4.39.3-1 bug or is it me - what MailScanner "debug" shows
Quentin Campbell
Q.G.Campbell at NEWCASTLE.AC.UK
Fri Feb 25 08:56:12 GMT 2005
Julian
I will let you know in a minute when I can access the system.
However nothing has changed on the system except updating to MS
4.39.3-1. The previous 4.38.9-? Version worked OK with whatever
Archive::ZIP I have.
Are there changes in 4.38.3-1 which make it sensitive to the version of
Archive::Zip?
Quentin
---
PHONE: +44 191 222 8209 Information Systems and Services (ISS),
University of Newcastle,
Newcastle upon Tyne,
FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."
>-----Original Message-----
>From: MailScanner mailing list
>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 25 February 2005 08:46
>To: MAILSCANNER at JISCMAIL.AC.UK
>Subject: Re: 4.39.3-1 bug or is it me - what MailScanner "debug" shows
>
>What version of Archive::Zip do you have?
>The zip file in the attachment is missing it's "End Of Central
>Directory" marker, but my system carries on anyway and successfully
>scans the message. Your's is abandoning the attachment extraction at
>that point.
>
>I have version 1.13 installed.
>
>Quentin Campbell wrote:
>
>>Julian
>>
>>The file are available via anonymous FTP at
>>ftp://ftp.ncl.ac.uk/pub/users/nqgc.
>>
>>The two files as you will see are the Sendmail qf & df parts of the
>>message.
>>
>>Quentin
>>---
>>PHONE: +44 191 222 8209 Information Systems and Services (ISS),
>> University of Newcastle,
>> Newcastle upon Tyne,
>>FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
>>--------------------------------------------------------------
>----------
>>"Any opinion expressed above is mine. The University can get its own."
>>
>>
>>
>>>-----Original Message-----
>>>From: MailScanner mailing list
>>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Julian Field
>>>Sent: 24 February 2005 13:56
>>>To: MAILSCANNER at JISCMAIL.AC.UK
>>>Subject: Re: 4.39.3-1 bug or is it me - what MailScanner
>"debug" shows
>>>
>>>Can I get remote access to this system to try to debug it? Or
>>>can you at
>>>least put a message that causes the problem on the web
>somewhere I can
>>>get it, so I can try it out for myself?
>>>
>>>Quentin Campbell wrote:
>>>
>>>
>>>
>>>>Julian
>>>>
>>>>Please ignore my last message. The one hard piece of
>>>>
>>>>
>>>information I have
>>>
>>>
>>>>is from when I run 4.39.3-1 in "debug" mode. It is repeatable.
>>>>
>>>>It picks up the first message in "mqueue.in" which happens
>to be both
>>>>spam and carrying a virus. It writes out quite a bit of the normal
>>>>MailScanner logging information to syslog then stops after
>issuing the
>>>>following message to console:
>>>>
>>>>Can't call method "print" on an undefined value at
>>>>/usr/lib/perl5/site_perl/5.8.0/MIME/Entity.pm line 1803.
>>>>
>>>>At that point in Entity.pm it appears to be trying to print
>>>>
>>>>
>>>the body of
>>>
>>>
>>>>a message to "OUTSTREAM" [?] for a MIME 'multipart' type.
>>>>
>>>>I cannot tell if this is the cause of the problem or a
>consequence of
>>>>it!
>>>>
>>>>Quentin
>>>>---
>>>>PHONE: +44 191 222 8209 Information Systems and Services (ISS),
>>>> University of Newcastle,
>>>> Newcastle upon Tyne,
>>>>FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
>>>>--------------------------------------------------------------
>>>>
>>>>
>>>----------
>>>
>>>
>>>>"Any opinion expressed above is mine. The University can
>get its own."
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>>-----Original Message-----
>>>>>From: MailScanner mailing list
>>>>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Quentin Campbell
>>>>>Sent: 24 February 2005 10:29
>>>>>To: MAILSCANNER at JISCMAIL.AC.UK
>>>>>Subject: Re: 4.39.3-1 bug or is it me?
>>>>>
>>>>>Julian
>>>>>
>>>>>In the case of spam the usual action is taken, namely to
>deliver the
>>>>>tagged message as an attachment. That is happening OK and
>for this to
>>>>>work the ~reports/en/inline.spam.warning.txt file must be
>>>>>
>>>>>
>>>readable. It
>>>
>>>
>>>>>clearly is.
>>>>>
>>>>>However it appears that after the message is delivered I get a
>>>>>"MailScanner child dying of old age" message logged.
>>>>>
>>>>>The problem with the "Cannot open message file , No such file or
>>>>>directory" error is only apparent when a virus is
>detected. It seems
>>>>>that MS goes as far as sending the virus notification to the
>>>>>"Notices To
>>>>>=" address but then the failure occurs.
>>>>>
>>>>>Looking at MessageBatch.pm it is as if there is a failure
>return from
>>>>>the attempt to post the notice but the failure message
>>>>>
>>>>>
>>>cannot be logged
>>>
>>>
>>>>>and execution fails at that point.
>>>>>
>>>>>Looking at the code excerpt from MessageBatch.pm below I
>>>>>
>>>>>
>>>note that I am
>>>
>>>
>>>>>not seeing in the logs the "Could not notify postmaster from
>>>>>
>>>>>
>>>..." text
>>>
>>>
>>>>>that I should get if the attempt to post fails and returns an error
>>>>>number in $!.
>>>>>
>>>>>Nor am I seeing the "Notices: Warned about <number>
>messages ...". I
>>>>>would expect to see immediately after the posting of the notice.
>>>>>
>>>>>The behaviours in the case of both spam delivery and when a
>>>>>virus notice
>>>>>is delivered to the "Notices To =" address suggests that MS is
>>>>>getting a
>>>>>failure from an attempt to post a message and the code that
>>>>>handles that
>>>>>posting is not returning to the caller.
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>From Message.Batch.pm
>>>>
>>>>
>>>>
>>>>
>>>>>...
>>>>>while(($postie,$notice) = each %notices) {
>>>>> $email = $headers{$postie} . "\n" .
>>>>> #MailScanner::Config::LanguageValue($message,
>'noticeheading') .
>>>>>":\n" .
>>>>> #$notices{$postie} . "\n" . $signatures{$postie} . "\n";
>>>>> MailScanner::Config::LanguageValue($message,
>>>>>
>>>>>
>>>'noticeprefix') . ":
>>>
>>>
>>>>>" .
>>>>> $reasons . "\n" . $notices{$postie} . "\n" .
>>>>>
>>>>>
>>>$signatures{$postie}
>>>
>>>
>>>>>. "\n";
>>>>>
>>>>> $global::MS->{mta}->SendMessageString(undef, $email, $postie) or
>>>>> MailScanner::Log::WarnLog("Could not notify postmaster from
>>>>>$postie, %s",
>>>>> $!);
>>>>>}
>>>>>
>>>>>MailScanner::Log::InfoLog("Notices: Warned about %d messages",
>>>>>$counter)
>>>>> if $counter;
>>>>>}
>>>>>
>>>>>
>>>>>
>>>>>Quentin
>>>>>--
>>>>>PHONE: +44 191 222 8209 Information Systems and Services (ISS),
>>>>> University of Newcastle,
>>>>> Newcastle upon Tyne,
>>>>>FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
>>>>>---------------------------------------------------------------
>>>>>---------
>>>>>"Any opinion expressed above is mine. The University can get
>>>>>its own."
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>>-----Original Message-----
>>>>>>From: MailScanner mailing list
>>>>>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Julian Field
>>>>>>Sent: 23 February 2005 16:35
>>>>>>To: MAILSCANNER at JISCMAIL.AC.UK
>>>>>>Subject: Re: 4.39.3-1 bug or is it me?
>>>>>>
>>>>>>In other words neither of us have the faintest clue as to
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>what could be
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>>going wrong here.
>>>>>>:-(
>>>>>>
>>>>>>Quentin Campbell wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>>>-----Original Message-----
>>>>>>>>From: MailScanner mailing list
>>>>>>>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Julian Field
>>>>>>>>Sent: 23 February 2005 14:21
>>>>>>>>To: MAILSCANNER at JISCMAIL.AC.UK
>>>>>>>>Subject: Re: 4.39.3-1 bug or is it me?
>>>>>>>>
>>>>>>>>Can you compare the configs. It is apparently failing to get
>>>>>>>>the message filenames altogether. No-one else has seen this
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>problem :-(
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>Julian
>>>>>>>
>>>>>>>I have carefully checked lists of files from ~reports/en
>>>>>>>
>>>>>>>
>>>and ~/rules
>>>
>>>
>>>>>>>against the pre-4.39.3-1 lists of files from those same
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>sub-directories.
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>>They are all accounted for and have the same names - this
>>>>>>>
>>>>>>>
>>>was checked
>>>
>>>
>>>>>>>with "diff" run against sorted lists of files.
>>>>>>>
>>>>>>>I have also used "diff" to compare the 4.39.3-1
>>>>>>>
>>>>>>>
>>>MailScanner.conf file
>>>
>>>
>>>>>>>against the previous version (4.38.9-1). They are the same
>>>>>>>
>>>>>>>
>>>except for
>>>
>>>
>>>>>>>the additional lines you have added since 4.38.9-1 and the
>>>>>>>
>>>>>>>
>>>different
>>>
>>>
>>>>>>>Version Number.
>>>>>>>
>>>>>>>Quentin
>>>>>>>
>>>>>>>------------------------ MailScanner list
>------------------------
>>>>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>>>>'leave mailscanner' in the body of the email.
>>>>>>>Before posting, read the MAQ
>(http://www.mailscanner.biz/maq/) and
>>>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>>>>
>>>>>>>Support MailScanner development - buy the book off the website!
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>--
>>>>>>Julian Field
>>>>>>www.MailScanner.info
>>>>>>Buy the MailScanner book at www.MailScanner.info/store
>>>>>>
>>>>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>>>>
>>>>>>------------------------ MailScanner list ------------------------
>>>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>>>'leave mailscanner' in the body of the email.
>>>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>>>
>>>>>>Support MailScanner development - buy the book off the website!
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>------------------------ MailScanner list ------------------------
>>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>>'leave mailscanner' in the body of the email.
>>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>>
>>>>>Support MailScanner development - buy the book off the website!
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>Support MailScanner development - buy the book off the website!
>>>>
>>>>
>>>>
>>>>
>>>>
>>>--
>>>Julian Field
>>>www.MailScanner.info
>>>Buy the MailScanner book at www.MailScanner.info/store
>>>
>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>>
>>>
>>>
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>
>>
>
>--
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner
mailing list