Messages received and processed, but not being delivered

Wed Feb 2 09:22:35 GMT 2005

Isi

try taking the blank lines out of the rule files.
You can debug what is happening by stopping MS, changing the Debug
statements to YES in MailScanner.conf and running checkmailscanner which
  will dump a load of instrumentation to the screen as MS runs..

If you haven't kept archive copies (or a store action in a ruleset) you
haven't got the emails to reprocess. You might to turn on the archive
action while you are testing all this..so you can reprocess the messages
if you need to.

I'd also move the RBL's in SA as if you have in MS they act a blacklist,
not just adding to the spam score. Oh and turn off autowhitelist and the
ALL_TRUSTED rule in spam.assassin.prefs.conf as well.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

Isi Lawson wrote:
> Hello All,
>
> I have found a problem that I could find no details about on the maillist.
>  Perhaps it is new.
>
> I have had a working installation of MailScanner for about 6 months now.
> Last night I added a ruleset that broke my installation.  Backing out the
> ruleset allow it to work normally again.  I am looking for some insight on
> 2 things:
>
> 1)  my does this not work.
> 2)  how can i get my mail back.
>
> Here is what happened.
>
> I modified this setting (/etc/MailScanner.conf)
> From:
>  Non Spam Actions = deliver
>
> To:
>  Non Spam Actions = /etc/MailScanner/rules/nonspam.action.rules
>
>
> I then added this file containing the rules
> (/etc/MailScanner/rules/nonspam.action.rules)
>
> # domain1.net
> FromOrTo:       *@domain1.net     deliver
>
> # domain2.com
> FromOrTo:       *@domain2.com     deliver
>
> # domain3.net
> FromOrTo:       *@domain3.net     deliver
>
> # Default Configuration
> FromOrTo:       Default           deliver
>
>
> I restart mailscanner (service MailScanner restart) and everything looks
> like it comes up in correctly in the logs /var/log/maillog.
>
> Jan 31 22:43:16 abaddon postfix/postfix-script: starting the Postfix mail
> system
> Jan 31 22:43:16 abaddon postfix/master[9080]: daemon started -- version 2.1.5
> Jan 31 22:43:16 abaddon postfix/postfix-script: fatal: the Postfix mail
> system is already running
> Jan 31 22:43:17 abaddon MailScanner[9104]: MailScanner E-Mail Virus
> Scanner version 4.37.7 starting...
> Jan 31 22:43:17 abaddon MailScanner[9104]: Config: calling custom init
> function MailWatchLogging
> Jan 31 22:43:17 abaddon MailScanner[9104]: Started SQL Logging child
> Jan 31 22:43:18 abaddon MailScanner[9104]: Enabling SpamAssassin
> auto-whitelist functionality...
> Jan 31 22:43:20 abaddon MailScanner[9104]: Using locktype = flock
>
>
> When i send a message through i also see normal logs: /var/log/maillog
>
> Jan 31 23:52:49 abaddon postfix/smtpd[2112]: connect from
> web13806.mail.yahoo.com[216.136.175.16]
> Jan 31 23:52:49 abaddon postfix/smtpd[2112]: 874353800082:
> client=web13806.mail.yahoo.com[216.136.175.16]
> Jan 31 23:52:49 abaddon postfix/cleanup[2114]: 874353800082: hold: header
> Received: from web13806.mail.yahoo.com (web13806.mail.yahoo.
> com [216.136.175.16])??by smtp01.purecomputing.net (Postfix) with SMTP id
> 874353800082??for <user at domain2.com>; Mon, 31 Jan 2005 23:
> 52:49  from web13806.mail.yahoo.com[216.136.175.16];
> from=<user at domain.com> to=<user at domain2.com> proto=SMTP
> helo=<web13806.mail.
> yahoo.com>
> Jan 31 23:52:49 abaddon postfix/cleanup[2114]: 874353800082: hold: header
> Received: (qmail 17030 invoked by uid 60001); 1 Feb 2005 04:
> 52:48 -0000 from web13806.mail.yahoo.com[216.136.175.16];
> from=<user at domain.com> to=<user at domain2.com> proto=SMTP helo=<web13806.
> mail.yahoo.com>
> Jan 31 23:52:49 abaddon postfix/cleanup[2114]: 874353800082:
> message-id=<20050201045248.17028.qmail at web13806.mail.yahoo.com>
> Jan 31 23:52:49 abaddon postfix/cleanup[2114]: 874353800082: hold: header
> Received: from [68.158.37.209] by web13806.mail.yahoo.com vi
> a HTTP; Mon, 31 Jan 2005 20:52:48 PST from
> web13806.mail.yahoo.com[216.136.175.16]; from=<user at domain.com>
> to=<user at domain2.com>
> proto=SMTP helo=<web13806.mail.yahoo.com>
> Jan 31 23:52:49 abaddon postfix/smtpd[2112]: disconnect from
> web13806.mail.yahoo.com[216.136.175.16]
> Jan 31 23:52:51 abaddon MailScanner[2019]: New Batch: Scanning 1 messages,
> 1480 bytes
> Jan 31 23:52:52 abaddon MailScanner[2019]: Virus and Content Scanning:
> Starting
> Jan 31 23:52:54 abaddon MailScanner[2019]: Logging message
> 874353800082.53026 to SQL
>
> And the transaction ends right there.  There is no more activity until i
> send another test message.  What i see is the message come in normally,
> get processed by mailscanner but never get put back on the outgoing queue
> so that postfix can send it.
>
> After much troubleshooting (i didn't correlate the rule addition with this
> problem) I decided to remove the Non Spam rule in MailScanner.conf and
> restarted. Everything started working just fine.
>
> I have it working not but would like to know how to get the ruleset work
> properly for Non Spam Actions and secondly how to recover my messages that
> I can see came in (via the logs and mailwatch) but are not anywhere that i
> have found on the system.  (thoughts)
>
> Hardware: P4 2.4, 512Meg, 1x60gig, 1x100Mbit
> Software: Redhat 9, Postfix, Spamassassin, DCC, Pyzor, Razor, MailWatch
> RBLs: None in MTA, ORDB-RBL and SBL+XBL in MailScanner, None in SpamAssassin
> Virus Scanners: ClamAV, BitDefender
> Volume: ~500 messages/day
>

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!