Large number of unscanned messages

[Bill Anderson]

Ok, I think I got this figured out.  The domain in question does not have
virus scanning turned on (which is what I want), but does have SPAM scanning
on.  I went ahead and turned on ALL logging of spam messages and this is
what I got.

> X-MailScanner: Not scanned: please contact your Internet E-Mail Service
> Provider for details
> X-MailScanner-SpamCheck: not spam, SpamAssassin (score=3.2, required 5,
>       MIME_LONG_LINE_QP, NO_REAL_NAME, SALE, SPAM_PHRASE_05_08,
>       SUBJECT_IS_LIST)

I assume the first X-MailScanner says not scanned, because the VIRUS
scanning will never happen because I turned it off.  The second line is what
happened during the SPAM scan process.  Since I did not have all logging of
spam turned on, I never saw the X-MailScanner-SpamCheck message, because the
SPAM never registered above my threshold.

Thanks.

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Julian Field
> Sent: Friday, January 17, 2003 1:02 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Large number of unscanned messages
>
>
> In which case only your named domains will be scanned. What are the
> envelope recipient addresses (in your maillog) on the unscanned messages?
>
> At 00:17 17/01/2003, you wrote:
> >Virus Scanning = /etc/MailScanner/rules/strlg.virus.scanning.rules
> >
> >strlg.virus.scanning.rules
> >FromorTo:       default         no
> >To:     motocow.com     yes
> >To:     sterling.net    yes
> >To:     sterlink.net    yes
> >To:     sterlink.ws     yes
> >To:     sterlink.org    yes
> >To:     sterlink.tv     yes
> >To:     sterlink.cc     yes
> >To:     sterlink.info   yes
> >To:     pacificlegal.com        yes
> >To:     pacimaging.com  yes
> >To:     countrysidechurch.com   yes
> >To:     tualatinislandgreens.com        yes
> >To:     bethanyvillage.com      yes
> >To:     darkhorseconstruction.com       yes
> >To:     lgprs.org       yes
> >To:     lgprs.com       yes
> >To:     lgprs.net       yes
> >To:     newavenues.org  yes
> >To:     coffmanteam.com yes
> >To:     coffmanexcavation.com   yes
> >
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > > Behalf Of Julian Field
> > > Sent: Thursday, January 16, 2003 3:42 PM
> > > To: MAILSCANNER at JISCMAIL.AC.UK
> > > Subject: Re: Large number of unscanned messages
> > >
> > >
> > > In your MailScanner.conf file, what does the "Virus Scanning"
> option say?
> > >
> > > At 23:32 16/01/2003, you wrote:
> > > >I have a large number of messages that do not get scanned.  I
> > > have verified
> > > >that they are not whitelisted.  Most of the spam get's caught,
> > > however some
> > > >slip through without scanning.  What could be causing this
> or what is the
> > > >best way to diagnose the problem.  Here is the log entry:
> > > >
> > > >Jan 16 15:26:33 arwen MailScanner[27051]: New Batch: Forwarding
> > > 1 unscanned
> > > >messages, 5099 bytes
> > > >
> > > >Here is the header of an unscanned message:
> > > >
> > > >Received: from arwen.sterling.net ([199.108.225.50]) by
> > > alder.keyknife.com
> > > >with SMTP (Microsoft Exchange Internet Mail Service Version
> 5.5.2650.21)
> > > >  id YSS41YS8; Thu, 16 Jan 2003 12:00:14 -0800
> > > >Received: from mx11.royalsavings.com (mx11.royalsavings.com
> > > [207.176.24.83])
> > > >  by arwen.sterling.net (8.11.6/8.11.6) with ESMTP id h0GK0Bu08958
> > > >  for < ejl at keyknife.com <mailto:ejl at keyknife.com> >; Thu,
> 16 Jan 2003
> > > >12:00:11 -0800
> > > >Received: by mx11.royalsavings.com (Postfix, from userid 844)
> > > >  id A9EF51E85BE; Thu, 16 Jan 2003 12:37:21 -0500 (EST)
> > > >To: ejl at keyknife.com <mailto:ejl at keyknife.com>
> > > >From: "Credit Help" < advice at SmartDiscounts.net
> > > ><mailto:advice at SmartDiscounts.net> >
> > > >Reply-To: bounce at dm-direct.com <mailto:bounce at dm-direct.com>
> > > >X-CampaignID: 00886
> > > >X-Recipient: ejl at keyknife.com <mailto:ejl at keyknife.com>
> > > >X-Intalius: ZWpsQGtleWtuaWZlLmNvbQ==
> > > >X-ListID: 12
> > > >X-Source: 50209
> > > >Subject: Advice on debt reduction
> > > >MIME-Version: 1.0
> > > >Content-type: multipart/alternative;
> > > boundary=boundary_23188.98657_31093158
> > > >Message-Id: < 20030116173721.A9EF51E85BE at mx11.royalsavings.com
> > > ><mailto:20030116173721.A9EF51E85BE at mx11.royalsavings.com> >
> > > >Date: Thu, 16 Jan 2003 12:37:21 -0500 (EST)
> > > >X-MailScanner: Not scanned: please contact your Internet
> E-Mail Service
> > > >Provider for details
> > > >
> > > >--boundary_23188.98657_31093158
> > > >Content-Type: text/plain; charset=us-ascii
> > > >Content-Transfer-Encoding: quoted-printable
> > > >X-MIME-Autoconverted: from 8bit to quoted-printable by
> > > arwen.sterling.net id
> > > >h0GK0Bu08958
> > >
> > > --
> > > Julian Field
> > > www.MailScanner.info
> > > MailScanner thanks transtec Computers for their support
> > >
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
>