Huge files in /var/vmail/mydomain.com/*user*/Maildir/tmp/

Hi !

Today I had run into low disk space condition, and found that we have been badly spammed

Code:

find / -type f -printf "%s\t%p\n" | sort -n | tail -20

reveal a LOT of same files of *same* size like:
134203542 /var/vmail/mydomain.com/*user*/Maildir/tmp/1606566109.M683566P25648.mail
I have removed them manually, since these commands don't clean this stuff.

Code:

doveadm expunge -A mailbox "*" all
postsuper -d ALL

I think its a bogus archive which freeze unarchiver when Amavis try to scan its content.
Anyone had such problem before? Is there any way to purge ALL mail tmp except

Code:

rm -Rf /var/vmail/*/*/Maildir/tmp/

PS. Additionally, there is huge
140737477881856 /proc/kcore
But I don't think its a real file.

 

As a temporary solution I wrote this shell/cron script, to be run every minute.
Hope this helps someone else.
Feedback appreciated.

Code:

#!/bin/bash

NOW=$(date +'%Y-%m-%d %T')
LOGFILE='/var/log/anvcheck_lowdiskspace.log'

if [ ! -f $LOGFILE ]; then
    touch $LOGFILE
    echo "$NOW : log file created" >> $LOGFILE
fi

CURRENT=$(df / | grep / | awk '{ print $5}' | sed 's/%//g')
THRESHOLD=90

if [ "$CURRENT" -gt "$THRESHOLD" ] ; then
   echo "$NOW : Deleting bogus mail temp files" >> $LOGFILE
   rm -Rf /var/vmail/*/*/Maildir/tmp/*
EOF
fi