Mail service dead. no receive, no send , no error

hi, i have a problem, after a long time with out problems we note that we dont receive mails, today we make some test from /to hotmail, gmail and other, and between mail from our server ( same or different domain)... Nothing. not error , no reject mail, nothing. if i send from our mail to any, a copy in "sent " remain, but no more noise.. nothing. i like if is posible if somebody can show from where we can begin the trace. i test mail server with mxtoolbox, and all the results are ok (green) no probelma, no black list. we really are missing. we contact today with our dealer , ma be they cahnge something, but all the test on the ports are ok . (needed ports are open)
tx in advance

 

are you trying to send to/from a mail client, eg outlook, or from webmail?

if a test of your mailserver with mxtoolbox is all green (was it just an mx lookup or did you use the diagnostics?) then it's most likely the problem is with the username/password for the account you're trying to send from.

 

nononnoo, i am the supervisor of the server. all account show the same behavior. using email client, or web mail. same result. i talking about a multidomain server (10 domains) with 20 o 30 email boxes. and we dont make changes in the last 10 months ( before CORONAvirus). but suddenly all kind of interchange stop the 1st of oc
tuber

 

My signature has link to tutorial on e-mail setup with ISPConfig, it has instructions on testing the setup.
Start with this: https://www.howtoforge.com/community/threads/please-read-before-posting.58408/
Are all services running?

Code:

systemctl --state=failed

Monitor mail log to see what happens when e-mail is being sent or received.
Verify your ISP has not closed port 25.

 

does local mail delivery work? ie [email protected] to [email protected]?

has any sort of apt upgrade / dist upgrade been applied to the mailserver? maybe check the last modified dates for the postfix config files.

if you're convinced that all the mail accounts themselves are ok and you've checked everything @Taleman suggests, maybe download and extract the ispconfig 3.1.15.p3 files and run php -q update.php, and allow it to reconfigure services.

if you tell us the affected mailservers fqdn and tell us a valid email address on there, we can find something.
otherwise, maybe try testing smtp using telnet: https://blog.mailtrap.io/how-to-test-smtp-server/

also, for the mail you've tried sending from your mailserver, have you checked all mail queues? maybe they're all in the deferred queue..

that's all a bit scattergun there, i'd suggest starting in this order:
1. check failed services as indicated by @Taleman
2. check the mail logs for any obvious errors.
3. start with the telnet smtp testing, it'll indicate if there's any problems with port 25, and if port 25 is ok but it doesn't accept mail, it should at least provide an error code to start troubleshooting from.


also, check for free disk space. not the first thing most people would think of when having mail server problems. but it'll properly screw up your mail queues if you've run out of space.

 

Taleman & Nhybgtvfr. Thank for your patient. i follow Till post ( i never see before!!! ) and this are the conclusion
test dont show problems:

##### SERVER #####
IP-address (as per hostname): ***.***.***.***
[WARN] could not determine server's ip address by ifconfig
[INFO] OS version is Ubuntu 18.04.5 LTS

[INFO] ISPConfig is installed.

##### ISPCONFIG #####
ISPConfig version is 3.1.15p3


##### VERSION CHECK #####

[INFO] php (cli) version is 7.2.24-0ubuntu***.***.***.***

##### PORT CHECK #####


##### MAIL SERVER CHECK #####


##### RUNNING SERVER PROCESSES #####

[INFO] I found the following web server(s):
Apache 2 (PID 11872)
[INFO] I found the following mail server(s):
Postfix (PID 2054)
[INFO] I found the following pop3 server(s):
Dovecot (PID 1633)
[INFO] I found the following imap server(s):
Dovecot (PID 1633)
[INFO] I found the following ftp server(s):
PureFTP (PID 1853)

##### LISTENING PORTS #####
Internet ()
Dirección (remota)
[anywhere]:993 (1633/dovecot)
[anywhere]:995 (1633/dovecot)
[localhost]:10023 (1876/postgrey)
[localhost]:9000 (1062/php-fpm
[localhost]:10025 (2054/master)
[localhost]:10027 (2054/master)
[anywhere]:587 (2054/master)
[localhost]:11211 (1101/memcached)
[anywhere]:110 (1633/dovecot)
[anywhere]:143 (1633/dovecot)
[anywhere]:465 (2054/master)​

ABout mail.log , i see the same entries repeat thousads

Oct 7 13:46:41 mnsvr postfix/smtpd[32357]: disconnect from unknown[45.142.120.209] ehlo=1 auth=0/1 rset=1 quit=1
commands=3/4
Oct 7 13:46:43 mnsvr postfix/smtpd[32331]: connect from unknown[45.142.120.209]
Oct 7 13:46:45 mnsvr postfix/smtpd[32357]: connect from unknown[45.142.120.209]
Oct 7 13:46:46 mnsvr postfix/smtpd[32033]: connect from unknown[212.70.149.20]
Oct 7 13:46:46 mnsvr postfix/smtpd[32036]: warning: unknown[212.70.149.83]: SASL LOGIN authentication failed:
UGFzc3dvcmQ6
Oct 7 13:46:46 mnsvr postfix/smtpd[32664]: warning: unknown[45.142.120.209]: SASL LOGIN authentication failed: Connection

lost to authentication server
Oct 7 13:46:46 mnsvr postfix/smtpd[32664]: disconnect from unknown[45.142.120.209] ehlo=1 auth=0/1 rset=1 quit=1

commands=3/4
Oct 7 13:46:46 mnsvr dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: Connection reset by peer
Oct 7 13:46:46 mnsvr postfix/smtpd[32037]: warning: unknown[45.142.120.209]: SASL LOGIN authentication failed: Connection

lost to authentication server
Oct 7 13:46:46 mnsvr postfix/smtpd[32037]: disconnect from unknown[45.142.120.209] ehlo=1 auth=0/1 rset=1 quit=1

commands=3/4
Oct 7 13:46:47 mnsvr postfix/smtpd[32036]: disconnect from unknown[212.70.149.83] ehlo=1 auth=0/1 rset=1 quit=1

commands=3/4
Oct 7 13:46:47 mnsvr dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: Connection reset by peer
Oct 7 13:46:48 mnsvr postfix/smtpd[32664]: connect from unknown[45.142.120.209]
Oct 7 13:46:49 mnsvr dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: Connection reset by peer
Oct 7 13:46:50 mnsvr postfix/smtpd[32036]: connect from unknown[212.70.149.52]
Oct 7 13:46:50 mnsvr postfix/smtpd[32037]: connect from unknown[45.142.120.209]
Oct 7 13:46:51 mnsvr dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: EOF
Oct 7 13:46:51 mnsvr postfix/smtpd[31826]: warning: unknown[45.142.120.209]: SASL LOGIN authentication failed: Connection

lost to authentication server
Oct 7 13:46:51 mnsvr postfix/smtpd[31826]: disconnect from unknown[45.142.120.209] ehlo=1 auth=0/1 rset=1 quit=1

commands=3/4
Oct 7 13:46:51 mnsvr dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: Connection reset by peer​

I test port 25 using telnet & web service for port testing, and ports 25 465, 993, 995 are open
the unique strage thing is about services:

● apparmor.service loaded failed failed AppArmor initialization
● certbot.service loaded failed failed Certbot​

because i use letsencrypt cert all the time, in all my webs w/o problems, and about APPARMOR, i thought is was disable in initial instalation sipconfig process !

 

but when i send a mail between 2 email internal, like [email protected] to [email protected]?
log file show something weird, but i need to help to undetsanding, and because this log contain personal info, i like to show in privae, can i?
tx in advance

 

if you click on the username on the left of each post, you can then click on start a conversation.

shouldn't be much in there that needs hiding though, you should be able to post it here, just blanking out or changing the actual recipient's part of the email address and any encrypted passwords.

 

yes, i thought the same, i send from [email protected] to [email protected]
here the extract: (removing the garbage)

Oct 7 16:03:20 mnsvr dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=18226, secured, session=<dWWYLRWx1OkAAAAAAAAAAAAAAAAAAAAB>
Oct 7 16:03:20 mnsvr dovecot: imap([email protected]): Logged out in=168 out=1474​

and the other side are:

Oct 7 16:03:20 mnsvr dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=18226, secured, session=<dWWYLRWx1OkAAAAAAAAAAAAAAAAAAAAB>
Oct 7 16:03:20 mnsvr dovecot: imap([email protected]): Logged out in=168 out=1474

​

or:

Oct 7 16:04:37 mnsvr dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=18257, secured, session=<9iQmMhWx2ukAAAAAAAAAAAAAAAAAAAAB>
Oct 7 16:04:37 mnsvr dovecot: imap([email protected]): Logged out in=92 out=950​

but i found millons of line similar to these:

Oct 7 16:04:37 mnsvr postfix/smtpd[16822]: warning: unknown[45.142.120.209]: SASL LOGIN authentication failed: Connection lost to authentication server
Oct 7 16:04:38 mnsvr postfix/smtpd[16822]: disconnect from unknown[45.142.120.209] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
Oct 7 16:04:38 mnsvr dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: EOF
Oct 7 16:04:38 mnsvr postfix/smtpd[18258]: connect from unknown[45.142.120.209]
Oct 7 16:04:39 mnsvr postfix/smtpd[17082]: warning: unknown[45.150.206.113]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct 7 16:04:39 mnsvr dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: Connection reset by peer
Oct 7 16:04:39 mnsvr postfix/smtpd[17082]: lost connection after AUTH from unknown[45.150.206.113]
Oct 7 16:04:39 mnsvr postfix/smtpd[17082]: disconnect from unknown[45.150.206.113] ehlo=1 auth=0/1 commands=1/2
Oct 7 16:04:39 mnsvr postfix/smtpd[17082]: connect from unknown[45.150.206.113]
Oct 7 16:04:39 mnsvr postfix/smtpd[17524]: warning: unknown[45.142.120.209]: SASL LOGIN authentication failed: Connection lost to authentication server
Oct 7 16:04:39 mnsvr dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: EOF
Oct 7 16:04:39 mnsvr postfix/smtpd[17524]: disconnect from unknown[45.142.120.209] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
Oct 7 16:04:41 mnsvr postfix/smtpd[17308]: warning: unknown[212.70.149.20]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct 7 16:04:41 mnsvr postfix/smtpd[17524]: connect from unknown[45.142.120.209]
Oct 7 16:04:42 mnsvr postfix/smtpd[17308]: disconnect from unknown[212.70.149.20] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
Oct 7 16:04:43 mnsvr postfix/smtpd[17372]: warning: unknown[45.142.120.209]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct 7 16:04:43 mnsvr postfix/smtpd[17372]: disconnect from unknown[45.142.120.209] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
​

i dont recognize these IPs, but i have millons of entries of this. more i looking for country, because i cannot trace this ips, 1 if for Bulgary, and the other is from russian federation, can i block again these traffic?

 

i confuse with this line

Oct 7 19:33:04 mnsvr postfix/smtpd[29285]: NOQUEUE: filter: RCPT from localhost[::1]: <[email protected]>: Sender address triggers FILTER amavis:[127.0.0.1]:10026; from=<info@digiiberi$
Oct 7 19:33:04 mnsvr postfix/smtpd[29285]: A1B6A5C585B: client=localhost[::1], sasl_method=LOGIN, [email protected]
Oct 7 19:33:04 mnsvr postfix/cleanup[29937]: A1B6A5C585B: message-id=<[email protected]>
Oct 7 19:33:04 mnsvr postfix/qmgr[16090]: A1B6A5C585B: from=<[email protected]>, size=619, nrcpt=1 (queue active)
Oct 7 19:33:04 mnsvr postfix/smtpd[29285]: disconnect from localhost[::1] ehlo=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=6​

--> Oct 7 19:33:04 mnsvr postfix/smtp[29885]: connect to 127.0.0.1[127.0.0.1]:10026: Connection refused

Oct 7 19:33:04 mnsvr postfix/smtp[29885]: A1B6A5C585B: to=<[email protected]>, relay=none, delay=0.06, delays=0.05/0/0/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]$
Oct 7 19:33:04 mnsvr dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=29939, secured, session=<LqGlGxixNoYAAAAAAAAAAAAAAAAAAAAB>
Oct 7 19:33:04 mnsvr dovecot: imap([email protected]): Logged out in=468 out=649
Oct 7 19:33:05 mnsvr postfix/smtpd[28239]: disconnect from unknown[212.70.149.20] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
Oct 7 19:33:05 mnsvr dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=29941, secured, session=<cDKvGxixOIYAAAAAAAAAAAAAAAAAAAAB>
Oct 7 19:33:05 mnsvr dovecot: imap([email protected]): Logged out in=70 out=748
Oct 7 19:33:05 mnsvr postfix/smtpd[28237]: warning: unknown[45.142.120.209]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct 7 19:33:05 mnsvr dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=29943, secured, session=<v0eyGxixOoYAAAAAAAAAAAAAAAAAAAAB>
Oct 7 19:33:05 mnsvr dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=29946, secured, session=<AsSyGxixPIYAAAAAAAAAAAAAAAAAAAAB>​

"postfix/smtp[29885]: connect to 127.0.0.1[127.0.0.1]:10026: Connection refused"???

 

Code:

Sender address triggers FILTER amavis:[127.0.0.1]:10026

Looks like amavis is using port 10026.

Code:

"postfix/smtp[29885]: connect to 127.0.0.1[127.0.0.1]:10026: Connection refused"???

My guess: amavis is not running.

 

i made php -q update.php, and , n ow list of failed service dont include certbot, but now

Oct 8 09:55:02 mnsvr postfix/smtpd[2141]: connect from localhost[::1]
Oct 8 09:55:02 mnsvr postfix/smtpd[2141]: lost connection after CONNECT from localhost[::1]
Oct 8 09:55:02 mnsvr postfix/smtpd[2141]: disconnect from localhost[::1] commands=0/0​

i dont understand why if i send from [email protected], it create copy in sent folder, but mail dissapair, and if i send from gmail or hotmail, i dont receive any mail with "delivery problem!!", nothing

 

What does mail.log show when sending or receiving those problem e-mails?

 

but now if i send from hotmail to domain.tlb, i get this:

Oct 8 10:00:03 mnsvr postfix/smtpd[2128]: NOQUEUE: filter: RCPT from mail-db8eur06olkn2091.outbound.protection.outlook.com[40.92.51.91]: <[email protected]>: S$
Oct 8 10:00:03 mnsvr postfix/smtpd[2128]: NOQUEUE: filter: RCPT from mail-db8eur06olkn2091.outbound.protection.outlook.com[40.92.51.91]: <[email protected]>: S$
Oct 8 10:00:04 mnsvr postfix/smtpd[2128]: 0AE575C5F2B: client=mail-db8eur06olkn2091.outbound.protection.outlook.com[40.92.51.91]
Oct 8 10:00:04 mnsvr postfix/cleanup[3067]: 0AE575C5F2B: message-id=<VI1PR0101MB25109D1F08040AD6E80A3393A30B0@VI1PR0101MB2510.eurprd01.prod.exchangelabs.com>
Oct 8 10:00:04 mnsvr postfix/qmgr[2087]: 0AE575C5F2B: from=<[email protected]>, size=5724, nrcpt=1 (queue active)
Oct 8 10:00:04 mnsvr postfix/error[3068]: 0AE575C5F2B: to=<[email protected]>, relay=none, delay=0.32, delays=0.29/0.02/0/0.01, dsn=4.4.1, status=deferred (delivery tempo$
Oct 8 10:00:04 mnsvr postfix/smtpd[2128]: disconnect from mail-db8eur06olkn2091.outbound.protection.outlook.com[40.92.51.91] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 co$
Oct 8 10:00:04 mnsvr dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: Connection reset by peer
Oct 8 10:00:20 mnsvr dovecot: imap-login: Login: user=<info@@domainA.tlb>, method=PLAIN, rip=::1, lip=::1, mpid=3341, secured, session=<ISc+OSSxNMMAAAAAAAAAAAAAAAAAAAAB>
Oct 8 10:00:20 mnsvr dovecot: imap(info@@domainA.tlb): Logged out in=488 out=3399
Oct 8 10:00:21 mnsvr postfix/smtpd[2128]: disconnect from unknown[212.70.149.83] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
Oct 8 10:00:21 mnsvr postfix/smtpd[2141]: connect from unknown[45.142.120.209]
Oct 8 10:00:22 mnsvr dovecot: imap-login: Login: user=<info@@domainA.tlb>, method=PLAIN, rip=::1, lip=::1, mpid=3343, secured, session=<b8BROSSxNsMAAAAAAAAAAAAAAAAAAAAB>
Oct 8 10:00:22 mnsvr dovecot: imap(info@@domainA.tlb): Logged out in=488 out=3399
Oct 8 10:00:22 mnsvr dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: Connection reset by peer
Oct 8 10:00:23 mnsvr dovecot: imap-login: Login: user=<info@@domainA.tlb>, method=PLAIN, rip=::1, lip=::1, mpid=3345, secured, session=<dfhgOSSxOMMAAAAAAAAAAAAAAAAAAAAB>
Oct 8 10:00:23 mnsvr dovecot: imap(info@@domainA.tlb): Logged out in=488 out=3399
Oct 8 10:00:24 mnsvr dovecot: imap-login: Login: user=<info@@domainA.tlb>, method=PLAIN, rip=::1, lip=::1, mpid=3347, secured, session=<BqduOSSxOsMAAAAAAAAAAAAAAAAAAAAB>
Oct 8 10:00:24 mnsvr dovecot: imap(info@@domainA.tlb): Logged out in=488 out=3399​

??

 

if i send from domain.tlb to hotmail

Oct 8 10:12:50 mnsvr postfix/smtpd[2151]: connect from localhost[::1]
Oct 8 10:12:50 mnsvr postfix/smtpd[2151]: NOQUEUE: filter: RCPT from localhost[::1]: <[email protected]>: Sender address triggers FILTER amavis:[127.0.0.1]:10026; from=<i$
Oct 8 10:12:50 mnsvr postfix/smtpd[2128]: warning: unknown[45.142.120.209]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct 8 10:12:50 mnsvr postfix/smtpd[2150]: warning: unknown[45.142.120.209]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct 8 10:12:50 mnsvr postfix/smtpd[2151]: 379ED5C5F1D: client=localhost[::1], sasl_method=LOGIN, [email protected]
Oct 8 10:12:50 mnsvr postfix/cleanup[3950]: 379ED5C5F1D: message-id=<[email protected]>
Oct 8 10:12:50 mnsvr postfix/smtpd[2143]: connect from unknown[45.142.120.209]
Oct 8 10:12:50 mnsvr postfix/qmgr[2087]: 379ED5C5F1D: from=<[email protected]>, size=622, nrcpt=1 (queue active)
Oct 8 10:12:50 mnsvr postfix/smtp[3944]: connect to 127.0.0.1[127.0.0.1]:10026: Connection refused
Oct 8 10:12:50 mnsvr postfix/smtpd[2151]: disconnect from localhost[::1] ehlo=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=6
Oct 8 10:12:50 mnsvr postfix/smtp[3944]: 379ED5C5F1D: to=<[email protected]>, relay=none, delay=0.06, delays=0.05/0/0/0, dsn=4.4.1, status=deferred (connect to$
Oct 8 10:12:50 mnsvr postfix/smtpd[2128]: disconnect from unknown[45.142.120.209] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
Oct 8 10:12:50 mnsvr dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=3952, secured, session=<nn3pZSSxvsMAAAAAAAAAAAAAAAAAAAAB>
Oct 8 10:12:50 mnsvr dovecot: imap([email protected]): Logged out in=463 out=649
Oct 8 10:12:50 mnsvr postfix/smtpd[2150]: disconnect from unknown[45.142.120.209] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
Oct 8 10:12:50 mnsvr dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=3954, secured, session=<vBv0ZSSxwMMAAAAAAAAAAAAAAAAAAAAB>
Oct 8 10:12:51 mnsvr dovecot: imap([email protected]): Logged out in=70 out=748
Oct 8 10:12:51 mnsvr dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=3956, secured, session=<Woj3ZSSxwsMAAAAAAAAAAAAAAAAAAAAB>
Oct 8 10:12:51 mnsvr dovecot: imap([email protected]): Logged out in=396 out=29003
Oct 8 10:12:51 mnsvr dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=3958, secured, session=<3Rj5ZSSxxMMAAAAAAAAAAAAAAAAAAAAB>
Oct 8 10:12:51 mnsvr dovecot: imap([email protected]): Logged out in=120 out=815​

 

it looks like the server is accepting emails ok, which is why you're not getting anything back when you send from hotmail etc.
but it's not able to virus scan them, so they're all in a queue waiting to be scanned.
as @Taleman stated, you should start looking at amavis

 

ok, and, any help, please, i dont know where i can begin

 

systemctl status amavis or systemctl status amavisd-new
should show if the service is running ok or not.

netstat -ap | grep amavis
will show what ports it's listening on if it is running.

 

you right!!!
netstat brief:

unix 2 [ ACC ] FLUJO ESCUCHANDO 29330 2065/master private/amavis​

but systmctl say:

● amavis.service - LSB: Starts amavisd-new mailfilter
Loaded: loaded (/etc/init.d/amavis; generated)
Active: active (exited) since Thu 2020-10-08 09:52:34 CEST; 2h 51min ago
Docs: man:systemd-sysv-generator(8)
Process: 1580 ExecStart=/etc/init.d/amavis start (code=exited, status=0/SUCCESS)

oct 08 09:52:34 mnsvr amavis[1978]: No decoder for .rar
oct 08 09:52:34 mnsvr amavis[1978]: No decoder for .rpm
oct 08 09:52:34 mnsvr amavis[1978]: No decoder for .swf
oct 08 09:52:34 mnsvr amavis[1978]: No decoder for .zoo
oct 08 09:52:34 mnsvr amavis[1978]: Using primary internal av scanner code for ClamAV-clamd
oct 08 09:52:34 mnsvr amavis[1580]: amavisd-new.
oct 08 09:52:34 mnsvr amavis[1978]: Found secondary av scanner ClamAV-clamscan at /usr/bin/clamscan
oct 08 09:52:34 mnsvr systemd[1]: Started LSB: Starts amavisd-new mailfilter.
oct 08 09:52:34 mnsvr amavis[1978]: (!!)TROUBLE in pre_loop_hook: config: no rules were found! Do you need to run 'sa-update'?
oct 08 09:52:34 mnsvr amavis[1978]: (!)_DIE: Suicide () TROUBLE in pre_loop_hook: config: no rules were found! Do you need to run 'sa-update'?​

i consult knowledge base (here!) y i do:
sa-update
and reboot & VOila!!!!!
i add commands for cron
TX a lot!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

 

thanks to guide me!!!!!