Receives email with blank body

[Martin Hepworth]

Doubt it, unless the antivirus on the Domino server did something to it,
all Mailwatch does is log the information.

Can you replay messages at all - ie do you use  the archive facility so you
can inject the message again while running in debug mode?


-- 
Martin Hepworth, CISSP
Oxford, UK


On 8 October 2012 18:05, Budi Febrianto <bfebrian.milis at gmail.com> wrote:

> Dear Martin,
>
> This happen not always with big emails, many big emails still delivered
> without any problems.
>
> This problem appears to be random, but often.
>
> The next host is the mail server, which is Lotus Domino 8.5.
>
> Is it possible that the anti virus or mailwatch somehow altered the mail
> format?
>
> Best regards
> On Oct 8, 2012 11:39 PM, "Martin Hepworth" <maxsec at gmail.com> wrote:
>
>> Is this consistent with large emails above the spam checks size limit?
>>
>> If it is, you could run a test in debug mode of a large email to see
>> what's going flakey.
>>
>> I presume the next host down the line (192.168.10.17) is handling this
>> OK?
>>
>>
>> --
>> Martin Hepworth, CISSP
>> Oxford, UK
>>
>>
>> On 8 October 2012 16:27, Budi Febrianto <bfebrian.milis at gmail.com> wrote:
>>
>>> Dear Martin,
>>>
>>> Thank you for the reply, but I don't see something strange in the maillog
>>>
>>> [root at spam log]# cat maillog.1 | grep q917UfQF014676
>>> Oct  1 14:30:58 spam sendmail[14676]: q917UfQF014676: from=<
>>> cory.margaret at abc.com>, size=340562, class=0, nrcpts=1, msgid=<
>>> E430C752C711024D996D49014F27FD10A78D9B at MT-XC-02-CB.abc.com>,
>>> proto=ESMTP, daemon=MTA, relay=ln-static-202-77-100-39.link.net.id
>>> [202.77.100.39] (may be forged)
>>> Oct  1 14:30:58 spam sendmail[14676]: q917UfQF014676: to=<
>>> amiws at xyz.co.id>, delay=00:00:11, mailer=smtp, pri=370562, stat=queued
>>> Oct  1 14:30:59 spam MailScanner[13678]: Message q917UfQF014676 from
>>> 202.77.100.39 (cory.margaret at abc.com) to xyz.co.id is too big for spam
>>> checks (341198 > 200000 bytes)
>>> Oct  1 14:30:59 spam MailScanner[13678]: Logging message q917UfQF014676
>>> to SQL
>>> Oct  1 14:30:59 spam MailScanner[13945]: q917UfQF014676: Logged to
>>> MailWatch SQL
>>> Oct  1 14:31:00 spam sendmail[14693]: q917UfQF014676: to=<
>>> amiws at xyz.co.id>, delay=00:00:13, xdelay=00:00:01, mailer=smtp,
>>> pri=460562, relay=[192.168.10.17] [192.168.10.17], dsn=2.0.0, stat=Sent
>>> (Message accepted for delivery)
>>>
>>> Best Regards
>>>
>>> On Mon, Oct 8, 2012 at 6:53 PM, Martin Hepworth <maxsec at gmail.com>wrote:
>>>
>>>> Check the mailScanner logs for  that message to see if it's doing
>>>> anything 'unusual' with the message.
>>>>
>>>> --
>>>> Martin Hepworth, CISSP
>>>> Oxford, UK
>>>>
>>>>
>>>> On 8 October 2012 11:30, Budi Febrianto <bfebrian.milis at gmail.com>wrote:
>>>>
>>>>> Dear all,
>>>>>
>>>>> My customer have problems with their mailscanner installation,
>>>>> sometimes users emails with blank body. I already search the web for
>>>>> possible reasons, but can't find any.
>>>>>
>>>>> This is the configurations:
>>>>>
>>>>> MailScanner 4.84.5
>>>>> Centos 6.2 64 bit
>>>>> Sendmail 8.13
>>>>> MailWatch-1.1.5.1
>>>>> ClamAV 0.96.5
>>>>>
>>>>> Best regards
>>>>>
>>>>> --
>>>>> MailScanner mailing list
>>>>> mailscanner at lists.mailscanner.info
>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>>>
>>>>> Before posting, read http://wiki.mailscanner.info/posting
>>>>>
>>>>> Support MailScanner development - buy the book off the website!
>>>>>
>>>>>
>>>>
>>>> --
>>>> MailScanner mailing list
>>>> mailscanner at lists.mailscanner.info
>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>>
>>>> Before posting, read http://wiki.mailscanner.info/posting
>>>>
>>>> Support MailScanner development - buy the book off the website!
>>>>
>>>>
>>>
>>> --
>>> MailScanner mailing list
>>> mailscanner at lists.mailscanner.info
>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>
>>> Before posting, read http://wiki.mailscanner.info/posting
>>>
>>> Support MailScanner development - buy the book off the website!
>>>
>>>
>>
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
>>
>>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20121008/bfb3069e/attachment.html