Blocked message for no apparent reason

[Ken A]

There might be a hint in the email headers/body, in 
/mailscanner/MailScanner/quarantine/20120418/q3IKBtOJ020557 ?

It's possible you found a bug, but it's probably something that 
MailScanner is configured to do. Look for quarantine settings and 
"store" directives in your configuration files and rules.

Ken

On 5/3/2012 2:57 PM, Gottschalk, David wrote:
> I don't see in the logs anywhere any hint that clam is blocking this message.
>
> Normally when ClamAV blocks a message, it associates it with the message id, and shows up in the logs.
>
> Any other ideas?
>
> David Gottschalk
> Emory University
> UTS Messaging Team
> 404.727.9744
>
>
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Ken A
> Sent: Thursday, May 03, 2012 12:04 PM
> To: mailscanner at lists.mailscanner.info
> Subject: Re: Blocked message for no apparent reason
>
> grep -i clam maillog ?
> Ken
>
> On 5/3/2012 10:45 AM, Gottschalk, David wrote:
>> I've got a strange issue with MailScanner. It seems a message is being
>> blocked, but I'm not sure why. Originally, I thought it was blocked by
>> SpamAssassin (even though the score has never exceeded the threshold),
>> and hitting a cache hit for every subsequent message. I cleared the
>> SpamAssassin cache, and even whitelisted it in MailScanner with no
>> dice. Any help figuring out what is going on here would be greatly
>> appreciated. I've never seen this occur before, so I'm not sure where
>> else to look and investigate. Below is a copy of the sendmail logs,
>> some sensitive information has been removed.
>>
>> Apr 18 16:11:55 sendmail: [mail.info] q3IKBtOJ020557:
>> from=<no-reply at burgiss.com>, size=1377, class=0, nrcpts=1,
>> msgid=<XMAILj4PPRE3IvhXJ4d00000538 at xmail.bg.lan>, proto=ESMTP,
>> daemon=MTA, relay=removed Apr 18 16:12:06 MailScanner: [mail.notice]
>> Saved entire message to
>> /mailscanner/MailScanner/quarantine/20120418/q3IKBtOJ020557 Apr 18
>> 16:12:11 MailScanner: [mail.info] Message q3IKBtOJ020557 from
>> 74.125.149.40 (no-reply at burgiss.com) is whitelisted Apr 18 16:12:11
>> MailScanner: [mail.info] SpamAssassin cache hit for message
>> q3IKBtOJ020557 Apr 18 16:12:11 MailScanner: [mail.info] Message
>> q3IKBtOJ020557 from 74.125.149.40 (no-reply at burgiss.com) to emory.edu
>> is not spam (whitelisted), SpamAssassin (cached, score=2.006, required
>> 8, autolearn=disabled, MIME_HEADER_CTYPE_ONLY 2.00, T_MIME_NO_TEXT
>> 0.01)
>>