MailScanner: Could not analyze message

[Martin Hepworth]

Dave

can you drop a "MailScanner -v" to the list. I'm wondering if one of the
MIME:: libraries that got updates recently might be causing an issue..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Dave Duffner - PSCGi wrote:
> Glenn,
>
>         Took a rip at that one, here's the twist:
>
>         It could be that software doing it, but I now have
> copies of the List digest traffic that fails to be analyzed
> the most.  If it sends 15 copies of the Digest out in small
> batches so as not to overload with mass CC:'ing, 10+ of those
> pass without incident.  But 1-5 of them will fail as being
> unable to be analyzed?  I have the MS children set high
> enough and nothing sits in queue's long enough to have these
> being passed because of overload, so the random part is most
> confusing.
>
>         And then we have the fact random inbounds are doing
> the same thing, none of those are digest-mode list traffic.
> Just random incoming e-mail to users.  It seems to happen
> most from Yahoo! traffic, but at least 50% of that traffic
> passes without any problems.
>
>         I checked the headers and content on those that pass
> outbound, they're hot huge by any means and all the header
> info is intact, nothing missing that should cause the failure
> you mentioned below.
>
>         Anyone with any ideas on what could be causing this?
>
>         Dave
>
>
>
>>-----Original Message-----
>>From: MailScanner mailing list
>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Steen, Glenn
>>Sent: Thursday, February 17, 2005 9:48 AM
>>To: MAILSCANNER at JISCMAIL.AC.UK
>>Subject: Re: MailScanner: Could not analyze message
>>
>>
>>That would be the CantAnalyze (in languages.conf)... Only
>>place it seems to fire is in the Explode function, if a MIME
>>boundary exists and is equivalent to the empty string ("").
>>Might point a fat finger at the digest creation software?
>>
>>-- Glenn
>>
>>
>>>-----Original Message-----
>>>From: MailScanner mailing list
>>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Dave
>>
>>Duffner - PSCGi
>>
>>>Sent: den 17 februari 2005 15:14
>>>To: MAILSCANNER at JISCMAIL.AC.UK
>>>Subject: MailScanner: Could not analyze message
>>>
>>>
>>>Greetings,
>>>
>>>        Still stumped on this one, has anyone else at least
>>
>>seen these
>>
>>>pop up?  Or might have a clue where the failures are or what logs I
>>>should be looking in to get a better grip on why this is happening?
>>>
>>>        We get the following messages encased in the virus warning
>>>e-mails MS issues:
>>>
>>>        MailScanner: Could not analyze message
>>>
>>>        It seems to be most prevalent in Digest-mode email from
>>>several list servers we have using the main server as part of the
>>>path.  We want the outgoing mail scanned to ensure nothing
>>
>>gets past
>>
>>>in or out, but randomly this pops up.
>>>
>>>        We're using MS, ClamAV & Spsmassassin in combo on an
>>>Ensim-based linux setup.  Normally it's worked just fine,
>>
>>but within
>>
>>>the last few weeks these started cropping up on outbound
>>
>>messages that
>>
>>>contain digests and inbound messages that seem to contain
>>
>>FWD's from
>>
>>>others to users on our servers. Notable is that it happens
>>
>>quite a bit
>>
>>>to someone using Yahoo that forwards random 'stuff' to one of our
>>>users.
>>>
>>>        Any clues helpful!
>>>
>>>        Dave
>>>
>>>
>>>
>>>--
>>>Message scanned by MailScanner, and is believed to be clean.
>>>CONFIDENTIALITY NOTICE:  This transmission intended for the
>>
>>specified
>>
>>>destination and person.  If this is not you, this
>>>e-mail must be deleted immediately.     www.nwcweb.com
>>>
>>>------------------------ MailScanner list
>>
>>------------------------ To
>>
>>>unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
>>>mailscanner' in the body of the email. Before posting, read the MAQ
>>>(http://www.mailscanner.biz/maq/) and the archives
>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>
>>------------------------ MailScanner list
>>------------------------ To unsubscribe, email
>>jiscmail at jiscmail.ac.uk with the words: 'leave mailscanner'
>>in the body of the email. Before posting, read the MAQ
>>(http://www.mailscanner.biz/maq/) and the archives
>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>--
>>Message scanned by MailScanner, and is believed to be clean.
>>CONFIDENTIALITY NOTICE:  This transmission intended for the
>>specified destination and person.  If this is not you, this
>>e-mail must be deleted immediately.     www.nwcweb.com
>>
>
>
>
> --
> Message scanned by MailScanner, and is believed to be clean.
> CONFIDENTIALITY NOTICE:  This transmission intended for the
> specified destination and person.  If this is not you, this
> e-mail must be deleted immediately.     www.nwcweb.com
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!