two messages repeatedly processed

Tue Oct 31 00:38:36 GMT 2006

Use Following options in MailScanner.conf file. This might help you out.

Deliver Unparsable TNEF = yes

On 10/31/06, Scott Silva <ssilva at sgvwater.com> wrote:
>
> David Vosburgh spake the following on 10/30/2006 12:50 PM:
> > Scott Silva wrote:
> >> David Vosburgh spake the following on 10/30/2006 10:35 AM:
> >>
> >>> I have three inbound mail servers with equal weighted MX values, all
> >>> running MS/SA/DCC/Razor/RDJ/milter-greylist/ImageInfo on CentOS 4.4
> >>> using sendmail 8.13.  The last of these three servers was upgraded
> about
> >>> 30 days ago, and all have been running great since then.  After
> getting
> >>> in this morning (but prior to coffee), I checked out the Vispan web
> page
> >>> on each server and noticed that one server had stats much different
> than
> >>> the others.  To make a long story shorter, there were two messages in
> >>> mqueue.in that appear to have been processed 1651 and 548 times (but
> not
> >>> delivered) during a three hour stretch until I moved them out of the
> >>> inbound queue.  Here's what was showing up in the maillog for one of
> the
> >>> messages:
> >>>
> >>
> >> Are there any thing common to these messages? TNEF? Mimetype? Encoding?
> >> Are they overly large than average?
> >> I have seen this in messages that failed the TNEF decoder in the past,
> >> but any
> >> process that chokes on them could be leaving them un-processed.
> >>
> > The two messages appear very dissimilar.  The one processed 1651 times
> > was about 8kb and was just plain text/HTML, while the other was about
> > 650kb and was TNEF encoded (you may be on to something).  Here are some
> > of the headers from the TNEF message:
> >
> > H??Content-class: urn:content-classes:message
> > H??MIME-Version: 1.0
> > H??Content-Type: multipart/mixed;
> >         boundary="----_=_NextPart_001_01C6FC06.9C7EA78E"
> > H??X-MimeOLE: Produced By Microsoft Exchange V6.5
> > H??X-MS-Has-Attach:
> > H??X-MS-TNEF-Correlator:
> > <BE948B9BBFB80445B8954769B643E2923D2322 at xxx.yyy.zzz.jp>
> >
> > And here are the (repeating) maillog entries for it:
> >
> > Oct 30 03:33:46 milter-greylist: k9U9XevM016782: addr 61.204.177.252
> > from <sss at ttt.com.ph> rcpt <mmmm at dalsemi.com>: autowhitelisted for more
> > 768:00:00
> > Oct 30 03:34:09 sendmail[16782]: k9U9XevM016782: from=<sss at ttt.com.ph>,
> > size=662042, class=0, nrcpts=1,
> > msgid=<BE948B9BBFB80445B8954769B643E2923D2322 at xxx.yyy.zzz.jp>,
> > proto=SMTP, daemon=MTA, relay=xxx.yyy.zzz.jp [www.xxx.yyy.zzz]
> > Oct 30 03:34:09 sendmail[16782]: k9U9XevM016782: Milter add: header:
> > X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by
> > milter-greylist-2.0.2 (xxxxx.dalsemi.com [aaa.bbb.ccc.ddd]);
> > Mon, 30 Oct 2006 03:34:09 -0600 (CST)
> > Oct 30 03:34:09 sendmail[16782]: k9U9XevM016782: to=<aaa at dalsemi.com>,
> > delay=00:00:23, mailer=smtp, pri=692042, stat=queued
> > Oct 30 03:34:10 MailScanner[14011]: Expanding TNEF archive at
> > /var/spool/MailScanner/incoming/14011/k9U9XevM016782/winmail.dat
> > Oct 30 03:34:10 MailScanner[14011]: Message k9U9XevM016782 added TNEF
> > contents p1,msg-14011-1301.txt
> > Oct 30 03:34:10 MailScanner[14011]: Message k9U9XevM016782 has had TNEF
> > winmail.dat removed
> > Oct 30 03:34:13 MailScanner[16473]: SpamAssassin cache hit for message
> > k9U9XevM016782
> > Oct 30 03:34:13 MailScanner[16473]: Expanding TNEF archive at
> > /var/spool/MailScanner/incoming/16473/k9U9XevM016782/winmail.dat
> > Oct 30 03:34:13 MailScanner[16473]: Message k9U9XevM016782 added TNEF
> > contents p1,msg-16473-1361.txt
> > Oct 30 03:34:13 MailScanner[16473]: Message k9U9XevM016782 has had TNEF
> > winmail.dat removed
> > Oct 30 03:34:15 MailScanner[17154]: SpamAssassin cache hit for message
> > k9U9XevM016782
> > Oct 30 03:34:15 MailScanner[17154]: Expanding TNEF archive at
> > /var/spool/MailScanner/incoming/17154/k9U9XevM016782/winmail.dat
> > Oct 30 03:34:15 MailScanner[17154]: Message k9U9XevM016782 added TNEF
> > contents p1,msg-17154-961.txt
> > Oct 30 03:34:15 MailScanner[17154]: Message k9U9XevM016782 has had TNEF
> > winmail.dat removed
> > ...
> >
> You could try and use the opposite TNEF decoder from what you are using
> now
> (internal vs. external). I haven't had a problem for quite some time, but
> I am
> pretty sure they were some bad mojo between the mime-tools I had at the
> time
> and the TNEF decoder. This was back on Redhat 9 more than a year ago, so
> my
> memory on the subject is fading.
> With only 2 failures, it seems to rule out a locking problem.
>
> Looking at the log snippets, it seems to be choking at the point of
> replacing
> the winmail.dat with the extracted contents. Maybe you could play with
> those
> settings in mailscanner. Keep those messages just in case Julian wants to
> see
> them. Unless it is priviledged comm's.
>
>
>
> --
>
> MailScanner is like deodorant...
> You hope everybody uses it, and
> you notice quickly if they don't!!!!
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>

-- 
Regards

Pravin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20061031/2446a95d/attachment.html