Mismatch between report and actions

[Glenn Steen]

2009/6/29 Robert Lopez <rlopezcnm at gmail.com>:
> On Mon, Jun 29, 2009 at 8:43 AM, Glenn Steen<glenn.steen at gmail.com> wrote:
>> 2009/6/29 Robert Lopez <rlopezcnm at gmail.com>:
>>> On Mon, Jun 29, 2009 at 8:11 AM, Glenn Steen<glenn.steen at gmail.com> wrote:
>>>> 2009/6/29 Robert Lopez <rlopezcnm at gmail.com>:
>>>>> On Sat, Jun 27, 2009 at 5:17 PM, Glenn Steen<glenn.steen at gmail.com> wrote:
>>>>>> 2009/6/26 Robert Lopez <rlopezcnm at gmail.com>:
>>>>>>> HP Prolient DL360 G5
>>>>>>> Two dual core Intel(R) Xeon(R) CPU E5450 @ 3.00GHz
>>>>>>> 8 G RAM
>>>>>>> Linux 2.6.28-11-server #42-Ubuntu SMP Fri Apr 17 02:45:36 UTC 2009
>>>>>>> x86_64 GNU/Linux
>>>>>>> Ubuntu 9.04 (jaunty)
>>>>>>> MailScanner version 4.74.16
>>>>>>> Postfix version 2.5.5
>>>>>>> SpamAssassin version 3.2.5 running on Perl version 5.10.0
>>>>>>> (I know there are newer versions. These are Ubuntu apt-get...)
>>>>>>>
>>>>>>>
>>>> (snip error...)
>>>>>>>
>>>>>> Do the upgrades needed ... MailScanner, possibly SA and Clam as well.
>>>>>> If this means leaving the Ubunto/apt thing behind, then so be it.
>>>>>> If you still observe the same behavior... Then we'll look at other things:-).
>>>>>>
>>>>>> Cheers
>>>> (snip)
>>>>>
>>>>> Thank you Glenn,
>>>>>
>>>>> Changing from Ubuntu is not my decision to make. My current project is
>>>>> comparing a system built with RHEL and files from Julians site to this
>>>>> one.
>>>>>
>>>> I didn't say "ditch Ubuntu", just the ubuntu packaging of
>>>> MailScanner;-). You could probably live pritty well with the source
>>>> tarball, for example.
>>>>
>>>> Cheers
>>>> --
>>>> -- Glenn
>>>> email: glenn < dot > steen < at > gmail < dot > com
>>>> work: glenn < dot > steen < at > ap1 < dot > se
>>>> --
>>>> MailScanner mailing list
>>>> mailscanner at lists.mailscanner.info
>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>>
>>>> Before posting, read http://wiki.mailscanner.info/posting
>>>>
>>>> Support MailScanner development - buy the book off the website!
>>>>
>>>
>>> Again, Thank you Glenn.
>>>
>>> I have to attend to the root cause of the problem I wrote about. The
>>> issue you reply to is a policy issue upon which I have no influence. I
>>> was very happy with the test system built with tar files. My
>>> management is not.
>>>
>> Why? They will just get an added delay and no real benefit (stability
>> or otherwise) from sticking to more or less outdated "debianized"
>> packages. Sigh. Get a clue-by-four and start whacking;-):-) One cannot
>> fight bleeding edge malware/spam with trailing edge, or even sometimes
>> moderately modern (like this problem instance;), protection systems.
>>
>> Cheers
>> --
>> -- Glenn
>> email: glenn < dot > steen < at > gmail < dot > com
>> work: glenn < dot > steen < at > ap1 < dot > se
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
>>
>
> Glenn I totally agree with you. But your comments are not helpful. I
> have stated I have no control over institutional policies.
>
That being the case, I'm not entirely sure we will be able to help
you. My prompting you to upgrade isn't just the semi-unhelpful comment
it may seem. There were some changes to the Postfix handling (mostly
when used with milters, true) recently, as well as some other
important fixes (IIRC there were some problems with the MIME tools
perl module... I might remeber wrong, but I don't think I do:-). Also,
since you use the Ubuntu packaging, you are likely to be using the
perl modules from the same source... I'm not sure, but I rather
suspect that that may be as bad as mixing the "MailScanner perl
modules" from certain other distros into the brew...
Going to a "source" install (as you've obviously tried) would take
some of the uncertanties out of the picture, as well as enabling you
to use the latest/greatest of MailScanner (at your own discretion, of
course)... So that you decide when you need upgrade, not some
packager. Usually, the latter is norm for most distros, and frankly
the sane thing to do. But not with system like MailScanner, IMO.

Anyway, that is neither here nor there. If you can't change what beta
you are using, that is the way it is.
Back to the original message then... Hmm.

This wouldn't be stored as spam, it would likely be stored in a
directory named like the queue file ID + the random bit... so did you
find for a file specifically? it should all be there in the
/var/spool/MailScanner/quarantine/20090626/E0CE312F.5E6C5 directory.

I suppose that if the mime explosion didn't go well, for some reason,
you might see some strange results... Hmm.

What are your settings in MailScanner.conf for
Deliver Disinfected Files
Silent Viruses
Still Deliver Silent Viruses
Non-Forging Viruses
ClamAV Full Message Scan
That the message got requeued and delivered suggest some rather not
that wise settings here, perhaps:-)

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se