"Problem Messages" - what's happening?

[Mark Sapiro]

On Sun, May 10, 2009 at 10:44:01AM +0100, Paul Hutchings wrote:
> Hmm OK seeing a few of the below in my Postmaster inbox.
> 
> Doing a grep of the logs shows this:
> 
> May  9 17:03:19 relay postfix/cleanup[7749]: 8BE611FCC8:
> message-id=<06A07D7DB16C417C8990A7FACEE37518 at Desktop>
> May  9 17:09:19 relay MailScanner[7940]: Making attempt 2 at processing
> message 8BE611FCC8.A5E8C
> May  9 17:09:19 relay MailScanner[7940]: Expanding TNEF archive at
> /var/spool/MailScanner/incoming/7940/8BE611FCC8.A5E8C/winmail.dat
[...]
> May  9 17:27:30 relay MailScanner[9522]: Warning: skipping message
> 8BE611FCC8.A5E8C as it has been attempted too many times
> May  9 17:27:30 relay MailScanner[9522]: Quarantined message
> 8BE611FCC8.A5E8C as it caused MailScanner to crash several times
> May  9 17:27:30 relay MailScanner[9522]: Saved entire message to
> /var/spool/MailScanner/quarantine/20090509/8BE611FCC8.A5E8C


I suspect the problem is the TNEF decoder is timing out trying to
decode the TNEF (winmail.dat) part of the message. The part is likely
corrupt.

You could verify this by retrieving the message from the quarantine,
saving the winmail.dat attachment and then trying to expand it with
/usr/bin/tnef which is the default decoder.

Also see
<http://lists.mailscanner.info/pipermail/mailscanner/2005-April/048465.html>.

-- 
Mark Sapiro mark at msapiro net       The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan