No Longer Fnishes Scans - Resolved

[Martin Hepworth]

Pete

1st thing, make sure you RDJ is up to date!!!

TRUSTED_RULESETS="TRIPWIRE EVILNUMBERS EVILNUMBERS1 EVILNUMBERS2 SARE_RANDOM
RANDOMVAL BOGUSVIRUS SARE_ADULT SARE_BML SARE_URI0 SARE_URI1 SARE_URI3
SARE_URI_ENG SARE_SPOOF SARE_BAYES_POISON_NXM SARE_OEM SARE_RANDOM
SARE_HEADER0 SARE_HEADER2 SARE_CODING SARE_SPECIFIC SARE_REDIRECT_POST300
SARE_GENLSUBJ SARE_UNSUB SARE_OBFU SARE_OBFU2 SARE_OBFU3 SARE_WHITELIST
SARE_WHITELIST_SPF SARE_WHITELIST_RCVDZMI_GERMAN FVGT_meta FVGT_body
FVGT_headers FVGT_rawbody FVGT_subject FVGT_uri JG_badhosts JG_body JG_from
JG_german JG_header JG_nazi JG_rawbody JG_subject JG_to SARE_STOCKS";

The JG ones are ones I load extra and aren't in the standard RDJ
config....for the FVGT configs see the RDJ web site ...


--
Martin Hepworth 
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> bounces at lists.mailscanner.info] On Behalf Of Pete Russell
> Sent: 02 March 2006 11:47
> To: MailScanner discussion
> Subject: Re: No Longer Fnishes Scans - Resolved
> 
> Thanks - any chance you could share you list of trusted rulesets with
> me? assuming yours is maintained and up to date?
> 
> ThanksPete
> 
> TRUSTED_RULESETS="TRIPWIRE SARE_EVILNUMBERS0 SARE_EVILNUMBERS1
> SARE_EVILNUMBERS2 SARE_BML SARE_OEM SARE_HEADER SARE_HTML0 SARE_RANDOM
> SARE_REDIRECT_POST300 SARE_FRAUD BOGUSVIRUS SARE_BAYES_POISON_NXM
> SARE_ADULT SARE_SPOOF SARE_SPECIFIC SARE_UNSUB SARE_URI0 SARE_URI1
> SARE_OBFU0 SARE_GENLSUBJ0 ZMI_GERMAN"
> 
> 
> Martin Hepworth wrote:
> > Pete
> >
> > The blacklist SA rule has been retired for many many moons. The URI-
> RBL's
> > are the replacement for this...
> >
> > --
> > Martin Hepworth
> > Snr Systems Administrator
> > Solid State Logic
> > Tel: +44 (0)1865 842300
> >
> >
> >>-----Original Message-----
> >>From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> >>bounces at lists.mailscanner.info] On Behalf Of Pete Russell
> >>Sent: 02 March 2006 11:18
> >>To: MailScanner discussion
> >>Subject: Re: No Longer Fnishes Scans - Resolved
> >>
> >>It was caused by a rule from rulesdujour called Blacklist - it had a
> >>grown to a crazy size, deleted and retried and all was well :)
> >>
> >>
> >>Pete Russell wrote:
> >>
> >>>For some reason today, without any inereference MailScanner startred
> >>>accepted new mail but none would ever be delivered and after MS
> restarts
> >>>we would see the be;loe logs. Anyone got any ideas on how to get mail
> >>>moving again?
> >>>
> >>>I changed Use Spamassassin to no and it continues to use SpamAssassin -
> >>>so i have left the MS service stopped and fallen back to anothyer
> server
> >>>- but this is not ideal
> >>>
> >>>Appreciate ANY suggestions
> >>>Pete
> >>>
> >>>Mar  2 18:36:09 car-mbus-sw1 MailScanner[2775]: Using locktype = flock
> >>>Mar  2 18:36:10 car-mbus-sw1 MailScanner[2775]: New Batch: Found 133
> >>>messages waiting
> >>>Mar  2 18:36:10 car-mbus-sw1 MailScanner[2775]: New Batch: Scanning 30
> >>>messages, 151525 bytes
> >>>Mar  2 18:36:10 car-mbus-sw1 MailScanner[2775]: Spam Checks: Starting
> >>>Mar  2 18:36:13 car-mbus-sw1 MailScanner[2786]: Using locktype = flock
> >>>Mar  2 18:36:13 car-mbus-sw1 MailScanner[2786]: New Batch: Found 133
> >>>messages waiting
> >>>Mar  2 18:36:13 car-mbus-sw1 MailScanner[2786]: New Batch: Scanning 30
> >>>messages, 5408558 bytes
> >>>Mar  2 18:36:13 car-mbus-sw1 MailScanner[2786]: Spam Checks: Starting
> >>>Mar  2 18:36:24 car-mbus-sw1 MailScanner[2780]: Using locktype = flock
> >>>Mar  2 18:36:24 car-mbus-sw1 MailScanner[2780]: New Batch: Found 133
> >>>messages waiting
> >>>Mar  2 18:36:24 car-mbus-sw1 MailScanner[2780]: New Batch: Scanning 13
> >>>messages, 140946 bytes
> >>>
> >>>
> >>>In the LINT test i see - so i found the rule and remmed it out of the
> >>>local.cf
> >>>
> >>>4200] dbg: config: adding redirector regex:
> >>>m'^https?:/*(?:[^/]+\.)?emf\d\.com/r\.cfm.*?&r=(.*)'i 0.00038
> >>>[4200] warn: config: warning: description exists for non-existent rule
> >>>ONTIME_HOSTING, 33.38069
> >>>
> >>>After that i retest and find
> >>>
> >>>[4609] dbg: config: adding redirector regex:
> >>>m'^https?:/*(?:[^/]+\.)?emf\d\.com/r\.cfm.*?&r=(.*)'i 0.00067
> >>>[4609] dbg: plugin:
> >>>Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0xa83c010) implements
> >>>'finish_parsing_end' 54.86721
> >>>
> >>>
> >>>Any ideas what would cause this and any suggestions on whatr to try
> >>
> >>next?
> >>--
> >>MailScanner mailing list
> >>mailscanner at lists.mailscanner.info
> >>http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >>
> >>Before posting, read http://wiki.mailscanner.info/posting
> >>
> >>Support MailScanner development - buy the book off the website!
> >
> >
> >
> > **********************************************************************
> >
> > This email and any files transmitted with it are confidential and
> > intended solely for the use of the individual or entity to whom they
> > are addressed. If you have received this email in error please notify
> > the system manager.
> >
> > This footnote confirms that this email message has been swept
> > for the presence of computer viruses and is believed to be clean.
> >
> > **********************************************************************
> >
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.	

**********************************************************************