Although I've been using MIMEDefang as the primary component in my email filtering path for years, I find that once in awhile it will mysteriously stop functioning. When this happens, it usually spontaneously coughs up an error state with no apparent changes to the configuration or filtering code. Now I've spent very little time actually working with MIMEDefang, though I've built several dozen mail filtering servers based on it. This is due to the fact that except for these incidents, it Just Works™ 99% of the time.
On my primary mail server a problem such as this might happen once or twice a year, which prompts me to upgrade to the newest version which I had probably been lax in doing anyway. Nine times out of ten, this "fixes" the problem and it's all but forgotten until next time.
The other day I ran into a situation where I would see MIMEDefang go to an error state with the message
MIMEDefang-2.56: accept() returned invalid socket (Result too large), try again. There was a dearth of information on this error in the MIMEDefang forums or on Google, and I was running the most recent version. So, I had to dig a little deeper.
md-mx-ctrl histo I could see that of the 10 slave processes that I had configured as the max number, the last few were hardly touched, so it didn't seem to be a concurrency problem. I did note that earlier in the day there were some spurious memory-related errors on the server, and I thought it possible that a large message or batch of messages had exhausted the memory limits for the processing slave, or even the whole group, so I upped
MX_MAX_RSS to 20MB and
MX_MAX_AS to 100MB in the MIMEDefang startup script. Upon restarting MIMEDefang and leaving a daemon to watch the maillog for errors, the problem appears to be resolved.
As always, YMMV.