Mails do slip through MS..

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Check your file locking. What version of Sendmail are you using, and on
what version of what OS on what architecture?

Marcel Blenkers wrote:

>Hi there,
>
>somehow some mails do slip through, but in the logfiles it seems that MS
>scannes them.
>
>But then SpamAssassin reports these Mails as spam or some virusscanners on
>the client-side report these mails to be infected.
>
>After checking those mails, and look through the Mail-Log, all i found was
>this:
>
>Jan 18 01:15:32 mail sendmail-in[24308]: j0I0FUBP024308:
>from=<fwv at toppowerproduct.info>, size=1491, class=0, nrcpts=1,
>msgid=<D95D7316.C78051E at toppowerproduct.info>, proto=SMTP, daemon=MTA,
>relay=28.255-0.172.63.66.in-addr.arpa [66.63.172.28] (may be forged)
>Jan 18 01:15:33 mail MailScanner[22054]: New Batch: Scanning 1 messages,
>2043 bytes
>Jan 18 01:15:33 mail MailScanner[22054]: Spam Checks: Starting
>Jan 18 01:15:36 mail MailScanner[22054]: Virus and Content Scanning:
>Starting
>Jan 18 01:15:37 mail MailScanner[22054]: Uninfected: Delivered 1 messages
>Jan 18 01:15:37 mail MailScanner[22054]: MailScanner child dying of old
>age
>Jan 18 01:15:37 mail MailScanner[24333]: MailScanner E-Mail Virus Scanner
>version 4.37.7 starting...
>Jan 18 01:15:41 mail MailScanner[24333]: Using locktype = posix
>Jan 18 01:15:41 mail MailScanner[24333]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type)
>
>
>it seems that MS says in the log it is checking the mail, but the mail
>does not contain the MS-Headers.
>After checking against other not scanned mails, this only happens if the
>mail was received as MS dies of "old age".
>
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!