MailScanner: Could not analyze message

[Martin Hepworth]

Dave

sorry.....

send the output of

/opt/MailScanner/bin/MailScanner -v

(or whereever MailScanner is installed)

to this list....

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Dave Duffner - PSCGi wrote:
> Martin,
>
>         I believe this could be related to RTF settings from
> stuff I'm finding elsewhere, but everything's worth a shot.
>
>         Forgive my ignorance, but can you define 'drop a
> MailScanner -v to the list' a bit more?  That command
> or doing it with the List's address doesn't seem to fly...
>
>         Dave
>
>
>
>>-----Original Message-----
>>From: MailScanner mailing list
>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Martin Hepworth
>>Sent: Friday, February 18, 2005 10:47 AM
>>To: MAILSCANNER at JISCMAIL.AC.UK
>>Subject: Re: MailScanner: Could not analyze message
>>
>>
>>Dave
>>
>>can you drop a "MailScanner -v" to the list. I'm wondering if
>>one of the
>>MIME:: libraries that got updates recently might be causing an issue..
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Dave Duffner - PSCGi wrote:
>>
>>>Glenn,
>>>
>>>        Took a rip at that one, here's the twist:
>>>
>>>        It could be that software doing it, but I now have
>>
>>copies of
>>
>>>the List digest traffic that fails to be analyzed the most.  If it
>>>sends 15 copies of the Digest out in small batches so as not to
>>>overload with mass CC:'ing, 10+ of those pass without
>>
>>incident.  But
>>
>>>1-5 of them will fail as being unable to be analyzed?  I
>>
>>have the MS
>>
>>>children set high enough and nothing sits in queue's long enough to
>>>have these being passed because of overload, so the random part is
>>>most confusing.
>>>
>>>        And then we have the fact random inbounds are doing
>>
>>the same
>>
>>>thing, none of those are digest-mode list traffic. Just random
>>>incoming e-mail to users.  It seems to happen most from Yahoo!
>>>traffic, but at least 50% of that traffic passes without
>>
>>any problems.
>>
>>>        I checked the headers and content on those that
>>
>>pass outbound,
>>
>>>they're hot huge by any means and all the header info is intact,
>>>nothing missing that should cause the failure you mentioned below.
>>>
>>>        Anyone with any ideas on what could be causing this?
>>>
>>>        Dave
>>>
>>>
>>>
>>>
>>>>-----Original Message-----
>>>>From: MailScanner mailing list
>>
>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On
>>
>>>>Behalf Of Steen, Glenn
>>>>Sent: Thursday, February 17, 2005 9:48 AM
>>>>To: MAILSCANNER at JISCMAIL.AC.UK
>>>>Subject: Re: MailScanner: Could not analyze message
>>>>
>>>>
>>>>That would be the CantAnalyze (in languages.conf)... Only place it
>>>>seems to fire is in the Explode function, if a MIME boundary exists
>>>>and is equivalent to the empty string (""). Might point a
>>
>>fat finger
>>
>>>>at the digest creation software?
>>>>
>>>>-- Glenn
>>>>
>>>>
>>>>
>>>>>-----Original Message-----
>>>>>From: MailScanner mailing list
>>
>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On
>>
>>>>>Behalf Of Dave
>>>>
>>>>Duffner - PSCGi
>>>>
>>>>
>>>>>Sent: den 17 februari 2005 15:14
>>>>>To: MAILSCANNER at JISCMAIL.AC.UK
>>>>>Subject: MailScanner: Could not analyze message
>>>>>
>>>>>
>>>>>Greetings,
>>>>>
>>>>>       Still stumped on this one, has anyone else at least
>>>>
>>>>seen these
>>>>
>>>>
>>>>>pop up?  Or might have a clue where the failures are or
>>
>>what logs I
>>
>>>>>should be looking in to get a better grip on why this is happening?
>>>>>
>>>>>       We get the following messages encased in the virus warning
>>>>>e-mails MS issues:
>>>>>
>>>>>       MailScanner: Could not analyze message
>>>>>
>>>>>       It seems to be most prevalent in Digest-mode email from
>>>>>several list servers we have using the main server as part of the
>>>>>path.  We want the outgoing mail scanned to ensure nothing
>>>>
>>>>gets past
>>>>
>>>>
>>>>>in or out, but randomly this pops up.
>>>>>
>>>>>       We're using MS, ClamAV & Spsmassassin in combo on an
>>>>>Ensim-based linux setup.  Normally it's worked just fine,
>>>>
>>>>but within
>>>>
>>>>
>>>>>the last few weeks these started cropping up on outbound
>>>>
>>>>messages that
>>>>
>>>>
>>>>>contain digests and inbound messages that seem to contain
>>>>
>>>>FWD's from
>>>>
>>>>
>>>>>others to users on our servers. Notable is that it happens
>>>>
>>>>quite a bit
>>>>
>>>>
>>>>>to someone using Yahoo that forwards random 'stuff' to one of our
>>>>>users.
>>>>>
>>>>>       Any clues helpful!
>>>>>
>>>>>       Dave
>>>>>
>>>>>
>>>>>
>>>>>--
>>>>>Message scanned by MailScanner, and is believed to be clean.
>>>>>CONFIDENTIALITY NOTICE:  This transmission intended for the
>>>>
>>>>specified
>>>>
>>>>
>>>>>destination and person.  If this is not you, this
>>>>>e-mail must be deleted immediately.     www.nwcweb.com
>>>>>
>>>>>------------------------ MailScanner list
>>>>
>>>>------------------------ To
>>>>
>>>>
>>>>>unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
>>>>>mailscanner' in the body of the email. Before posting, read the MAQ
>>>>>(http://www.mailscanner.biz/maq/) and the archives
>>>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>>
>>>>>Support MailScanner development - buy the book off the website!
>>>>>
>>>>
>>>>------------------------ MailScanner list
>>>>------------------------ To unsubscribe, email
>>
>>jiscmail at jiscmail.ac.uk
>>
>>>>with the words: 'leave mailscanner' in the body of the
>>
>>email. Before
>>
>>>>posting, read the MAQ
>>>>(http://www.mailscanner.biz/maq/) and the archives
>>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>Support MailScanner development - buy the book off the website!
>>>>
>>>>--
>>>>Message scanned by MailScanner, and is believed to be clean.
>>>>CONFIDENTIALITY NOTICE:  This transmission intended for the
>>
>>specified
>>
>>>>destination and person.  If this is not you, this
>>>>e-mail must be deleted immediately.     www.nwcweb.com
>>>>
>>>
>>>
>>>
>>>--
>>>Message scanned by MailScanner, and is believed to be clean.
>>>CONFIDENTIALITY NOTICE:  This transmission intended for the
>>
>>specified
>>
>>>destination and person.  If this is not you, this
>>>e-mail must be deleted immediately.     www.nwcweb.com
>>>
>>>------------------------ MailScanner list
>>
>>------------------------ To
>>
>>>unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
>>>mailscanner' in the body of the email. Before posting, read the MAQ
>>>(http://www.mailscanner.biz/maq/) and the archives
>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential
>>and intended solely for the use of the individual or entity
>>to whom they are addressed. If you have received this email
>>in error please notify the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list
>>------------------------ To unsubscribe, email
>>jiscmail at jiscmail.ac.uk with the words: 'leave mailscanner'
>>in the body of the email. Before posting, read the MAQ
>>(http://www.mailscanner.biz/maq/) and the archives
>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>--
>>Message scanned by MailScanner, and is believed to be clean.
>>CONFIDENTIALITY NOTICE:  This transmission intended for the
>>specified destination and person.  If this is not you, this
>>e-mail must be deleted immediately.     www.nwcweb.com
>>
>
>
>
> --
> Message scanned by MailScanner, and is believed to be clean.
> CONFIDENTIALITY NOTICE:  This transmission intended for the
> specified destination and person.  If this is not you, this
> e-mail must be deleted immediately.     www.nwcweb.com
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!