MailScanner: Could not analyze message

[Dave Duffner - PSCGi]

Glenn,

        Took a rip at that one, here's the twist:

        It could be that software doing it, but I now have
copies of the List digest traffic that fails to be analyzed
the most.  If it sends 15 copies of the Digest out in small
batches so as not to overload with mass CC:'ing, 10+ of those
pass without incident.  But 1-5 of them will fail as being
unable to be analyzed?  I have the MS children set high
enough and nothing sits in queue's long enough to have these
being passed because of overload, so the random part is most
confusing.

        And then we have the fact random inbounds are doing
the same thing, none of those are digest-mode list traffic.
Just random incoming e-mail to users.  It seems to happen
most from Yahoo! traffic, but at least 50% of that traffic
passes without any problems.

        I checked the headers and content on those that pass
outbound, they're hot huge by any means and all the header
info is intact, nothing missing that should cause the failure
you mentioned below.

        Anyone with any ideas on what could be causing this?

        Dave


> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Steen, Glenn
> Sent: Thursday, February 17, 2005 9:48 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: MailScanner: Could not analyze message
>
>
> That would be the CantAnalyze (in languages.conf)... Only
> place it seems to fire is in the Explode function, if a MIME
> boundary exists and is equivalent to the empty string ("").
> Might point a fat finger at the digest creation software?
>
> -- Glenn
>
> > -----Original Message-----
> > From: MailScanner mailing list
> > [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Dave
> Duffner - PSCGi
> > Sent: den 17 februari 2005 15:14
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: MailScanner: Could not analyze message
> >
> >
> > Greetings,
> >
> >         Still stumped on this one, has anyone else at least
> seen these
> > pop up?  Or might have a clue where the failures are or what logs I
> > should be looking in to get a better grip on why this is happening?
> >
> >         We get the following messages encased in the virus warning
> > e-mails MS issues:
> >
> >         MailScanner: Could not analyze message
> >
> >         It seems to be most prevalent in Digest-mode email from
> > several list servers we have using the main server as part of the
> > path.  We want the outgoing mail scanned to ensure nothing
> gets past
> > in or out, but randomly this pops up.
> >
> >         We're using MS, ClamAV & Spsmassassin in combo on an
> > Ensim-based linux setup.  Normally it's worked just fine,
> but within
> > the last few weeks these started cropping up on outbound
> messages that
> > contain digests and inbound messages that seem to contain
> FWD's from
> > others to users on our servers. Notable is that it happens
> quite a bit
> > to someone using Yahoo that forwards random 'stuff' to one of our
> > users.
> >
> >         Any clues helpful!
> >
> >         Dave
> >
> >
> >
> > --
> > Message scanned by MailScanner, and is believed to be clean.
> > CONFIDENTIALITY NOTICE:  This transmission intended for the
> specified
> > destination and person.  If this is not you, this
> > e-mail must be deleted immediately.     www.nwcweb.com
> >
> > ------------------------ MailScanner list
> ------------------------ To
> > unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
> > mailscanner' in the body of the email. Before posting, read the MAQ
> > (http://www.mailscanner.biz/maq/) and the archives
> > (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
> >
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail at jiscmail.ac.uk with the words: 'leave mailscanner'
> in the body of the email. Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> --
> Message scanned by MailScanner, and is believed to be clean.
> CONFIDENTIALITY NOTICE:  This transmission intended for the
> specified destination and person.  If this is not you, this
> e-mail must be deleted immediately.     www.nwcweb.com
>


--
Message scanned by MailScanner, and is believed to be clean.
CONFIDENTIALITY NOTICE:  This transmission intended for the
specified destination and person.  If this is not you, this
e-mail must be deleted immediately.     www.nwcweb.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!