MailScanner: Could not analyze message

Dave Duffner - PSCGi webalizer at NWCWEB.COM
Fri Feb 18 18:19:41 GMT 2005


Martin,

        I've found MS all over the place, running it is not the
problem.  But running 'MailScanner -v' constantly produces
the error:

Cannot open config file -v, No such file or dir at ..../Config.pm line 400

        Is the syntax correct on this?  I can't find references
offhand on how to use the -v option and if I'm doing that
properly to get the report that'd give clues we're after
here.

        Thanks!

        Dave


> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Martin Hepworth
> Sent: Friday, February 18, 2005 12:18 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: MailScanner: Could not analyze message
>
>
> Dave
>
> you should be able to figure it out from either 'locate
> MailScanner' or at worst look in the start rc file for MailScanner.
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Dave Duffner - PSCGi wrote:
> > Martin,
> >
> >         Not a problem...
> >
> >         We're working with servers loaded with RH Linux
> Fedora Core 1
> > and Ensim Pro OS'es so I think I'm after a different point
> to execute
> > that command.  There is no /opt dir or even
> /usr/bin/MailScanner dir
> > to fire it from.  Doing so as a command returns the error
> that config
> > file '-v' doesn't exist.
> >
> >         Where should I be looking or what'd I miss?
> >
> >         Thanks!
> >
> >         Dave
> >
> >
> >
> >>-----Original Message-----
> >>From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> >>Behalf Of Martin Hepworth
> >>Sent: Friday, February 18, 2005 11:06 AM
> >>To: MAILSCANNER at JISCMAIL.AC.UK
> >>Subject: Re: MailScanner: Could not analyze message
> >>
> >>
> >>Dave
> >>
> >>sorry.....
> >>
> >>send the output of
> >>
> >>/opt/MailScanner/bin/MailScanner -v
> >>
> >>(or whereever MailScanner is installed)
> >>
> >>to this list....
> >>
> >>--
> >>Martin Hepworth
> >>Snr Systems Administrator
> >>Solid State Logic
> >>Tel: +44 (0)1865 842300
> >>
> >>
> >>Dave Duffner - PSCGi wrote:
> >>
> >>>Martin,
> >>>
> >>>        I believe this could be related to RTF settings
> >>
> >>from stuff I'm
> >>
> >>>finding elsewhere, but everything's worth a shot.
> >>>
> >>>        Forgive my ignorance, but can you define 'drop a
> >>
> >>MailScanner
> >>
> >>>-v to the list' a bit more?  That command or doing it with
> >>
> >>the List's
> >>
> >>>address doesn't seem to fly...
> >>>
> >>>        Dave
> >>>
> >>>
> >>>
> >>>
> >>>>-----Original Message-----
> >>>>From: MailScanner mailing list
> >>
> >>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> >>
> >>>>Behalf Of Martin Hepworth
> >>>>Sent: Friday, February 18, 2005 10:47 AM
> >>>>To: MAILSCANNER at JISCMAIL.AC.UK
> >>>>Subject: Re: MailScanner: Could not analyze message
> >>>>
> >>>>
> >>>>Dave
> >>>>
> >>>>can you drop a "MailScanner -v" to the list. I'm wondering
> >>
> >>if one of
> >>
> >>>>the
> >>>>MIME:: libraries that got updates recently might be causing
> >>
> >>an issue..
> >>
> >>>>
> >>>>--
> >>>>Martin Hepworth
> >>>>Snr Systems Administrator
> >>>>Solid State Logic
> >>>>Tel: +44 (0)1865 842300
> >>>>
> >>>>
> >>>>Dave Duffner - PSCGi wrote:
> >>>>
> >>>>
> >>>>>Glenn,
> >>>>>
> >>>>>       Took a rip at that one, here's the twist:
> >>>>>
> >>>>>       It could be that software doing it, but I now have
> >>>>
> >>>>copies of
> >>>>
> >>>>
> >>>>>the List digest traffic that fails to be analyzed the
> most.  If it
> >>>>>sends 15 copies of the Digest out in small batches so as not to
> >>>>>overload with mass CC:'ing, 10+ of those pass without
> >>>>
> >>>>incident.  But
> >>>>
> >>>>
> >>>>>1-5 of them will fail as being unable to be analyzed?  I
> >>>>
> >>>>have the MS
> >>>>
> >>>>
> >>>>>children set high enough and nothing sits in queue's long
> >>
> >>enough to
> >>
> >>>>>have these being passed because of overload, so the
> random part is
> >>>>>most confusing.
> >>>>>
> >>>>>       And then we have the fact random inbounds are doing
> >>>>
> >>>>the same
> >>>>
> >>>>
> >>>>>thing, none of those are digest-mode list traffic. Just random
> >>>>>incoming e-mail to users.  It seems to happen most from Yahoo!
> >>>>>traffic, but at least 50% of that traffic passes without
> >>>>
> >>>>any problems.
> >>>>
> >>>>
> >>>>>       I checked the headers and content on those that
> >>>>
> >>>>pass outbound,
> >>>>
> >>>>
> >>>>>they're hot huge by any means and all the header info is intact,
> >>>>>nothing missing that should cause the failure you
> mentioned below.
> >>>>>
> >>>>>       Anyone with any ideas on what could be causing this?
> >>>>>
> >>>>>       Dave
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>>-----Original Message-----
> >>>>>>From: MailScanner mailing list
> >>>>
> >>>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> >>>>
> >>>>
> >>>>>>Behalf Of Steen, Glenn
> >>>>>>Sent: Thursday, February 17, 2005 9:48 AM
> >>>>>>To: MAILSCANNER at JISCMAIL.AC.UK
> >>>>>>Subject: Re: MailScanner: Could not analyze message
> >>>>>>
> >>>>>>
> >>>>>>That would be the CantAnalyze (in languages.conf)... Only
> >>
> >>place it
> >>
> >>>>>>seems to fire is in the Explode function, if a MIME
> >>
> >>boundary exists
> >>
> >>>>>>and is equivalent to the empty string (""). Might point a
> >>>>
> >>>>fat finger
> >>>>
> >>>>
> >>>>>>at the digest creation software?
> >>>>>>
> >>>>>>-- Glenn
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>-----Original Message-----
> >>>>>>>From: MailScanner mailing list
> >>>>
> >>>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> >>>>
> >>>>
> >>>>>>>Behalf Of Dave
> >>>>>>
> >>>>>>Duffner - PSCGi
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>Sent: den 17 februari 2005 15:14
> >>>>>>>To: MAILSCANNER at JISCMAIL.AC.UK
> >>>>>>>Subject: MailScanner: Could not analyze message
> >>>>>>>
> >>>>>>>
> >>>>>>>Greetings,
> >>>>>>>
> >>>>>>>      Still stumped on this one, has anyone else at least
> >>>>>>
> >>>>>>seen these
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>pop up?  Or might have a clue where the failures are or
> >>>>
> >>>>what logs I
> >>>>
> >>>>
> >>>>>>>should be looking in to get a better grip on why this is
> >>
> >>happening?
> >>
> >>>>>>>      We get the following messages encased in the
> >>
> >>virus warning
> >>
> >>>>>>>e-mails MS issues:
> >>>>>>>
> >>>>>>>      MailScanner: Could not analyze message
> >>>>>>>
> >>>>>>>      It seems to be most prevalent in Digest-mode email from
> >>>>>>>several list servers we have using the main server as
> >>
> >>part of the
> >>
> >>>>>>>path.  We want the outgoing mail scanned to ensure nothing
> >>>>>>
> >>>>>>gets past
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>in or out, but randomly this pops up.
> >>>>>>>
> >>>>>>>      We're using MS, ClamAV & Spsmassassin in combo on an
> >>>>>>>Ensim-based linux setup.  Normally it's worked just fine,
> >>>>>>
> >>>>>>but within
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>the last few weeks these started cropping up on outbound
> >>>>>>
> >>>>>>messages that
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>contain digests and inbound messages that seem to contain
> >>>>>>
> >>>>>>FWD's from
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>others to users on our servers. Notable is that it happens
> >>>>>>
> >>>>>>quite a bit
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>to someone using Yahoo that forwards random 'stuff' to
> >>
> >>one of our
> >>
> >>>>>>>users.
> >>>>>>>
> >>>>>>>      Any clues helpful!
> >>>>>>>
> >>>>>>>      Dave
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>--
> >>>>>>>Message scanned by MailScanner, and is believed to be clean.
> >>>>>>>CONFIDENTIALITY NOTICE:  This transmission intended for the
> >>>>>>
> >>>>>>specified
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>destination and person.  If this is not you, this
> >>>>>>>e-mail must be deleted immediately.     www.nwcweb.com
> >>>>>>>
> >>>>>>>------------------------ MailScanner list
> >>>>>>
> >>>>>>------------------------ To
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>unsubscribe, email jiscmail at jiscmail.ac.uk with the
> >>
> >>words: 'leave
> >>
> >>>>>>>mailscanner' in the body of the email. Before posting,
> >>
> >>read the MAQ
> >>
> >>>>>>>(http://www.mailscanner.biz/maq/) and the archives
> >>>>>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>>>>>
> >>>>>>>Support MailScanner development - buy the book off the website!
> >>>>>>>
> >>>>>>
> >>>>>>------------------------ MailScanner list
> >>>>>>------------------------ To unsubscribe, email
> >>>>
> >>>>jiscmail at jiscmail.ac.uk
> >>>>
> >>>>
> >>>>>>with the words: 'leave mailscanner' in the body of the
> >>>>
> >>>>email. Before
> >>>>
> >>>>
> >>>>>>posting, read the MAQ
> >>>>>>(http://www.mailscanner.biz/maq/) and the archives
> >>>>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>>>>
> >>>>>>Support MailScanner development - buy the book off the website!
> >>>>>>
> >>>>>>--
> >>>>>>Message scanned by MailScanner, and is believed to be clean.
> >>>>>>CONFIDENTIALITY NOTICE:  This transmission intended for the
> >>>>
> >>>>specified
> >>>>
> >>>>
> >>>>>>destination and person.  If this is not you, this
> >>>>>>e-mail must be deleted immediately.     www.nwcweb.com
> >>>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>--
> >>>>>Message scanned by MailScanner, and is believed to be clean.
> >>>>>CONFIDENTIALITY NOTICE:  This transmission intended for the
> >>>>
> >>>>specified
> >>>>
> >>>>
> >>>>>destination and person.  If this is not you, this
> >>>>>e-mail must be deleted immediately.     www.nwcweb.com
> >>>>>
> >>>>>------------------------ MailScanner list
> >>>>
> >>>>------------------------ To
> >>>>
> >>>>
> >>>>>unsubscribe, email jiscmail at jiscmail.ac.uk with the
> words: 'leave
> >>>>>mailscanner' in the body of the email. Before posting,
> read the MAQ
> >>>>>(http://www.mailscanner.biz/maq/) and the archives
> >>>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>>>
> >>>>>Support MailScanner development - buy the book off the website!
> >>>>
> >>>>************************************************************
> >>
> >>**********
> >>
> >>>>This email and any files transmitted with it are confidential and
> >>>>intended solely for the use of the individual or entity to
> >>
> >>whom they
> >>
> >>>>are addressed. If you have received this email in error
> >>
> >>please notify
> >>
> >>>>the system manager.
> >>>>
> >>>>This footnote confirms that this email message has been
> >>
> >>swept for the
> >>
> >>>>presence of computer viruses and is believed to be clean.
> >>>>
> >>>>************************************************************
> >>
> >>**********
> >>
> >>>>------------------------ MailScanner list
> >>>>------------------------ To unsubscribe, email
> >>
> >>jiscmail at jiscmail.ac.uk
> >>
> >>>>with the words: 'leave mailscanner' in the body of the
> >>
> >>email. Before
> >>
> >>>>posting, read the MAQ
> >>>>(http://www.mailscanner.biz/maq/) and the archives
> >>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>>
> >>>>Support MailScanner development - buy the book off the website!
> >>>>
> >>>>--
> >>>>Message scanned by MailScanner, and is believed to be clean.
> >>>>CONFIDENTIALITY NOTICE:  This transmission intended for the
> >>
> >>specified
> >>
> >>>>destination and person.  If this is not you, this
> >>>>e-mail must be deleted immediately.     www.nwcweb.com
> >>>>
> >>>
> >>>
> >>>
> >>>--
> >>>Message scanned by MailScanner, and is believed to be clean.
> >>>CONFIDENTIALITY NOTICE:  This transmission intended for the
> >>
> >>specified
> >>
> >>>destination and person.  If this is not you, this
> >>>e-mail must be deleted immediately.     www.nwcweb.com
> >>>
> >>>------------------------ MailScanner list
> >>
> >>------------------------ To
> >>
> >>>unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
> >>>mailscanner' in the body of the email. Before posting, read the MAQ
> >>>(http://www.mailscanner.biz/maq/) and the archives
> >>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>>
> >>>Support MailScanner development - buy the book off the website!
> >>
> >>************************************************************
> **********
> >>
> >>This email and any files transmitted with it are confidential and
> >>intended solely for the use of the individual or entity to
> whom they
> >>are addressed. If you have received this email in error
> please notify
> >>the system manager.
> >>
> >>This footnote confirms that this email message has been
> swept for the
> >>presence of computer viruses and is believed to be clean.
> >>
> >>************************************************************
> **********
> >>
> >>------------------------ MailScanner list
> >>------------------------ To unsubscribe, email
> jiscmail at jiscmail.ac.uk
> >>with the words: 'leave mailscanner' in the body of the
> email. Before
> >>posting, read the MAQ
> >>(http://www.mailscanner.biz/maq/) and the archives
> >>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>
> >>Support MailScanner development - buy the book off the website!
> >>
> >>--
> >>Message scanned by MailScanner, and is believed to be clean.
> >>CONFIDENTIALITY NOTICE:  This transmission intended for the
> specified
> >>destination and person.  If this is not you, this
> >>e-mail must be deleted immediately.     www.nwcweb.com
> >>
> >
> >
> >
> > --
> > Message scanned by MailScanner, and is believed to be clean.
> > CONFIDENTIALITY NOTICE:  This transmission intended for the
> specified
> > destination and person.  If this is not you, this
> > e-mail must be deleted immediately.     www.nwcweb.com
> >
> > ------------------------ MailScanner list
> ------------------------ To
> > unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
> > mailscanner' in the body of the email. Before posting, read the MAQ
> > (http://www.mailscanner.biz/maq/) and the archives
> > (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential
> and intended solely for the use of the individual or entity
> to whom they are addressed. If you have received this email
> in error please notify the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail at jiscmail.ac.uk with the words: 'leave mailscanner'
> in the body of the email. Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> --
> Message scanned by MailScanner, and is believed to be clean.
> CONFIDENTIALITY NOTICE:  This transmission intended for the
> specified destination and person.  If this is not you, this
> e-mail must be deleted immediately.     www.nwcweb.com
>


--
Message scanned by MailScanner, and is believed to be clean.
CONFIDENTIALITY NOTICE:  This transmission intended for the
specified destination and person.  If this is not you, this
e-mail must be deleted immediately.     www.nwcweb.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!




More information about the MailScanner mailing list