Receives email with blank body

[Budi Febrianto]

Dear Martin,

This happen not always with big emails, many big emails still delivered
without any problems.

This problem appears to be random, but often.

The next host is the mail server, which is Lotus Domino 8.5.

Is it possible that the anti virus or mailwatch somehow altered the mail
format?

Best regards
On Oct 8, 2012 11:39 PM, "Martin Hepworth" <maxsec at gmail.com> wrote:

> Is this consistent with large emails above the spam checks size limit?
>
> If it is, you could run a test in debug mode of a large email to see
> what's going flakey.
>
> I presume the next host down the line (192.168.10.17) is handling this OK?
>
>
> --
> Martin Hepworth, CISSP
> Oxford, UK
>
>
> On 8 October 2012 16:27, Budi Febrianto <bfebrian.milis at gmail.com> wrote:
>
>> Dear Martin,
>>
>> Thank you for the reply, but I don't see something strange in the maillog
>>
>> [root at spam log]# cat maillog.1 | grep q917UfQF014676
>> Oct  1 14:30:58 spam sendmail[14676]: q917UfQF014676: from=<
>> cory.margaret at abc.com>, size=340562, class=0, nrcpts=1, msgid=<
>> E430C752C711024D996D49014F27FD10A78D9B at MT-XC-02-CB.abc.com>,
>> proto=ESMTP, daemon=MTA, relay=ln-static-202-77-100-39.link.net.id
>> [202.77.100.39] (may be forged)
>> Oct  1 14:30:58 spam sendmail[14676]: q917UfQF014676: to=<amiws at xyz.co.id>,
>> delay=00:00:11, mailer=smtp, pri=370562, stat=queued
>> Oct  1 14:30:59 spam MailScanner[13678]: Message q917UfQF014676 from
>> 202.77.100.39 (cory.margaret at abc.com) to xyz.co.id is too big for spam
>> checks (341198 > 200000 bytes)
>> Oct  1 14:30:59 spam MailScanner[13678]: Logging message q917UfQF014676
>> to SQL
>> Oct  1 14:30:59 spam MailScanner[13945]: q917UfQF014676: Logged to
>> MailWatch SQL
>> Oct  1 14:31:00 spam sendmail[14693]: q917UfQF014676: to=<amiws at xyz.co.id>,
>> delay=00:00:13, xdelay=00:00:01, mailer=smtp, pri=460562,
>> relay=[192.168.10.17] [192.168.10.17], dsn=2.0.0, stat=Sent (Message
>> accepted for delivery)
>>
>> Best Regards
>>
>> On Mon, Oct 8, 2012 at 6:53 PM, Martin Hepworth <maxsec at gmail.com> wrote:
>>
>>> Check the mailScanner logs for  that message to see if it's doing
>>> anything 'unusual' with the message.
>>>
>>> --
>>> Martin Hepworth, CISSP
>>> Oxford, UK
>>>
>>>
>>> On 8 October 2012 11:30, Budi Febrianto <bfebrian.milis at gmail.com>wrote:
>>>
>>>> Dear all,
>>>>
>>>> My customer have problems with their mailscanner installation,
>>>> sometimes users emails with blank body. I already search the web for
>>>> possible reasons, but can't find any.
>>>>
>>>> This is the configurations:
>>>>
>>>> MailScanner 4.84.5
>>>> Centos 6.2 64 bit
>>>> Sendmail 8.13
>>>> MailWatch-1.1.5.1
>>>> ClamAV 0.96.5
>>>>
>>>> Best regards
>>>>
>>>> --
>>>> MailScanner mailing list
>>>> mailscanner at lists.mailscanner.info
>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>>
>>>> Before posting, read http://wiki.mailscanner.info/posting
>>>>
>>>> Support MailScanner development - buy the book off the website!
>>>>
>>>>
>>>
>>> --
>>> MailScanner mailing list
>>> mailscanner at lists.mailscanner.info
>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>
>>> Before posting, read http://wiki.mailscanner.info/posting
>>>
>>> Support MailScanner development - buy the book off the website!
>>>
>>>
>>
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
>>
>>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20121009/eb3056c9/attachment.html