two messages repeatedly processed

[David Vosburgh]

Scott Silva wrote:
> David Vosburgh spake the following on 10/30/2006 10:35 AM:
> 
>>I have three inbound mail servers with equal weighted MX values, all
>>running MS/SA/DCC/Razor/RDJ/milter-greylist/ImageInfo on CentOS 4.4
>>using sendmail 8.13.  The last of these three servers was upgraded about
>>30 days ago, and all have been running great since then.  After getting
>>in this morning (but prior to coffee), I checked out the Vispan web page
>>on each server and noticed that one server had stats much different than
>>the others.  To make a long story shorter, there were two messages in
>>mqueue.in that appear to have been processed 1651 and 548 times (but not
>>delivered) during a three hour stretch until I moved them out of the
>>inbound queue.  Here's what was showing up in the maillog for one of the
>>messages:
>>
> 
> Are there any thing common to these messages? TNEF? Mimetype? Encoding?
> Are they overly large than average?
> I have seen this in messages that failed the TNEF decoder in the past, but any
> process that chokes on them could be leaving them un-processed.
> 
The two messages appear very dissimilar.  The one processed 1651 times 
was about 8kb and was just plain text/HTML, while the other was about 
650kb and was TNEF encoded (you may be on to something).  Here are some 
of the headers from the TNEF message:

H??Content-class: urn:content-classes:message
H??MIME-Version: 1.0
H??Content-Type: multipart/mixed;
         boundary="----_=_NextPart_001_01C6FC06.9C7EA78E"
H??X-MimeOLE: Produced By Microsoft Exchange V6.5
H??X-MS-Has-Attach:
H??X-MS-TNEF-Correlator: 
<BE948B9BBFB80445B8954769B643E2923D2322 at xxx.yyy.zzz.jp>

And here are the (repeating) maillog entries for it:

Oct 30 03:33:46 milter-greylist: k9U9XevM016782: addr 61.204.177.252 
from <sss at ttt.com.ph> rcpt <mmmm at dalsemi.com>: autowhitelisted for more 
768:00:00
Oct 30 03:34:09 sendmail[16782]: k9U9XevM016782: from=<sss at ttt.com.ph>, 
size=662042, class=0, nrcpts=1, 
msgid=<BE948B9BBFB80445B8954769B643E2923D2322 at xxx.yyy.zzz.jp>, 
proto=SMTP, daemon=MTA, relay=xxx.yyy.zzz.jp [www.xxx.yyy.zzz]
Oct 30 03:34:09 sendmail[16782]: k9U9XevM016782: Milter add: header: 
X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by 
milter-greylist-2.0.2 (xxxxx.dalsemi.com [aaa.bbb.ccc.ddd]);
Mon, 30 Oct 2006 03:34:09 -0600 (CST)
Oct 30 03:34:09 sendmail[16782]: k9U9XevM016782: to=<aaa at dalsemi.com>, 
delay=00:00:23, mailer=smtp, pri=692042, stat=queued
Oct 30 03:34:10 MailScanner[14011]: Expanding TNEF archive at 
/var/spool/MailScanner/incoming/14011/k9U9XevM016782/winmail.dat
Oct 30 03:34:10 MailScanner[14011]: Message k9U9XevM016782 added TNEF 
contents p1,msg-14011-1301.txt
Oct 30 03:34:10 MailScanner[14011]: Message k9U9XevM016782 has had TNEF 
winmail.dat removed
Oct 30 03:34:13 MailScanner[16473]: SpamAssassin cache hit for message 
k9U9XevM016782
Oct 30 03:34:13 MailScanner[16473]: Expanding TNEF archive at 
/var/spool/MailScanner/incoming/16473/k9U9XevM016782/winmail.dat
Oct 30 03:34:13 MailScanner[16473]: Message k9U9XevM016782 added TNEF 
contents p1,msg-16473-1361.txt
Oct 30 03:34:13 MailScanner[16473]: Message k9U9XevM016782 has had TNEF 
winmail.dat removed
Oct 30 03:34:15 MailScanner[17154]: SpamAssassin cache hit for message 
k9U9XevM016782
Oct 30 03:34:15 MailScanner[17154]: Expanding TNEF archive at 
/var/spool/MailScanner/incoming/17154/k9U9XevM016782/winmail.dat
Oct 30 03:34:15 MailScanner[17154]: Message k9U9XevM016782 added TNEF 
contents p1,msg-17154-961.txt
Oct 30 03:34:15 MailScanner[17154]: Message k9U9XevM016782 has had TNEF 
winmail.dat removed
...

-- 

Dave Vosburgh
Sr. Unix System Administrator
Dallas Semiconductor
vosburgh at dalsemi.com  972-371-4418

"By order of the prophet, we ban that boogie sound."