two messages repeatedly processed

[Scott Silva]

David Vosburgh spake the following on 10/30/2006 12:50 PM:
> Scott Silva wrote:
>> David Vosburgh spake the following on 10/30/2006 10:35 AM:
>>
>>> I have three inbound mail servers with equal weighted MX values, all
>>> running MS/SA/DCC/Razor/RDJ/milter-greylist/ImageInfo on CentOS 4.4
>>> using sendmail 8.13.  The last of these three servers was upgraded about
>>> 30 days ago, and all have been running great since then.  After getting
>>> in this morning (but prior to coffee), I checked out the Vispan web page
>>> on each server and noticed that one server had stats much different than
>>> the others.  To make a long story shorter, there were two messages in
>>> mqueue.in that appear to have been processed 1651 and 548 times (but not
>>> delivered) during a three hour stretch until I moved them out of the
>>> inbound queue.  Here's what was showing up in the maillog for one of the
>>> messages:
>>>
>>
>> Are there any thing common to these messages? TNEF? Mimetype? Encoding?
>> Are they overly large than average?
>> I have seen this in messages that failed the TNEF decoder in the past,
>> but any
>> process that chokes on them could be leaving them un-processed.
>>
> The two messages appear very dissimilar.  The one processed 1651 times
> was about 8kb and was just plain text/HTML, while the other was about
> 650kb and was TNEF encoded (you may be on to something).  Here are some
> of the headers from the TNEF message:
> 
> H??Content-class: urn:content-classes:message
> H??MIME-Version: 1.0
> H??Content-Type: multipart/mixed;
>         boundary="----_=_NextPart_001_01C6FC06.9C7EA78E"
> H??X-MimeOLE: Produced By Microsoft Exchange V6.5
> H??X-MS-Has-Attach:
> H??X-MS-TNEF-Correlator:
> <BE948B9BBFB80445B8954769B643E2923D2322 at xxx.yyy.zzz.jp>
> 
> And here are the (repeating) maillog entries for it:
> 
> Oct 30 03:33:46 milter-greylist: k9U9XevM016782: addr 61.204.177.252
> from <sss at ttt.com.ph> rcpt <mmmm at dalsemi.com>: autowhitelisted for more
> 768:00:00
> Oct 30 03:34:09 sendmail[16782]: k9U9XevM016782: from=<sss at ttt.com.ph>,
> size=662042, class=0, nrcpts=1,
> msgid=<BE948B9BBFB80445B8954769B643E2923D2322 at xxx.yyy.zzz.jp>,
> proto=SMTP, daemon=MTA, relay=xxx.yyy.zzz.jp [www.xxx.yyy.zzz]
> Oct 30 03:34:09 sendmail[16782]: k9U9XevM016782: Milter add: header:
> X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by
> milter-greylist-2.0.2 (xxxxx.dalsemi.com [aaa.bbb.ccc.ddd]);
> Mon, 30 Oct 2006 03:34:09 -0600 (CST)
> Oct 30 03:34:09 sendmail[16782]: k9U9XevM016782: to=<aaa at dalsemi.com>,
> delay=00:00:23, mailer=smtp, pri=692042, stat=queued
> Oct 30 03:34:10 MailScanner[14011]: Expanding TNEF archive at
> /var/spool/MailScanner/incoming/14011/k9U9XevM016782/winmail.dat
> Oct 30 03:34:10 MailScanner[14011]: Message k9U9XevM016782 added TNEF
> contents p1,msg-14011-1301.txt
> Oct 30 03:34:10 MailScanner[14011]: Message k9U9XevM016782 has had TNEF
> winmail.dat removed
> Oct 30 03:34:13 MailScanner[16473]: SpamAssassin cache hit for message
> k9U9XevM016782
> Oct 30 03:34:13 MailScanner[16473]: Expanding TNEF archive at
> /var/spool/MailScanner/incoming/16473/k9U9XevM016782/winmail.dat
> Oct 30 03:34:13 MailScanner[16473]: Message k9U9XevM016782 added TNEF
> contents p1,msg-16473-1361.txt
> Oct 30 03:34:13 MailScanner[16473]: Message k9U9XevM016782 has had TNEF
> winmail.dat removed
> Oct 30 03:34:15 MailScanner[17154]: SpamAssassin cache hit for message
> k9U9XevM016782
> Oct 30 03:34:15 MailScanner[17154]: Expanding TNEF archive at
> /var/spool/MailScanner/incoming/17154/k9U9XevM016782/winmail.dat
> Oct 30 03:34:15 MailScanner[17154]: Message k9U9XevM016782 added TNEF
> contents p1,msg-17154-961.txt
> Oct 30 03:34:15 MailScanner[17154]: Message k9U9XevM016782 has had TNEF
> winmail.dat removed
> ...
> 
You could try and use the opposite TNEF decoder from what you are using now
(internal vs. external). I haven't had a problem for quite some time, but I am
pretty sure they were some bad mojo between the mime-tools I had at the time
and the TNEF decoder. This was back on Redhat 9 more than a year ago, so my
memory on the subject is fading.
With only 2 failures, it seems to rule out a locking problem.

Looking at the log snippets, it seems to be choking at the point of replacing
the winmail.dat with the extracted contents. Maybe you could play with those
settings in mailscanner. Keep those messages just in case Julian wants to see
them. Unless it is priviledged comm's.



-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!