Single email, multiple Spamassassin attempls

Fri May 17 17:52:19 IST 2013

Robert,

There are three primary things I check for when dealing with this problem:

1. Selinux. You know the drill for this one.
2. MailScanner Run As and directory ownership and permissions.
3. Making sure you add the -U option to MailScanner for the newer versions
of perl.

sed -i 's:#!/usr/bin/perl -I:#!/usr/bin/perl -U -I:g' /usr/sbin/MailScanner

Jerry Benton

On Wed, May 15, 2013 at 7:31 PM, Robert Lopez <rlopezcnm at gmail.com> wrote:

> Do I have a MailScanner configuration problem or is this expected behavior?
>
> MailScanner 4.84.5-3
> Clamd 0.97.7-1
> SpamAssassin 3.3.1
> Perl 5.10.1
> Postfix 2.10.0
>
> A new email gateway is sending the much discussed "Problem Email"
> messages. As far as I see there is not a problem with anything other
> than the emails that are listed in the "Problem Email" messages.
>
> However, I see a pattern that looks like this, where there are
> apparently multiple attempts to scan of each email by SpamAssassin:
>
> May 15 10:18:08 mg08 postfix/cleanup[7331]: 780574C02AB: hold: header
> Received: from apn-37-7-144-188.dynamic.gprs.plus.pl (unknown
> [5.174.118.246])??by mg08.cnm.edu (Postfix) with ESMTP id
> 780574C02AB??for <xxxxxxxx at cnm.edu>; Wed, 15 May 2013 10:18:06 -0600
> (MDT) from unknown[5.174.118.246];
> from=<wBlUzCw213 at apostolic-voice.org> to=<xxxxxxxx at cnm.edu>
> proto=ESMTP helo=<apn-37-7-144-188.dynamic.gprs.plus.pl>
> May 15 10:18:08 mg08 postfix/cleanup[7331]: 780574C02AB: warning:
> header Subject: I cant be the only one in this from
> unknown[5.174.118.246]; from=<wBlUzCw213 at apostolic-voice.org>
> to=<xxxxxxxx at cnm.edu> proto=ESMTP
> helo=<apn-37-7-144-188.dynamic.gprs.plus.pl>
> May 15 10:18:08 mg08 postfix/cleanup[7331]: 780574C02AB:
> message-id=<
> 9BAEEC48-4130-08D1-E84A-F0DF63F3D233 at apn-37-7-144-188.dynamic.gprs.plus.pl
> >
> May 15 10:18:13 mg08 MailScanner[4633]: Message 780574C02AB.A2DEA from
> 5.174.118.246 (wbluzcw213 at apostolic-voice.org) to cnm.edu is spam,
> SpamAssassin (not cached, score=16.991, required 6,
> autolearn=disabled, CK_HELO_GENERIC 0.25, HELO_DYNAMIC_IPADDR 3.24,
> RDNS_NONE 1.27, URIBL_AB_SURBL 4.50, URIBL_BLACK 1.77, URIBL_DBL_SPAM
> 1.70, URIBL_JP_SURBL 1.95, URIBL_SBL 0.64, URIBL_WS_SURBL 1.66)
> May 15 10:18:13 mg08 MailScanner[4633]: Non-delivery of spam: message
> 780574C02AB.A2DEA from wbluzcw213 at apostolic-voice.org to
> xxxxxxxx at cnm.edu with subject I cant be the only one in this
> May 15 10:18:13 mg08 MailScanner[4633]: Spam Actions: message
> 780574C02AB.A2DEA actions are store
> May 15 10:20:54 mg08 MailScanner[7342]: Making attempt 2 at processing
> message 780574C02AB.A2DEA
> May 15 10:20:54 mg08 MailScanner[7342]: SpamAssassin cache hit for
> message 780574C02AB.A2DEA
> May 15 10:20:54 mg08 MailScanner[7342]: Message 780574C02AB.A2DEA from
> 5.174.118.246 (wbluzcw213 at apostolic-voice.org) to cnm.edu is spam,
> SpamAssassin (cached, score=16.991, required 6, autolearn=disabled,
> CK_HELO_GENERIC 0.25, HELO_DYNAMIC_IPADDR 3.24, RDNS_NONE 1.27,
> URIBL_AB_SURBL 4.50, URIBL_BLACK 1.77, URIBL_DBL_SPAM 1.70,
> URIBL_JP_SURBL 1.95, URIBL_SBL 0.64, URIBL_WS_SURBL 1.66)
> May 15 10:20:54 mg08 MailScanner[7342]: Non-delivery of spam: message
> 780574C02AB.A2DEA from wbluzcw213 at apostolic-voice.org to
> xxxxxxxx at cnm.edu with subject I cant be the only one in this
> May 15 10:20:54 mg08 MailScanner[7342]: Spam Actions: message
> 780574C02AB.A2DEA actions are store
> May 15 10:25:16 mg08 MailScanner[4579]: Making attempt 3 at processing
> message 780574C02AB.A2DEA
> May 15 10:25:16 mg08 MailScanner[4579]: SpamAssassin cache hit for
> message 780574C02AB.A2DEA
> May 15 10:25:16 mg08 MailScanner[4579]: Message 780574C02AB.A2DEA from
> 5.174.118.246 (wbluzcw213 at apostolic-voice.org) to cnm.edu is spam,
> SpamAssassin (cached, score=16.991, required 6, autolearn=disabled,
> CK_HELO_GENERIC 0.25, HELO_DYNAMIC_IPADDR 3.24, RDNS_NONE 1.27,
> URIBL_AB_SURBL 4.50, URIBL_BLACK 1.77, URIBL_DBL_SPAM 1.70,
> URIBL_JP_SURBL 1.95, URIBL_SBL 0.64, URIBL_WS_SURBL 1.66)
> May 15 10:25:16 mg08 MailScanner[4579]: Non-delivery of spam: message
> 780574C02AB.A2DEA from wbluzcw213 at apostolic-voice.org to
> xxxxxxxx at cnm.edu with subject I cant be the only one in this
> May 15 10:25:16 mg08 MailScanner[4579]: Spam Actions: message
> 780574C02AB.A2DEA actions are store
> May 15 10:28:34 mg08 MailScanner[4746]: Making attempt 4 at processing
> message 780574C02AB.A2DEA
> May 15 10:28:34 mg08 MailScanner[4746]: SpamAssassin cache hit for
> message 780574C02AB.A2DEA
> May 15 10:28:34 mg08 MailScanner[4746]: Message 780574C02AB.A2DEA from
> 5.174.118.246 (wbluzcw213 at apostolic-voice.org) to cnm.edu is spam,
> SpamAssassin (cached, score=16.991, required 6, autolearn=disabled,
> CK_HELO_GENERIC 0.25, HELO_DYNAMIC_IPADDR 3.24, RDNS_NONE 1.27,
> URIBL_AB_SURBL 4.50, URIBL_BLACK 1.77, URIBL_DBL_SPAM 1.70,
> URIBL_JP_SURBL 1.95, URIBL_SBL 0.64, URIBL_WS_SURBL 1.66)
> May 15 10:28:34 mg08 MailScanner[4746]: Non-delivery of spam: message
> 780574C02AB.A2DEA from wbluzcw213 at apostolic-voice.org to
> xxxxxxxx at cnm.edu with subject I cant be the only one in this
> May 15 10:28:34 mg08 MailScanner[4746]: Spam Actions: message
> 780574C02AB.A2DEA actions are store
> May 15 10:30:38 mg08 MailScanner[7382]: Making attempt 5 at processing
> message 780574C02AB.A2DEA
> May 15 10:30:38 mg08 MailScanner[7382]: SpamAssassin cache hit for
> message 780574C02AB.A2DEA
> May 15 10:30:38 mg08 MailScanner[7382]: Message 780574C02AB.A2DEA from
> 5.174.118.246 (wbluzcw213 at apostolic-voice.org) to cnm.edu is spam,
> SpamAssassin (cached, score=16.991, required 6, autolearn=disabled,
> CK_HELO_GENERIC 0.25, HELO_DYNAMIC_IPADDR 3.24, RDNS_NONE 1.27,
> URIBL_AB_SURBL 4.50, URIBL_BLACK 1.77, URIBL_DBL_SPAM 1.70,
> URIBL_JP_SURBL 1.95, URIBL_SBL 0.64, URIBL_WS_SURBL 1.66)
> May 15 10:30:38 mg08 MailScanner[7382]: Non-delivery of spam: message
> 780574C02AB.A2DEA from wbluzcw213 at apostolic-voice.org to
> xxxxxxxx at cnm.edu with subject I cant be the only one in this
> May 15 10:30:38 mg08 MailScanner[7382]: Spam Actions: message
> 780574C02AB.A2DEA actions are store
> May 15 10:34:24 mg08 MailScanner[7439]: Making attempt 6 at processing
> message 780574C02AB.A2DEA
> May 15 10:34:24 mg08 MailScanner[7439]: SpamAssassin cache hit for
> message 780574C02AB.A2DEA
> May 15 10:34:24 mg08 MailScanner[7439]: Message 780574C02AB.A2DEA from
> 5.174.118.246 (wbluzcw213 at apostolic-voice.org) to cnm.edu is spam,
> SpamAssassin (cached, score=16.991, required 6, autolearn=disabled,
> CK_HELO_GENERIC 0.25, HELO_DYNAMIC_IPADDR 3.24, RDNS_NONE 1.27,
> URIBL_AB_SURBL 4.50, URIBL_BLACK 1.77, URIBL_DBL_SPAM 1.70,
> URIBL_JP_SURBL 1.95, URIBL_SBL 0.64, URIBL_WS_SURBL 1.66)
> May 15 10:34:24 mg08 MailScanner[7439]: Non-delivery of spam: message
> 780574C02AB.A2DEA from wbluzcw213 at apostolic-voice.org to
> xxxxxxxx at cnm.edu with subject I cant be the only one in this
> May 15 10:34:24 mg08 MailScanner[7439]: Spam Actions: message
> 780574C02AB.A2DEA actions are store
> May 15 10:34:24 mg08 MailScanner[7422]: Warning: skipping message
> 780574C02AB.A2DEA as it has been attempted too many times
> May 15 10:34:24 mg08 MailScanner[7422]: Quarantined message
> 780574C02AB.A2DEA as it caused MailScanner to crash several times
> May 15 10:34:24 mg08 MailScanner[7422]: Saved entire message to
> /var/spool/MailScanner/quarantine/20130515/780574C02AB.A2DEA
>
>
> Do I have a MailScanner configuration problem or is this expected behavior?
>
>
> --
> Robert Lopez
> Unix Systems Administrator
> Central New Mexico Community College (CNM)
> 525 Buena Vista SE
> Albuquerque, New Mexico 87106
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>

-- 

--
Jerry Benton
Mailborder Systems
www.mailborder.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130517/5dcffdf7/attachment.html 