I have a problem with users' mailboxes being corrupted. I am running RH8, with sendmail/procmail using McAfee command line virus scanner through the emailscan script (emailscan.sourceforge.net/) and SpamAssassin 2.61.

My /etc/procmailrc is listed below. Occassionally, when the mail client attempts to fetch the mail, an error message is returned stating:

ERROR : Could not complete request.
Query: SELECT "INBOX"
Reason Given: SELECT failed: Can't open INBOX (file /var/spool/mail/username): not in valid mailbox format

Generally an otherwise empty mailbox will have a strand of SpamAssassin output at the top, similar to this:

X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on server
X-Spam-Level: *
X-Spam-Status: No, hits=1.2 required=4.0 tests=BANG_MONEY,HTML_MESSAGE,
NO_REAL_NAME autolearn=no, version=2.61

Comments on the /etc/procmailrc file:

1. The DROPPRIVS is commented out because I get errors about permissions on rm, mkdir, and find. Error messages generated are:
/bin/mkdir: cannot open current directory: Permission denied
/usr/bin/find: cannot get current directory: Permission denied
No errors were generated when running without privileges dropped.

2. The virus scanning is locked so that only once instance of emailscan can run at once. I had problems locking with $LOGNAME.lock lockfiles. When two users received an attachment at the same time (i.e., email with attachment addressed to two users), an endless loop of attempting to lock was created:

procmail: Locking "/var/spool/mail/username1.lock"
procmail: [21171] Wed Jan 28 14:19:16 2004
procmail: Locking "/var/spool/mail/username2.lock"
procmail: [21175] Wed Jan 28 14:19:16 2004
procmail: Locking "/var/spool/mail/username1.lock"
procmail: [21171] Wed Jan 28 14:19:24 2004
procmail: Locking "/var/spool/mail/username2.lock"
procmail: [21175] Wed Jan 28 14:19:24 2004
procmail: Locking "/var/spool/mail/username1.lock"
procmail: [21171] Wed Jan 28 14:19:32 2004
procmail: Locking "/var/spool/mail/username2.lock"
procmail: [21175] Wed Jan 28 14:19:32 2004
procmail: Locking "/var/spool/mail/username1.lock"
procmail: [21171] Wed Jan 28 14:19:40 2004
procmail: Locking "/var/spool/mail/username2.lock"
procmail: [21175] Wed Jan 28 14:19:40 2004

3. The recipe deleting anything with Bad RFC2822 headers is to delete errors generated by SpamAssassin when the dates on spam generate these errors.

Q1: Why are users' mailboxes being corrupted with apparently spurious SpamAssassin results?

Q2: I have a small mail server (8 users) with a 1.7 Gig processor and 512M of RAM. I think that I do not need to limit myself to one instance of emailscan and SpamAssassin at a time. Ideally, I would like for each user to be able to have an instance of emailscan or SpamAssassin at any one time. Any comments on recipes to help me accomplish this are appreciated.

Thanks,
Travis Beal

My /etc/procmailrc file:
==================
#DROPPRIVS=yes
LOGFILE=/var/log/proclog/procmail.masterlog
VERBOSE = off
TMP=/var/tmp

# Scan for viruses
#:0fw:/var/spool/mail/$LOGNAME.lock
:0fw:virus.lock
* !^X-Virus-Scan:
* multipart
| /etc/mail/emailscan/emailscan

#SpamAssassin
:0fw:/var/spool/mail/$LOGNAME.lock
* < 256000
| /usr/bin/spamc -u nobody

# Work around procmail bug: any output on stderr will cause the "F" in "From"
# to be dropped. This will re-add it.
:0
* ^^rom[ ]
{
LOG="*** Dropped F off From_ header! Fixing up. "
:0 fhw
| sed -e '1s/^/F/'
}

:0
* ^X-Mail-Format-Warning: *Bad RFC2822 header*
/dev/null