Now that I'm not freaking out after a long weekend of Postfix/<insert accessory here> config files, etc... let me try to explain my problem.
This seems to only happen when I receive a "SPAM" email. Amavisd wants to gzip the spam and save it for later in /var/amavisd/quarantine. I tried to gzip -d a "spam-e43234...324f.gz" file and got "unrecognized file format". I'm thinking it's saying "hey. we've got spam. let's gzip it, and put it in quarantine.. oops, didn't gzip properly <return>".
**NOTE: FQDN changed to "HOSTNAME.COM" for privacy **
Relevant entry from /var/log/maillog:
Dec 29 17:49:56 otis postfix/smtpd[1763]: connect from mail81.megamailservers.com[216.251.36.81]
Dec 29 17:49:57 otis postfix/smtpd[1763]: NOQUEUE: client=mail81.megamailservers.com[216.251.36.81]
Dec 29 17:49:57 otis amavis[21766]: (21766-05) ESMTP::10024 /var/amavisd/tmp/amavis-20041229T174957-21766: <antiquated8@myway.com> -> <XXXX@HOSTNAME.COM>,<X@HOSTNAME.COM> Received: SIZE=2654 BODY=8BITMIME from otis.HOSTNAME.COM ([127.0.0.1]) by localhost (otis.HOSTNAME.COM [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 21766-05; Wed, 29 Dec 2004 17:49:57 -0600 (CST)
Dec 29 17:49:57 otis amavis[21766]: (21766-05) Checking: [216.251.36.81] <antiquated8@myway.com> -> <XXXX@HOSTNAME.COM>,<X@HOSTNAME.COM>
Dec 29 17:49:57 otis amavis[21766]: (21766-05) p001 1 Content-Type: text/html, size: 1865 B, name:
Dec 29 17:50:12 otis amavis[21766]: (21766-05) local delivery: <antiquated8@myway.com> -> <spam-quarantine>, mbx=/var/amavisd/quarantine/spam-36ff4082b106eccd216b0072ed06c026-20041229-174957-21766-05.gz
Dec 29 17:50:12 otis amavis[21766]: (21766-05) TROUBLE in check_mail: spam quar+notif FAILED: Closing pipe to /bin/gzip: DIED on signal 127 (ffffffff), Broken pipe at /usr/local/sbin/amavisd line 3567, <GEN100> line 132.
Dec 29 17:50:12 otis amavis[21766]: (21766-05) PRESERVING EVIDENCE in /var/amavisd/tmp/amavis-20041229T174957-21766
Dec 29 17:50:12 otis amavis[21766]: (21766-05) TIMING [total 15075 ms] - SMTP EHLO: 26 (0%), SMTP pre-MAIL: 23 (0%), mkdir tempdir: 6 (0%), create email.txt: 4 (0%), SMTP pre-DATA-flush: 94 (1%), SMTP DATA: 403 (3%), body_hash: 6 (0%), mkdir parts: 9 (0%), mime_decode: 88 (1%), get-file-type1: 190 (1%), parts_decode: 3 (0%), AV-scan-1: 99 (1%), spam-wb-list: 48 (0%), SA msg read: 5 (0%), SA parse: 16 (0%), SA check: 13867 (92%), update_cache: 23 (0%), write-header: 148 (1%), rundown: 16 (0%)
Dec 29 17:55:12 otis postfix/smtpd[1763]: timeout after END-OF-MESSAGE from mail81.megamailservers.com[216.251.36.81]
Dec 29 17:55:12 otis postfix/smtpd[1763]: disconnect from mail81.megamailservers.com[216.251.36.81]
/etc/amavisd.conf:
use strict;
$MYHOME = '/var/amavisd';
$mydomain = 'HOSTNAME.COM';
$daemon_user = '_amavisd';
$daemon_group = '_amavisd';
$daemon_chroot_dir = $MYHOME;
$QUARANTINEDIR = "$MYHOME/quarantine";
$TEMPBASE = "$MYHOME/tmp";
$ENV{TMPDIR} = $TEMPBASE;
$helpers_home = $MYHOME;
$max_servers=8;
$child_timeout=20*60; # we need to adjust the timeout since it is not a localhost transfer
$forward_method = 'smtp:127.0.0.1:10025';
$notify_method = $forward_method;
$inet_socket_port = 10024;
$inet_socket_bind = '127.0.0.1';
# @bypass_virus_checks_acl = (1);
read_hash(\%local_domains, '/etc/postfix/relay_domains');
$DO_SYSLOG = 1; # (1 = syslog, 0 = logfile)
$log_level = 5; # (0-5)
$final_spam_destiny = D_REJECT; # Set to D_REJECT, D_PASS to pass through
read_hash(\%whitelist_sender, '/var/amavisd/whitelist');
read_hash(\%blacklist_sender, '/var/amavisd/blacklist');
read_hash(\%spam_lovers, '/var/amavisd/spam_lovers');
#defending against mail bombs
$MAXLEVELS = 14;
$MAXFILES = 1500;
$MIN_EXPANSION_QUOTA = 100*1024;
$MAX_EXPANSION_QUOTA = 300*1024*1024;
$path = '/usr/bin:/bin';
$file = 'file';
$arc = ['nomarch', 'arc'];
$gzip = 'gzip';
$bzip2 = 'bzip2';
$uncompress = ['uncompress', 'gzip -d', 'zcat'];
$lha = 'lha';
$unarj = 'unarj';
$unrar = 'unrar';
$zoo = 'zoo';
$cpio = 'cpio';
$rpm2cpio = 'rpm2cpio';
$cabextract = 'cabextract';
$enable_db = 1; # enable use of BerkeleyDB/libdb (SNMP and nanny)
$enable_global_cache = 1; # enable use of libdb-based cache if $enable_db=1
# SpamAssassin settings
$sa_local_tests_only = 0;
$sa_auto_whitelist = 1; # comment this line out to turn off auto whitelist
$sa_mail_body_size_limit = 64*1024; # 64KB
$sa_tag_level_deflt = 3.0; # controls adding the X-Spam-Status and X-Spam-Level headers,
$sa_tag2_level_deflt = 6.3; # controls adding 'X-Spam-Flag: YES', and editing Subject,
$sa_kill_level_deflt = $sa_tag2_level_deflt; # triggers spam evasive actions:
$sa_spam_subject_tag = '***SPAM*** ';
$sa_debug = 1; # comment this line out to turn off debugging
### Virus scanners
# Add X-Virus-Scanned line to mail? (default: undef)
$X_HEADER_TAG = 'X-Virus-Scanned';
$remove_existing_x_scanned_headers = 0; # leave existing X-Virus-Scanned alone
# Don't notify sender when these viruses
# are found because they spoof From:
$viruses_that_fake_sender_re = new_RE(
qr'nimda|hybris|klez|bugbear|yaha|braid|sobig|fizz er|palyh|peido|holar'i,
qr'tanatos|lentin|bridex|mimail|trojan\.dropper|du maru|parite|spaces'i,
qr'dloader|galil|gibe|swen|netwatch|bics|sbrowse|s co|mydoom'i,
[qr'^(EICAR\.COM|Joke\.|Junk\.)'i => 0],
[qr'^(WM97|OF97|W95/CIH-|JS/Fort)'i => 0],
);
@av_scanners = (
# http://www.clamav.net/
['Clam Antivirus-clamd',
\&ask_daemon, ["CONTSCAN {}\n", '/var/amavisd/clamd.sock'],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
);
@av_scanners_backup = (
# http://www.clamav.net/
['Clam Antivirus - clamscan', 'clamscan',
'--stdout --disable-summary -r {}', [0], [1],
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
);
1; # insure a defined return
Amavisd stuff from /var/log/maillog:
Dec 29 20:44:20 otis amavis[2882]: SMTP-in protocol code loaded
Dec 29 20:44:20 otis amavis[2882]: ANTI-VIRUS code loaded
Dec 29 20:44:20 otis amavis[2882]: ANTI-SPAM code loaded
Dec 29 20:44:20 otis amavis[2882]: Unpackers code loaded
Dec 29 20:44:20 otis amavis[2882]: Found $file at (chroot: /var/amavisd/) /bin/file
Dec 29 20:44:20 otis amavis[2882]: Found $arc at (chroot: /var/amavisd/) /usr/bin/arc
Dec 29 20:44:20 otis amavis[2882]: Found $gzip at (chroot: /var/amavisd/) /bin/gzip
Dec 29 20:44:20 otis amavis[2882]: Found $bzip2 at (chroot: /var/amavisd/) /bin/bzip2
Dec 29 20:44:20 otis amavis[2882]: No $lzop, not using it
Dec 29 20:44:20 otis amavis[2882]: Found $lha at (chroot: /var/amavisd/) /usr/bin/lha
Dec 29 20:44:20 otis amavis[2882]: Found $unarj at (chroot: /var/amavisd/) /usr/bin/unarj
Dec 29 20:44:20 otis amavis[2882]: Found $uncompress at (chroot: /var/amavisd/) /bin/gzip -d
Dec 29 20:44:20 otis amavis[2882]: No $unfreeze, not using it
Dec 29 20:44:20 otis amavis[2882]: Found $unrar at (chroot: /var/amavisd/) /usr/bin/unrar
Dec 29 20:44:20 otis amavis[2882]: Found $zoo at (chroot: /var/amavisd/) /bin/zoo
Dec 29 20:44:20 otis amavis[2882]: Found $cpio at (chroot: /var/amavisd/) /usr/bin/cpio
Dec 29 20:44:20 otis amavis[2882]: No $ar, not using it
Dec 29 20:44:20 otis amavis[2882]: Found $rpm2cpio at (chroot: /var/amavisd/) /usr/bin/rpm2cpio
Dec 29 20:44:20 otis amavis[2882]: Found $cabextract at (chroot: /var/amavisd/) /usr/bin/cabextract
Dec 29 20:44:20 otis amavis[2882]: No $dspam, not using it
Dec 29 20:44:20 otis amavis[2882]: Using internal av scanner code for (primary) Clam Antivirus-clamd
Dec 29 20:44:20 otis amavis[2882]: Found secondary av scanner Clam Antivirus - clamscan at (chroot: /var/amavisd/) /bin/clamscan
Dec 29 20:44:20 otis amavis[2882]: Creating db in /var/amavisd /var/amavisd/db/; BerkeleyDB 0.26, libdb 4.2
Dec 29 20:44:21 otis amavis[2882]: SpamControl: initializing Mail::SpamAssassin
Dec 29 20:44:38 otis amavis[2882]: SpamControl: done
Right now I'm running Amavisd in normal mode (non-chroot) to see how much of a difference that makes. I've also tried "sudo chroot -u _amavisd /var/amavisd /bin/gzip -h" and gzip displays the syntaxes like it should.
I'm now watching the logs in hope that some spam arrives so I can see how gzip works without a chroot jail.
I also wonder if maybe the mail message that gzip is trying to compress is too small and gzip is returning "file would grow; left unmodified" and amavisd is taking this to be an error...?
I'm not sure which possibility it is. Maybe it's a simple change to a config file. I'll stop speculating now. Thanks for your time.