MailScanner: Could not analyze message
Dave Duffner - PSCGi
webalizer at NWCWEB.COM
Fri Feb 18 16:01:32 GMT 2005
Martin,
I believe this could be related to RTF settings from
stuff I'm finding elsewhere, but everything's worth a shot.
Forgive my ignorance, but can you define 'drop a
MailScanner -v to the list' a bit more? That command
or doing it with the List's address doesn't seem to fly...
Dave
> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Martin Hepworth
> Sent: Friday, February 18, 2005 10:47 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: MailScanner: Could not analyze message
>
>
> Dave
>
> can you drop a "MailScanner -v" to the list. I'm wondering if
> one of the
> MIME:: libraries that got updates recently might be causing an issue..
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Dave Duffner - PSCGi wrote:
> > Glenn,
> >
> > Took a rip at that one, here's the twist:
> >
> > It could be that software doing it, but I now have
> copies of
> > the List digest traffic that fails to be analyzed the most. If it
> > sends 15 copies of the Digest out in small batches so as not to
> > overload with mass CC:'ing, 10+ of those pass without
> incident. But
> > 1-5 of them will fail as being unable to be analyzed? I
> have the MS
> > children set high enough and nothing sits in queue's long enough to
> > have these being passed because of overload, so the random part is
> > most confusing.
> >
> > And then we have the fact random inbounds are doing
> the same
> > thing, none of those are digest-mode list traffic. Just random
> > incoming e-mail to users. It seems to happen most from Yahoo!
> > traffic, but at least 50% of that traffic passes without
> any problems.
> >
> > I checked the headers and content on those that
> pass outbound,
> > they're hot huge by any means and all the header info is intact,
> > nothing missing that should cause the failure you mentioned below.
> >
> > Anyone with any ideas on what could be causing this?
> >
> > Dave
> >
> >
> >
> >>-----Original Message-----
> >>From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> >>Behalf Of Steen, Glenn
> >>Sent: Thursday, February 17, 2005 9:48 AM
> >>To: MAILSCANNER at JISCMAIL.AC.UK
> >>Subject: Re: MailScanner: Could not analyze message
> >>
> >>
> >>That would be the CantAnalyze (in languages.conf)... Only place it
> >>seems to fire is in the Explode function, if a MIME boundary exists
> >>and is equivalent to the empty string (""). Might point a
> fat finger
> >>at the digest creation software?
> >>
> >>-- Glenn
> >>
> >>
> >>>-----Original Message-----
> >>>From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> >>>Behalf Of Dave
> >>
> >>Duffner - PSCGi
> >>
> >>>Sent: den 17 februari 2005 15:14
> >>>To: MAILSCANNER at JISCMAIL.AC.UK
> >>>Subject: MailScanner: Could not analyze message
> >>>
> >>>
> >>>Greetings,
> >>>
> >>> Still stumped on this one, has anyone else at least
> >>
> >>seen these
> >>
> >>>pop up? Or might have a clue where the failures are or
> what logs I
> >>>should be looking in to get a better grip on why this is happening?
> >>>
> >>> We get the following messages encased in the virus warning
> >>>e-mails MS issues:
> >>>
> >>> MailScanner: Could not analyze message
> >>>
> >>> It seems to be most prevalent in Digest-mode email from
> >>>several list servers we have using the main server as part of the
> >>>path. We want the outgoing mail scanned to ensure nothing
> >>
> >>gets past
> >>
> >>>in or out, but randomly this pops up.
> >>>
> >>> We're using MS, ClamAV & Spsmassassin in combo on an
> >>>Ensim-based linux setup. Normally it's worked just fine,
> >>
> >>but within
> >>
> >>>the last few weeks these started cropping up on outbound
> >>
> >>messages that
> >>
> >>>contain digests and inbound messages that seem to contain
> >>
> >>FWD's from
> >>
> >>>others to users on our servers. Notable is that it happens
> >>
> >>quite a bit
> >>
> >>>to someone using Yahoo that forwards random 'stuff' to one of our
> >>>users.
> >>>
> >>> Any clues helpful!
> >>>
> >>> Dave
> >>>
> >>>
> >>>
> >>>--
> >>>Message scanned by MailScanner, and is believed to be clean.
> >>>CONFIDENTIALITY NOTICE: This transmission intended for the
> >>
> >>specified
> >>
> >>>destination and person. If this is not you, this
> >>>e-mail must be deleted immediately. www.nwcweb.com
> >>>
> >>>------------------------ MailScanner list
> >>
> >>------------------------ To
> >>
> >>>unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
> >>>mailscanner' in the body of the email. Before posting, read the MAQ
> >>>(http://www.mailscanner.biz/maq/) and the archives
> >>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>
> >>>Support MailScanner development - buy the book off the website!
> >>>
> >>
> >>------------------------ MailScanner list
> >>------------------------ To unsubscribe, email
> jiscmail at jiscmail.ac.uk
> >>with the words: 'leave mailscanner' in the body of the
> email. Before
> >>posting, read the MAQ
> >>(http://www.mailscanner.biz/maq/) and the archives
> >>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>
> >>Support MailScanner development - buy the book off the website!
> >>
> >>--
> >>Message scanned by MailScanner, and is believed to be clean.
> >>CONFIDENTIALITY NOTICE: This transmission intended for the
> specified
> >>destination and person. If this is not you, this
> >>e-mail must be deleted immediately. www.nwcweb.com
> >>
> >
> >
> >
> > --
> > Message scanned by MailScanner, and is believed to be clean.
> > CONFIDENTIALITY NOTICE: This transmission intended for the
> specified
> > destination and person. If this is not you, this
> > e-mail must be deleted immediately. www.nwcweb.com
> >
> > ------------------------ MailScanner list
> ------------------------ To
> > unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
> > mailscanner' in the body of the email. Before posting, read the MAQ
> > (http://www.mailscanner.biz/maq/) and the archives
> > (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential
> and intended solely for the use of the individual or entity
> to whom they are addressed. If you have received this email
> in error please notify the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail at jiscmail.ac.uk with the words: 'leave mailscanner'
> in the body of the email. Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> --
> Message scanned by MailScanner, and is believed to be clean.
> CONFIDENTIALITY NOTICE: This transmission intended for the
> specified destination and person. If this is not you, this
> e-mail must be deleted immediately. www.nwcweb.com
>
--
Message scanned by MailScanner, and is believed to be clean.
CONFIDENTIALITY NOTICE: This transmission intended for the
specified destination and person. If this is not you, this
e-mail must be deleted immediately. www.nwcweb.com
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner
mailing list