Releaseing mail from quarantine (wiki instructions didn't work)

[Julian Field]

Once you've copied the message into the *outgoing* queue, it won't get 
re-read by MailScanner, but you need to tell sendmail to make a delivery 
attempt on the message, or else it will just get processed the next time 
the queue runner passes it in the queue. Read the docs for "sendmail -q".

If you don't like the instructions on the wiki, please expand them!
But you do *not* need to restart MailScanner to flush the outgoing 
queue, what you are seeing is a side-effect. If you want to try to flush 
every message in the queue, do "sendmail -q". If you know that the 
message you are trying to flush contains "01234" in its filename, you 
can do "sendmail -qI01234" and it will just flush that message.

Chris W. Parker wrote:
> Hello,
>
> First issue is that I've got an email that is being quarantined because
> it is claimed to be "nested too deeply".
>
> To release it from the quarantine I referred to
> http://wiki.mailscanner.info/doku.php?id=maq:index#quarantine_management
> . It says to simply copy the qf/df file pair of the offending email into
> the outgoing queue. But when I do that nothing happens. The email just
> sits there in the queue whilst other emails (that are received and found
> to be clean) come and go through the queue. I finally restarted
> MailScanner and that seemed to get the message on its way. Which brings
> me to the second issue... After MailScanner restarted it was quarantined
> again for the same problem. Back to square one.
>
> I'd like to suggest that the wiki be updated with more complete
> instructions since, unless my system is out of the norm, those
> instructions very lacking. It doesn't mention the need to restart
> MailScanner and simply copying the qf/df files to the outgoing queue
> merely results in the email(s) being quarantined again.
>
>
> So now I'm looking for the rule that caused this email to be quarantined
> in the first place and the best I could find is:
>
> ClamAVmodule Maximum Recursion Level = 8
>
> I raised the max up to 25 and redid the release+restart and the user was
> able to receive the email. When I checked the .zip it only had one
> folder with two files.
>  
> So...
>  
> file.zip:
>   folder
>      fileA.xls
>      fileB.xls
>  
> This is hardly 25 levels of nesting. What could cause this to be
> flagged?
>
> Another part in this puzzle is that the message was larger than the "Max
> Spam Check Size = 150000" limit. Could this be related?
>
>  
>  
> Thanks,
> Chris.
>
>   

Jules

-- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk