MailScanner: Could not analyze message
Dave Duffner - PSCGi
webalizer at NWCWEB.COM
Fri Feb 18 16:33:07 GMT 2005
Martin,
Not a problem...
We're working with servers loaded with RH Linux Fedora Core 1
and Ensim Pro OS'es so I think I'm after a different point to
execute that command. There is no /opt dir or even /usr/bin/MailScanner
dir to fire it from. Doing so as a command returns the error that
config file '-v' doesn't exist.
Where should I be looking or what'd I miss?
Thanks!
Dave
> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Martin Hepworth
> Sent: Friday, February 18, 2005 11:06 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: MailScanner: Could not analyze message
>
>
> Dave
>
> sorry.....
>
> send the output of
>
> /opt/MailScanner/bin/MailScanner -v
>
> (or whereever MailScanner is installed)
>
> to this list....
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Dave Duffner - PSCGi wrote:
> > Martin,
> >
> > I believe this could be related to RTF settings
> from stuff I'm
> > finding elsewhere, but everything's worth a shot.
> >
> > Forgive my ignorance, but can you define 'drop a
> MailScanner
> > -v to the list' a bit more? That command or doing it with
> the List's
> > address doesn't seem to fly...
> >
> > Dave
> >
> >
> >
> >>-----Original Message-----
> >>From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> >>Behalf Of Martin Hepworth
> >>Sent: Friday, February 18, 2005 10:47 AM
> >>To: MAILSCANNER at JISCMAIL.AC.UK
> >>Subject: Re: MailScanner: Could not analyze message
> >>
> >>
> >>Dave
> >>
> >>can you drop a "MailScanner -v" to the list. I'm wondering
> if one of
> >>the
> >>MIME:: libraries that got updates recently might be causing
> an issue..
> >>
> >>
> >>--
> >>Martin Hepworth
> >>Snr Systems Administrator
> >>Solid State Logic
> >>Tel: +44 (0)1865 842300
> >>
> >>
> >>Dave Duffner - PSCGi wrote:
> >>
> >>>Glenn,
> >>>
> >>> Took a rip at that one, here's the twist:
> >>>
> >>> It could be that software doing it, but I now have
> >>
> >>copies of
> >>
> >>>the List digest traffic that fails to be analyzed the most. If it
> >>>sends 15 copies of the Digest out in small batches so as not to
> >>>overload with mass CC:'ing, 10+ of those pass without
> >>
> >>incident. But
> >>
> >>>1-5 of them will fail as being unable to be analyzed? I
> >>
> >>have the MS
> >>
> >>>children set high enough and nothing sits in queue's long
> enough to
> >>>have these being passed because of overload, so the random part is
> >>>most confusing.
> >>>
> >>> And then we have the fact random inbounds are doing
> >>
> >>the same
> >>
> >>>thing, none of those are digest-mode list traffic. Just random
> >>>incoming e-mail to users. It seems to happen most from Yahoo!
> >>>traffic, but at least 50% of that traffic passes without
> >>
> >>any problems.
> >>
> >>> I checked the headers and content on those that
> >>
> >>pass outbound,
> >>
> >>>they're hot huge by any means and all the header info is intact,
> >>>nothing missing that should cause the failure you mentioned below.
> >>>
> >>> Anyone with any ideas on what could be causing this?
> >>>
> >>> Dave
> >>>
> >>>
> >>>
> >>>
> >>>>-----Original Message-----
> >>>>From: MailScanner mailing list
> >>
> >>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> >>
> >>>>Behalf Of Steen, Glenn
> >>>>Sent: Thursday, February 17, 2005 9:48 AM
> >>>>To: MAILSCANNER at JISCMAIL.AC.UK
> >>>>Subject: Re: MailScanner: Could not analyze message
> >>>>
> >>>>
> >>>>That would be the CantAnalyze (in languages.conf)... Only
> place it
> >>>>seems to fire is in the Explode function, if a MIME
> boundary exists
> >>>>and is equivalent to the empty string (""). Might point a
> >>
> >>fat finger
> >>
> >>>>at the digest creation software?
> >>>>
> >>>>-- Glenn
> >>>>
> >>>>
> >>>>
> >>>>>-----Original Message-----
> >>>>>From: MailScanner mailing list
> >>
> >>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> >>
> >>>>>Behalf Of Dave
> >>>>
> >>>>Duffner - PSCGi
> >>>>
> >>>>
> >>>>>Sent: den 17 februari 2005 15:14
> >>>>>To: MAILSCANNER at JISCMAIL.AC.UK
> >>>>>Subject: MailScanner: Could not analyze message
> >>>>>
> >>>>>
> >>>>>Greetings,
> >>>>>
> >>>>> Still stumped on this one, has anyone else at least
> >>>>
> >>>>seen these
> >>>>
> >>>>
> >>>>>pop up? Or might have a clue where the failures are or
> >>
> >>what logs I
> >>
> >>>>>should be looking in to get a better grip on why this is
> happening?
> >>>>>
> >>>>> We get the following messages encased in the
> virus warning
> >>>>>e-mails MS issues:
> >>>>>
> >>>>> MailScanner: Could not analyze message
> >>>>>
> >>>>> It seems to be most prevalent in Digest-mode email from
> >>>>>several list servers we have using the main server as
> part of the
> >>>>>path. We want the outgoing mail scanned to ensure nothing
> >>>>
> >>>>gets past
> >>>>
> >>>>
> >>>>>in or out, but randomly this pops up.
> >>>>>
> >>>>> We're using MS, ClamAV & Spsmassassin in combo on an
> >>>>>Ensim-based linux setup. Normally it's worked just fine,
> >>>>
> >>>>but within
> >>>>
> >>>>
> >>>>>the last few weeks these started cropping up on outbound
> >>>>
> >>>>messages that
> >>>>
> >>>>
> >>>>>contain digests and inbound messages that seem to contain
> >>>>
> >>>>FWD's from
> >>>>
> >>>>
> >>>>>others to users on our servers. Notable is that it happens
> >>>>
> >>>>quite a bit
> >>>>
> >>>>
> >>>>>to someone using Yahoo that forwards random 'stuff' to
> one of our
> >>>>>users.
> >>>>>
> >>>>> Any clues helpful!
> >>>>>
> >>>>> Dave
> >>>>>
> >>>>>
> >>>>>
> >>>>>--
> >>>>>Message scanned by MailScanner, and is believed to be clean.
> >>>>>CONFIDENTIALITY NOTICE: This transmission intended for the
> >>>>
> >>>>specified
> >>>>
> >>>>
> >>>>>destination and person. If this is not you, this
> >>>>>e-mail must be deleted immediately. www.nwcweb.com
> >>>>>
> >>>>>------------------------ MailScanner list
> >>>>
> >>>>------------------------ To
> >>>>
> >>>>
> >>>>>unsubscribe, email jiscmail at jiscmail.ac.uk with the
> words: 'leave
> >>>>>mailscanner' in the body of the email. Before posting,
> read the MAQ
> >>>>>(http://www.mailscanner.biz/maq/) and the archives
> >>>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>>>
> >>>>>Support MailScanner development - buy the book off the website!
> >>>>>
> >>>>
> >>>>------------------------ MailScanner list
> >>>>------------------------ To unsubscribe, email
> >>
> >>jiscmail at jiscmail.ac.uk
> >>
> >>>>with the words: 'leave mailscanner' in the body of the
> >>
> >>email. Before
> >>
> >>>>posting, read the MAQ
> >>>>(http://www.mailscanner.biz/maq/) and the archives
> >>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>>
> >>>>Support MailScanner development - buy the book off the website!
> >>>>
> >>>>--
> >>>>Message scanned by MailScanner, and is believed to be clean.
> >>>>CONFIDENTIALITY NOTICE: This transmission intended for the
> >>
> >>specified
> >>
> >>>>destination and person. If this is not you, this
> >>>>e-mail must be deleted immediately. www.nwcweb.com
> >>>>
> >>>
> >>>
> >>>
> >>>--
> >>>Message scanned by MailScanner, and is believed to be clean.
> >>>CONFIDENTIALITY NOTICE: This transmission intended for the
> >>
> >>specified
> >>
> >>>destination and person. If this is not you, this
> >>>e-mail must be deleted immediately. www.nwcweb.com
> >>>
> >>>------------------------ MailScanner list
> >>
> >>------------------------ To
> >>
> >>>unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
> >>>mailscanner' in the body of the email. Before posting, read the MAQ
> >>>(http://www.mailscanner.biz/maq/) and the archives
> >>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>
> >>>Support MailScanner development - buy the book off the website!
> >>
> >>************************************************************
> **********
> >>
> >>This email and any files transmitted with it are confidential and
> >>intended solely for the use of the individual or entity to
> whom they
> >>are addressed. If you have received this email in error
> please notify
> >>the system manager.
> >>
> >>This footnote confirms that this email message has been
> swept for the
> >>presence of computer viruses and is believed to be clean.
> >>
> >>************************************************************
> **********
> >>
> >>------------------------ MailScanner list
> >>------------------------ To unsubscribe, email
> jiscmail at jiscmail.ac.uk
> >>with the words: 'leave mailscanner' in the body of the
> email. Before
> >>posting, read the MAQ
> >>(http://www.mailscanner.biz/maq/) and the archives
> >>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>
> >>Support MailScanner development - buy the book off the website!
> >>
> >>--
> >>Message scanned by MailScanner, and is believed to be clean.
> >>CONFIDENTIALITY NOTICE: This transmission intended for the
> specified
> >>destination and person. If this is not you, this
> >>e-mail must be deleted immediately. www.nwcweb.com
> >>
> >
> >
> >
> > --
> > Message scanned by MailScanner, and is believed to be clean.
> > CONFIDENTIALITY NOTICE: This transmission intended for the
> specified
> > destination and person. If this is not you, this
> > e-mail must be deleted immediately. www.nwcweb.com
> >
> > ------------------------ MailScanner list
> ------------------------ To
> > unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
> > mailscanner' in the body of the email. Before posting, read the MAQ
> > (http://www.mailscanner.biz/maq/) and the archives
> > (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential
> and intended solely for the use of the individual or entity
> to whom they are addressed. If you have received this email
> in error please notify the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail at jiscmail.ac.uk with the words: 'leave mailscanner'
> in the body of the email. Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> --
> Message scanned by MailScanner, and is believed to be clean.
> CONFIDENTIALITY NOTICE: This transmission intended for the
> specified destination and person. If this is not you, this
> e-mail must be deleted immediately. www.nwcweb.com
>
--
Message scanned by MailScanner, and is believed to be clean.
CONFIDENTIALITY NOTICE: This transmission intended for the
specified destination and person. If this is not you, this
e-mail must be deleted immediately. www.nwcweb.com
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner
mailing list