Problem with MailScanner, postfix and corrupt mails

[Steen, Glenn]

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Robert Waldner
> Sent: den 7 mars 2005 13:51
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Problem with MailScanner, postfix and corrupt mails
> 
> 
> 
> Hi!
> 
> On two boxen, I constantly have mails which are, apparingly, 
> damaged by
>  MailScanner so that postfix, after picking them up again, quarantines
>  them into its "corrupt"-folder.
> 
> When I `postcat` such a damaged mail, I invariably see the same
>  pattern, which I think is best explained by an example:
> 
> .-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.
> message_size:            9158             317               2 
>               0
> message_arrival_time: Mon Nov 15 22:28:40 2004
> sender: sender at domain
> named_attribute: client_name=mail.gmx.de
> named_attribute: client_address=213.165.64.20
> named_attribute: message_origin=mail.gmx.de[213.165.64.20]
> named_attribute: helo_name=mail.gmx.net
> named_attribute: protocol_name=SMTP
> warning_message_time: Tue Nov 16 02:28:40 2004
> original_recipient: user at domain
> recipient: user at domain
> *** MESSAGE CONTENTS 4C80A7375E ***
> Received: from mail.gmx.net (mail.gmx.de [213.165.64.20])
> ...
> <Received:- and other headers>
> 
> message_size:               0               0               0 
>               0
> message_arrival_time: Mon Nov 15 22:28:40 2004
> sender: sender at domain
> named_attribute: client_name=mail.gmx.de
> named_attribute: client_address=213.165.64.20
> named_attribute: message_origin=mail.gmx.de[213.165.64.20]
> original_recipient: user at domain
> recipient: user at domain
> *** MESSAGE CONTENTS 4C80A7375E ***
> Received: from mail.gmx.net (mail.gmx.de [213.165.64.20])
> ...
> <all the various headers again, plus the actual message content this
>  time>
> 
> X-host-MailScanner: Did not find any virus
> X-host-MailScanner-SpamCheck: not spam,
>         SpamAssassin (Wertung=0.108, benoetigt 5, AWL 0.00...)
> X-MailScanner-From: sender at domain
> 
> <message content (no headers), again>
> .-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.
> 
> So, the pattern is
>  postfix-headers
>  *** MESSAGE CONTENTS queue-id ***
>  normal mail-headers
>  postfix-headers
>  *** MESSAGE CONTENTS queue-id ***
>  normail mail-headers
>  mail content
>  MailScanner-headers
>  mail-contents again
> 
> Both boxen are i386 and run Debian Sarge, MailScanner 4.38.10-1/
>  postfix 2.1.5-6 on one, 4.35.3-1/2.1.5-0 on the other. I don't see
>  this happening on another box, which runs 4.37.7-1/2.1.5-5, but on
>  sun4u instead of i386.
> 
> Any hints? The only thing I could google up was filesystem corruption,
>  which I'm pretty sure I can rule out here. Judging from the position
>  of the MailScanner headers, I'd guess it's MailScanner screwing up
>  somehow, but since I don't know, I ask ;)

Hm, the only time I've seen corrupt messages is when I've experienced
machine failures (had a "bad kernel" situation a while back that made
those ... frequent:-)... Until today, when I had one "unforced". Didn't
analyze it more than to see that it was a spam, so unfortunately I
deleted it. Will be sure to look more closely on this.

Could you determine anything more these corrupt queue files have in
common?

Oh and BTW, you do run a one queue setup, right?

-- Glenn

> 
> cheers+TIA,
> &rw
> --
> -- A sendmail / by any other name
> -- Would still / HELO just.as.swe.et
> --                            - Greg
> 
> 
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!