Could not analyze message

Martin Hepworth martinh at solidstatelogic.com
Wed Nov 8 10:21:13 GMT 2006


Paul Houselander wrote:
> Emmm, I was just trying a few things and tried changing the following line
> in the qf file
> 
> H??Content-Type: multipart/mixed
> 
> to
> 
> H??Content-Type: text/plain; charset="iso-8859-1";format=flowed (i copied
> from another plain text email I had)
> 
> and the message was not quarantined, so it must be this that is causing
> MailScanner to throw up the "Could not analyze message", the message is just
> plain text, I dont imagine this is a MailScanner prob as this is the only
> message that I get with this problem.
> 
> Can anyone shed any light on this? could it be a badly written mail client?
> do you need some other headers when Content-Type: is multipart/mixed?
> 
> This is the complete bit of the qf file (after all the recived lines)
> 
> H??From: "xxxxxxxxxxxxx" <xxxxxxxxxxxx>
> H??Subject: Proof of Delivery
> H??To: xxxxxxxxxxxxx
> H??Content-Type: multipart/mixed
> H??Date: Fri, 3 Nov 2006 13:32:29 +0000
> H??Message-ID: <GOLDMASTERwOzrJS1yJ000001e0 at goldmaster.gold01.com>
> H??X-OriginalArrivalTime: 03 Nov 2006 13:32:29.0639 (UTC)
> FILETIME=[825D5570:01C6FF4C]
> 
> Ive just taken a look at another message that is multipart/mixed and it has
> 
> Mime-Version: 1.0
> Content-Type: multipart/mixed;
> boundary="----=_Part_1920_10465405.1162980009645"
> 
> Which the message that Could not be analyzed does not
> 
> Cheers
> 
> Paul
> 
> 
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info]On Behalf Of Paul
> Houselander
> Sent: 08 November 2006 09:43
> To: MailScanner discussion
> Subject: RE: Could not analyze message
> 
> 
> Hi Martin
> 
> Ive set both Debug = yes and Debug SpamAssassin = yes nothing in the logs of
> any note.
> 
> New Batch: Scanning 1 messages, 2080 bytes
> Created attachment dirs for 1 messages
> SpamAssassin returned 0
> Virus and Content Scanning: Starting
> Commencing scanning by clamavmodule...
> Completed scanning by clamavmodule
> Completed checking by /usr/bin/file
> Saved entire message to
> /var/spool/MailScanner/quarantine/20061107/kA3DWXX9018872
> 
> Ive tried this now with a fresh install of the latest stable version of
> MailScanner and get the same "Could not analyze message", so I believe the
> problem is easily reproducible. I can send someone offlist the qf/df pair?
> 
> Thanks for your help so far.
> 
> Kind Regards
> 
> Paul
> 
> 
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info]On Behalf Of Martin
> Hepworth
> Sent: 07 November 2006 17:09
> To: MailScanner discussion
> Subject: Re: Could not analyze message
> 
> 
> Paul Houselander wrote:
>> Hi Martin
>>
>> Thanks for the debug tip forgot all about that!
>>
>> I set
>>
>> Debug = yes
>> Debig SpamAssassin = no
>>
>> and copied the qf/qf pair back into /var/spool/mqueue.in
>>
>> I started up MailScanner
>>
>> 	MailScanner:	In Debugging mode, not forking....
>>
>> The message got quarantined but the debug info didnt really show
> anything -
>> I got a message saying
>>
>> format error: can't find EOCD signature
>>  at /usr/sbin/MailScanner line 820
>>
>> But I put some other messages in and got exactly the same problem.
>>
>> Any other tips :-)
>>
>> Paul
>>
>> -----Original Message-----
>> From: mailscanner-bounces at lists.mailscanner.info
>> [mailto:mailscanner-bounces at lists.mailscanner.info]On Behalf Of Martin
>> Hepworth
>> Sent: 07 November 2006 15:02
>> To: MailScanner discussion
>> Subject: Re: Could not analyze message
>>
>>
>> Paul Houselander wrote:
>>> Nope I dont think thats the problem, ive just realised I gave the headers
>>> from the released email (i have a little script that releases an email
>> from
>>> quarantine), below is the raw qf file data:-
>>>
>>> Any other ideals, I just cant get this email through unscanned or better
>>> still understand why MailScanner cant analyze the message.
>>>
>>> Cheers
>>>
>> <snip>
>> Paul
>>
>> can you drop this back into the queue and run mailScanner/Spamassassin
>> in debug mode? You may then be able to spot whats going awry.
>>
>> --
>> Martin Hepworth
>> Senior Systems Administrator
>> Solid State Logic
>> Tel: +44 (0)1865 842300
>>
>> **********************************************************************
>>
>> This email and any files transmitted with it are confidential and
>> intended solely for the use of the individual or entity to whom they
>> are addressed. If you have received this email in error please notify
>> the system manager.
>>
>> This footnote confirms that this email message has been swept
>> for the presence of computer viruses and is believed to be clean.
>>
>> **********************************************************************
>>
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
>>
>>
>> This message has been scanned by the Allteks Mailsafe Service
>>
>>
>>
> Paul
> set both options to debug - also check the maillog file
> 
> --
> Martin Hepworth
> Senior Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
> 
> **********************************************************************
> 
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
> 
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
> 
> **********************************************************************
> 
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> 
> This message has been scanned by the Allteks Mailsafe Service
> 
> 
> 
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> 
> This message has been scanned by the Allteks Mailsafe Service
> 
> 
> 
Paul

looking at RFC2387 which describes all this, I'd say the client is 
broke. You should get some idea of the client in the headers.

I'd drop Jules an email..he's mroe used to dealing with rfc stuff and 
readign them than me..;-)

-- 
Martin Hepworth
Senior Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.	

**********************************************************************



More information about the MailScanner mailing list