it from the list.

Some software use startup daemons or agents that are a new feature of the OS. Look for them in /Library/LaunchAgents/ and /Library/LaunchDaemons/ or in /Home/Library/LaunchAgents/.

If an application installs any other files the best way to track them down is to do a Finder search using the application name or the developer name as the search term. Unfortunately Spotlight will not look in certain folders by default. You can modify Spotlight's behavior or use a third-party search utility, EasyFind, instead.

Some applications install a receipt in the /Library/Receipts/ folder. Usually with the same name as the program or the developer. The item generally has a ".pkg" extension. Be sure you also delete this item as some programs use it to determine if it's already installed.

There are many utilities that can uninstall applications. Here is a selection:

1. AppZapper

2. AppDelete

3. Automaton

4. Hazel

5. AppCleaner

6. CleanApp

7. iTrash

8. Amnesia

9. Uninstaller

10. Spring Cleaning

For more information visit The XLab FAQs and read the FAQ on removing software.

Reply

Answer 2

JCinTX Author

Level 1

0 points

May 17, 2014 2:06 PM in response to Kappy

Thanks Kappy, but I am not iusing any 'addon' antivirus software - so there is nothing to remove. This is part of the OS X Server application install - more specifically while the amavisd server process is analyzing the message. Anyway, I have retrained the server to fix my issues from marking it as banned/spam/etc ...

Right now I am just stuck as I can not get the amavisd-release command to work at the terminal level. I need it to send the quarantined messages back into the mail queue to be delivered to the clients email accounts. I ihave tried to uninstall the server.app and reinstall it from the app store, but it has not fixed it either.

Reply

Answer 3

Kappy

Level 10

361,741 points

May 17, 2014 2:12 PM in response to JCinTX

As you could tell I'm not a server user. Sorry, but I'm not able to help you.

Reply

Answer 4

TigerKR

Level 1

53 points

May 19, 2014 8:02 AM in response to JCinTX

Here are some commands to try:

sudo /bin/launchctl unload -w /Applications/Server.app/Contents/ServerRoot/System/Library/LaunchDaemons/org.a mavis.amavisd.plist

sudo /bin/launchctl load -w /Applications/Server.app/Contents/ServerRoot/System/Library/LaunchDaemons/org.a mavis.amavisd.plist

sudo

/Applications/Server.app/Contents/ServerRoot/usr/bin/spamassassin --lint D

Watch the logs:

/Library/Logs/Mail/*

/var/log/mail.log

/var/log/system.log

Also check out these great tutorials for modifying amavis (and related) configuration files (skip the part about downloading, installing, or otherwise updating the software):

http://topicdesk.com/downloads/tutorials/138-updating-amavisd-new-on-os-x-server -g-1053

http://topicdesk.com/downloads/tutorials/61-updating-spamassassin-on-os-x-server

http://topicdesk.com/downloads/tutorials/139-updating-clamav-on-os-x-server-g-10 56

http://topicdesk.com/downloads/tutorials/38-frontline-spam-defense-for-mac-os-x- server

Those tutorials are so key to setting up the configuration files for OS X Server (I'm using 10.9 Server currently).

Remember to always backup your computer, and also backup individual config files before you edit them.

Reply

Answer 5

JCinTX Author

Level 1

0 points

May 19, 2014 11:45 AM in response to TigerKR

Thanks TigerKR,

So I ran thru that, all worked well (no errors) and then reran amavisd-release command in the terminal and it kicked back the same error...

amavisd-release banned-fX3ORr9nexcG

Can't connect to UNIX socket /var/amavis/amavisd.sock: No such file or directory at /Applications/Server.app/Contents/ServerRoot/usr/bin/amavisd-release line 260.

I ran it a few times checking all the log system and mail* log files and it does not even register anything out of the ordinary except a launchd (com.apple.server.mail.alerts) throttling respawn every few seconds - which is annoying but not causing any damage here.

I'm thinking it won't log anything as the command is not completing from the terminal. I opened the command amavisd-release and it has this code which seems to not be completing...

$sock->connect( pack_sockaddr_un($socketname) )

or die "Can't connect to UNIX socket $socketname: $!";

I'll check out the other articles and see about updating amavisd manually with those instructions you provided. It will be very handy as I know clamav is always showing outdated in the osx server releases.

Reply

Answer 6

TigerKR

Level 1

53 points

May 19, 2014 11:55 AM in response to JCinTX

I don't recommend that you update any of those programs manually. I'd stick to the Apple installed versions. What you're experiencing is a configuration or corruption problem - and installing more programs is definately going to conflate the problem (I know from exerience).

I provided those links for their detail on how to modify non-GUI settings to help to secure you server and reduce SPAM.

Reply

Answer 7

TigerKR

Level 1

53 points

May 19, 2014 11:59 AM in response to JCinTX

Did you try running the command using sudo?

Reply

Answer 8

JCinTX Author

Level 1

0 points

May 19, 2014 12:28 PM in response to TigerKR

Ok, thanks I was afraid of doing that since OS X server likes stuff in different places and this seemed to be for 10.5. - and all the folder locations jumped around at mountain lion. I'll leave it alone then and try to figure out why that code is not running instead.

Yes, I've been running both with sudo and also elevated to stay sudo with sudo -s.

Reply

Answer 9

TigerKR

Level 1

53 points

May 19, 2014 12:56 PM in response to JCinTX

Did you try using the full pathnames, both for the comand and the mail you're trying to release?

sudo /Applications/Server.app/Contents/ServerRoot/usr/bin/amavisd-release \

/Library/Server/Mail/data/scanner/quarantine/banned-fX3ORr9nexcG

Also, what happnens when you type:

ls -aFhlTe /Library/Server/Mail/data/scanner/quarantine/banned-fX3ORr9nexcG

Reply

Answer 10

JCinTX Author

Level 1

0 points

May 19, 2014 1:10 PM in response to TigerKR

Yes, I just tried doing that again and resulted in same error.

Here is the ls listing...

ls -aFhlTe /Library/Server/Mail/data/scanner/quarantine/banned-fX3ORr9nexcG

-rw-r-----+ 1 _amavisd mail 70K May 17 02:56:10 2014 /Library/Server/Mail/data/scanner/quarantine/banned-fX3ORr9nexcG

0: group:admin allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity

1: user:admin allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity

Reply

Answer 11

TigerKR

Level 1

53 points

May 19, 2014 2:02 PM in response to JCinTX

For me, the outer folder is owned by _amavisd:mail, but everything inside is owned by _amavisd:_amavisd. Try:

sudo chown -R _amavisd:_amavisd\ /Library/Server/Mail/data/scanner/quarantine/*

Also, yours has an ACL, but mine don't, so try stripping the ACLs:

sudo chmod -R -N\ /Library/Server/Mail/data/scanner/quarantine

And what happens when you run this:

ls -aFhlTe /Library/Server/Mail/data/scanner/

Reply

Answer 12

TigerKR

Level 1

53 points

May 19, 2014 2:15 PM in response to JCinTX

Also, I've found the amavisd.sock file. Its located:

/Library/Server/Mail/data/scanner/amavis/amavisd.sock

You may have to edit the amavis config file:

/Library/Server/Mail/Config/amavisd/amavisd.conf

and look for a line that starts with "$unix_socketname =". Comment out that line by adding a "#" at the beginning of the line, and add this line just below:

$unix_socketname = "$MYHOME/amavisd.sock"; # amavisd-release or amavis-milter

Then you're going to want to unload and reload the amavis LaunchDaemon using the sudo launchctl commands I pasted earlier.

Reply

Answer 13

JCinTX Author

Level 1

0 points

May 19, 2014 2:28 PM in response to TigerKR

Ok, tried changing perms and got same result.

I id the ls on the directory and it had the same thing so I changed it as well. So it is updated as well with:

bash-3.2# ls -aFhlTe /Library/Server/Mail/data/scanner/

total 0

drwxr-xr-x 7 root wheel 238B May 16 21:50:52 2014 ./

drwxr-xr-x 13 root wheel 442B May 16 21:47:59 2014 ../

drwxr-x--- 13 _amavisd _amavisd 442B May 19 14:45:21 2014 amavis/

drwxr-xr-x 4 _clamav _clamav 136B May 19 14:45:09 2014 clamav/

drwxr-x--- 1985 _amavisd mail 66K May 19 16:14:10 2014 quarantine/

drwxr-xr-x 3 root wheel 102B Jun 8 15:22:15 2013 spamassassin/

drwxr-x---+ 2 _amavisd _amavisd 68B May 19 16:14:10 2014 virusmails/

0: group:admin allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextat tr,writeextattr,readsecurity

bash-3.2# sudo chown -R _amavisd:_amavisd /Library/Server/Mail/data/scanner/quarantine

bash-3.2# ls -aFhlTe /Library/Server/Mail/data/scanner/

total 0

drwxr-xr-x 7 root wheel 238B May 16 21:50:52 2014 ./

drwxr-xr-x 13 root wheel 442B May 16 21:47:59 2014 ../

drwxr-x--- 13 _amavisd _amavisd 442B May 19 14:45:21 2014 amavis/

drwxr-xr-x 4 _clamav _clamav 136B May 19 14:45:09 2014 clamav/

drwxr-x--- 1985 _amavisd _amavisd 66K May 19 16:14:10 2014 quarantine/

drwxr-xr-x 3 root wheel 102B Jun 8 15:22:15 2013 spamassassin/

drwxr-x---+ 2 _amavisd _amavisd 68B May 19 16:14:10 2014 virusmails/

0: group:admin allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextat tr,writeextattr,readsecurity

bash-3.2# sudo /Applications/Server.app/Contents/ServerRoot/usr/bin/amavisd-release /Library/Server/Mail/data/scanner/quarantine/banned-fX3ORr9nexcG

Can't connect to UNIX socket /var/amavis/amavisd.sock: No such file or directory at /Applications/Server.app/Contents/ServerRoot/usr/bin/amavisd-release line 260.

Reply

Answer 14

TigerKR

Level 1

53 points

May 19, 2014 2:40 PM in response to JCinTX

Oops, I edited my comment. You must've used text right from the email apple sent. Sorry about that. Run:

sudo chown _amavisd:mail\ /Library/Server/Mail/data/scanner/quarantine

sudo chown -R _amavisd:_amavisd\ /Library/Server/Mail/data/scanner/quarantine/*

Also, did you edit the amavisd.conf file as I suggested below?

Reply

Answer 15

JCinTX Author

Level 1

0 points

May 19, 2014 3:28 PM in response to TigerKR

Oops I did do it from the email.. Ok I ran the commands and now have...

bash-3.2# ls -aFhlTe /Library/Server/Mail/data/scanner/

total 0

drwxr-xr-x 7 root wheel 238B May 16 21:50:52 2014 ./

drwxr-xr-x 13 root wheel 442B May 16 21:47:59 2014 ../

drwxr-x--- 13 _amavisd _amavisd 442B May 19 16:50:00 2014 amavis/

drwxr-xr-x 4 _clamav _clamav 136B May 19 16:49:50 2014 clamav/

drwxr-x--- 2057 _amavisd mail 68K May 19 17:12:34 2014 quarantine/

drwxr-xr-x 3 root wheel 102B Jun 8 15:22:15 2013 spamassassin/

drwxr-x---+ 2 _amavisd _amavisd 68B May 19 17:12:34 2014 virusmails/

0: group:admin allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextat tr,writeextattr,readsecurity

bash-3.2# ls -aFhlTe /Library/Server/Mail/data/scanner/quarantine/ban*

-rw-r----- 1 _amavisd _amavisd 70K May 17 02:56:10 2014 /Library/Server/Mail/data/scanner/quarantine/banned-fX3ORr9nexcG

I did also check the amavisd.conf file and it was already there with the same $unix_socketname = "$MYHOME/amavisd.sock"; # amavisd-release or amavis-milter line as you suggested.

I can telnet into the port for it - so it should be listening...

bash-3.2# telnet localhost 10024

Trying 127.0.0.1...

Connected to localhost.

Escape character is '^]'.

220 [127.0.0.1] ESMTP amavisd-new service ready

Am I reading this correctly that the error in the line 260 is looking for the amavisd.sock file though in /var/amavis subfolder, which I do not have. I wonder if I make a directory and copy over the amavisd.sock file from /Library/Server/Mail/Data/scanner/amavis/ to /var/amavis if it would work then? I created a /var/amavis directory and tried to it do it but got and error...

cp /Library/Server/Mail/Data/scanner/amavis/amavisd.sock /var/amavis/amavisd.sock

cp: /Library/Server/Mail/Data/scanner/amavis/amavisd.sock: Operation not supported on socket

Reply