From pgadmin at pse-consulting.de Mon Dec 1 11:30:54 2014 From: pgadmin at pse-consulting.de (Andreas Pflug) Date: Mon, 01 Dec 2014 12:30:54 +0100 Subject: data loss from failed link Message-ID: <547C516E.2050304@pse-consulting.de> Lately, I've been moving MailScanner's in and out exim queues to a xfs file system, and configuring quota projects on both queues (no limits applied). After a while I noticed that the out queue would contain only xxx-H files, no message body xxx-D files any more. The logfile would state "Failed to link message body between queues". Apparently the creation of a hard link failes if the target directory is in a different xfs quota project. Unfortunately, the check in EximDiskStore.pm LinkData() (line 256) just logs a message and continues, deleting the non-linked message and thus losing data. Instead of Log::WarnLog a Log::DieLog should be generated, because losing data on misconfigured storage isn't acceptable. Regards Andreas From kevin.miller at juneau.org Tue Dec 2 19:11:54 2014 From: kevin.miller at juneau.org (Kevin Miller) Date: Tue, 2 Dec 2014 19:11:54 +0000 Subject: Bounces from Yahoo Message-ID: Every now and then, my users will send to Yahoo and the mail bounces. The cause is duplicate subject headers. SOMEONE at yahoo.com on 12/1/2014 3:52 PM Diagnostic code = NoDiagnostic; Reason code = TransferFailed; Status code = 500 There's a similar thread over in the Baruwa neighborhood, but apparently it's a MailScanner bug. They mention a fix over there but I don't know that it's made it to github for MailScanner yet. http://baruwa-users-list.963389.n3.nabble.com/Yahoo-Headers-are-not-RFC-compliant-td4027435.html Anyone else having this issue? Any patch files out for it? Running on: Linux smtp.ci.juneau.ak.us 2.6.18-398.el5 #1 SMP Tue Sep 16 20:50:52 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux This is CentOS release 5.11 (Final) This is Perl version 5.008008 (5.8.8) This is MailScanner version 4.84.5 ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 From jeremy at fluxlabs.net Tue Dec 2 19:49:56 2014 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue, 2 Dec 2014 19:49:56 +0000 Subject: Bounces from Yahoo In-Reply-To: References: Message-ID: The reason is double subject lines. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Dec 2, 2014, at 1:24 PM, Kevin Miller > wrote: Every now and then, my users will send to Yahoo and the mail bounces. The cause is duplicate subject headers. SOMEONE at yahoo.com on 12/1/2014 3:52 PM Diagnostic code = NoDiagnostic; Reason code = TransferFailed; Status code = 500 #5.0.0 SMTP; 554 Message not allowed - Headers are not RFC compliant[291]> There's a similar thread over in the Baruwa neighborhood, but apparently it's a MailScanner bug. They mention a fix over there but I don't know that it's made it to github for MailScanner yet. http://baruwa-users-list.963389.n3.nabble.com/Yahoo-Headers-are-not-RFC-compliant-td4027435.html Anyone else having this issue? Any patch files out for it? Running on: Linux smtp.ci.juneau.ak.us 2.6.18-398.el5 #1 SMP Tue Sep 16 20:50:52 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux This is CentOS release 5.11 (Final) This is Perl version 5.008008 (5.8.8) This is MailScanner version 4.84.5 ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141202/2d2b5c0b/attachment.html From sbanderson at impromed.com Tue Dec 2 19:55:25 2014 From: sbanderson at impromed.com (Scott B. Anderson) Date: Tue, 2 Dec 2014 19:55:25 +0000 Subject: Bounces from Yahoo In-Reply-To: References: Message-ID: I have also seen this error regarding multiple subject headers from some sites. What is the fix? Scott > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- > bounces at lists.mailscanner.info] On Behalf Of Kevin Miller > Sent: Tuesday, December 02, 2014 1:12 PM > To: MailScanner List (mailscanner at lists.mailscanner.info) > Subject: Bounces from Yahoo > > Every now and then, my users will send to Yahoo and the mail bounces. The > cause is duplicate subject headers. > > SOMEONE at yahoo.com on 12/1/2014 3:52 PM > Diagnostic code = NoDiagnostic; Reason code = TransferFailed; Status code > = 500 > are not RFC compliant[291]> > > There's a similar thread over in the Baruwa neighborhood, but apparently it's a > MailScanner bug. They mention a fix over there but I don't know that it's made it > to github for MailScanner yet. > > http://baruwa-users-list.963389.n3.nabble.com/Yahoo-Headers-are-not-RFC- > compliant-td4027435.html > > Anyone else having this issue? Any patch files out for it? > > Running on: > Linux smtp.ci.juneau.ak.us 2.6.18-398.el5 #1 SMP Tue Sep 16 20:50:52 EDT 2014 > x86_64 x86_64 x86_64 GNU/Linux This is CentOS release 5.11 (Final) This is Perl > version 5.008008 (5.8.8) > > This is MailScanner version 4.84.5 > > ...Kevin > -- > Kevin Miller > Network/email Administrator, CBJ MIS Dept. > 155 South Seward Street > Juneau, Alaska 99801 > Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! ... -- Rely On Us. ImproMed LLC -- From jeremy at fluxlabs.net Tue Dec 2 20:01:31 2014 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue, 2 Dec 2014 20:01:31 +0000 Subject: Bounces from Yahoo In-Reply-To: References: , Message-ID: <9B499DE5-8B8F-49D7-B150-446CE5EA7DB7@fluxlabs.net> Oops. Didn't see you said that already. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Dec 2, 2014, at 2:00 PM, Jeremy McSpadden > wrote: The reason is double subject lines. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Dec 2, 2014, at 1:24 PM, Kevin Miller > wrote: Every now and then, my users will send to Yahoo and the mail bounces. The cause is duplicate subject headers. SOMEONE at yahoo.com on 12/1/2014 3:52 PM Diagnostic code = NoDiagnostic; Reason code = TransferFailed; Status code = 500 #5.0.0 SMTP; 554 Message not allowed - Headers are not RFC compliant[291]> There's a similar thread over in the Baruwa neighborhood, but apparently it's a MailScanner bug. They mention a fix over there but I don't know that it's made it to github for MailScanner yet. http://baruwa-users-list.963389.n3.nabble.com/Yahoo-Headers-are-not-RFC-compliant-td4027435.html Anyone else having this issue? Any patch files out for it? Running on: Linux smtp.ci.juneau.ak.us 2.6.18-398.el5 #1 SMP Tue Sep 16 20:50:52 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux This is CentOS release 5.11 (Final) This is Perl version 5.008008 (5.8.8) This is MailScanner version 4.84.5 ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141202/d26afb15/attachment.html From rcooper at dwford.com Tue Dec 2 20:06:53 2014 From: rcooper at dwford.com (Rick Cooper) Date: Tue, 2 Dec 2014 15:06:53 -0500 Subject: Bounces from Yahoo In-Reply-To: References: Message-ID: This was supposedly addressed in 2009 by Jules see: http://lists.mailscanner.info/pipermail/mailscanner/2009-September/093185.ht ml But that was exim specific, what MTA is involved here? Rick _____ From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: Tuesday, December 02, 2014 2:50 PM To: MailScanner discussion Subject: Re: Bounces from Yahoo The reason is double subject lines. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Dec 2, 2014, at 1:24 PM, Kevin Miller wrote: Every now and then, my users will send to Yahoo and the mail bounces. The cause is duplicate subject headers. SOMEONE at yahoo.com on 12/1/2014 3:52 PM Diagnostic code = NoDiagnostic; Reason code = TransferFailed; Status code = 500 There's a similar thread over in the Baruwa neighborhood, but apparently it's a MailScanner bug. They mention a fix over there but I don't know that it's made it to github for MailScanner yet. http://baruwa-users-list.963389.n3.nabble.com/Yahoo-Headers-are-not-RFC-comp liant-td4027435.html Anyone else having this issue? Any patch files out for it? Running on: Linux smtp.ci.juneau.ak.us 2.6.18-398.el5 #1 SMP Tue Sep 16 20:50:52 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux This is CentOS release 5.11 (Final) This is Perl version 5.008008 (5.8.8) This is MailScanner version 4.84.5 ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141202/1706ea78/attachment.html From kevin.miller at juneau.org Tue Dec 2 20:11:42 2014 From: kevin.miller at juneau.org (Kevin Miller) Date: Tue, 2 Dec 2014 20:11:42 +0000 Subject: Bounces from Yahoo In-Reply-To: References: Message-ID: <9ce482e4eb7a4b529fc77f5ec3848929@City-Exch-DB1.cbj.local> Yes, I know. Hence the "The cause is duplicate subject headers." in my post. The question is, how do I fix it? Yahoo apparently does something that causes MailScanner to do that. Maybe some mutant grey-list process? I dunno. I can't duplicate it at will - if users wait a while and resend the message will go through, I think because it hits a different ingress server. Andrew Lissa writes that it's fixed over there: "It is an issue within MailScanner not baruwa, will try get some time to push it into MailScanner proper on Github, since the enterprise MailScanner is a fork it requires some time to do so. Will do that when I get some space time, hands full at the moment." Be nice to see the patches in MailScanner proper. ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: Tuesday, December 02, 2014 10:50 AM To: MailScanner discussion Subject: Re: Bounces from Yahoo The reason is double subject lines. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Dec 2, 2014, at 1:24 PM, Kevin Miller > wrote: Every now and then, my users will send to Yahoo and the mail bounces. The cause is duplicate subject headers. SOMEONE at yahoo.com on 12/1/2014 3:52 PM Diagnostic code = NoDiagnostic; Reason code = TransferFailed; Status code = 500 #5.0.0 SMTP; 554 Message not allowed - Headers are not RFC compliant[291]> There's a similar thread over in the Baruwa neighborhood, but apparently it's a MailScanner bug. They mention a fix over there but I don't know that it's made it to github for MailScanner yet. http://baruwa-users-list.963389.n3.nabble.com/Yahoo-Headers-are-not-RFC-compliant-td4027435.html Anyone else having this issue? Any patch files out for it? Running on: Linux smtp.ci.juneau.ak.us 2.6.18-398.el5 #1 SMP Tue Sep 16 20:50:52 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux This is CentOS release 5.11 (Final) This is Perl version 5.008008 (5.8.8) This is MailScanner version 4.84.5 ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141202/d075e889/attachment.html From kevin.miller at juneau.org Tue Dec 2 20:19:02 2014 From: kevin.miller at juneau.org (Kevin Miller) Date: Tue, 2 Dec 2014 20:19:02 +0000 Subject: Bounces from Yahoo In-Reply-To: References: Message-ID: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> In my case, sendmail. ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Rick Cooper Sent: Tuesday, December 02, 2014 11:07 AM To: 'MailScanner discussion' Subject: RE: Bounces from Yahoo This was supposedly addressed in 2009 by Jules see: http://lists.mailscanner.info/pipermail/mailscanner/2009-September/093185.html But that was exim specific, what MTA is involved here? Rick ________________________________ From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: Tuesday, December 02, 2014 2:50 PM To: MailScanner discussion Subject: Re: Bounces from Yahoo The reason is double subject lines. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Dec 2, 2014, at 1:24 PM, Kevin Miller > wrote: Every now and then, my users will send to Yahoo and the mail bounces. The cause is duplicate subject headers. SOMEONE at yahoo.com on 12/1/2014 3:52 PM Diagnostic code = NoDiagnostic; Reason code = TransferFailed; Status code = 500 #5.0.0 SMTP; 554 Message not allowed - Headers are not RFC compliant[291]> There's a similar thread over in the Baruwa neighborhood, but apparently it's a MailScanner bug. They mention a fix over there but I don't know that it's made it to github for MailScanner yet. http://baruwa-users-list.963389.n3.nabble.com/Yahoo-Headers-are-not-RFC-compliant-td4027435.html Anyone else having this issue? Any patch files out for it? Running on: Linux smtp.ci.juneau.ak.us 2.6.18-398.el5 #1 SMP Tue Sep 16 20:50:52 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux This is CentOS release 5.11 (Final) This is Perl version 5.008008 (5.8.8) This is MailScanner version 4.84.5 ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141202/76bd2e56/attachment.html From rcooper at dwford.com Tue Dec 2 21:29:37 2014 From: rcooper at dwford.com (Rick Cooper) Date: Tue, 2 Dec 2014 16:29:37 -0500 Subject: Bounces from Yahoo In-Reply-To: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> Message-ID: <999FAE18E4344005BCFD1094438097AF@SAHOMELT> Looking through the code I kind of wonder if this is an uninteded consequence of the MailScanner.conf line: Place New Headers At Top Of Message How is yours set? The ReplaceHeader function does not do a delete if that options is set to yes near as I can tell by # DKIM: Don't do DeleteHeader if only adding headers at top $this->DeleteHeader($message, $key) unless $message->{dkimfriendly}; _____ From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Kevin Miller Sent: Tuesday, December 02, 2014 3:19 PM To: 'MailScanner discussion' Subject: RE: Bounces from Yahoo In my case, sendmail. ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Rick Cooper Sent: Tuesday, December 02, 2014 11:07 AM To: 'MailScanner discussion' Subject: RE: Bounces from Yahoo This was supposedly addressed in 2009 by Jules see: http://lists.mailscanner.info/pipermail/mailscanner/2009-September/093185.ht ml But that was exim specific, what MTA is involved here? Rick _____ From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: Tuesday, December 02, 2014 2:50 PM To: MailScanner discussion Subject: Re: Bounces from Yahoo The reason is double subject lines. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Dec 2, 2014, at 1:24 PM, Kevin Miller wrote: Every now and then, my users will send to Yahoo and the mail bounces. The cause is duplicate subject headers. SOMEONE at yahoo.com on 12/1/2014 3:52 PM Diagnostic code = NoDiagnostic; Reason code = TransferFailed; Status code = 500 There's a similar thread over in the Baruwa neighborhood, but apparently it's a MailScanner bug. They mention a fix over there but I don't know that it's made it to github for MailScanner yet. http://baruwa-users-list.963389.n3.nabble.com/Yahoo-Headers-are-not-RFC-comp liant-td4027435.html Anyone else having this issue? Any patch files out for it? Running on: Linux smtp.ci.juneau.ak.us 2.6.18-398.el5 #1 SMP Tue Sep 16 20:50:52 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux This is CentOS release 5.11 (Final) This is Perl version 5.008008 (5.8.8) This is MailScanner version 4.84.5 ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141202/5c0e8884/attachment.html From kevin.miller at juneau.org Tue Dec 2 22:19:12 2014 From: kevin.miller at juneau.org (Kevin Miller) Date: Tue, 2 Dec 2014 22:19:12 +0000 Subject: Bounces from Yahoo In-Reply-To: <999FAE18E4344005BCFD1094438097AF@SAHOMELT> References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> <999FAE18E4344005BCFD1094438097AF@SAHOMELT> Message-ID: <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> Mine are set to the top. I don't have DKIM set up however. Not sure if that matters. I don't think I've ever changed that and have been running MailScanner since 2003 or so. It's only become an issue for us recently. ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 From glenn.steen at gmail.com Wed Dec 3 08:50:14 2014 From: glenn.steen at gmail.com (Glenn Steen) Date: Wed, 3 Dec 2014 09:50:14 +0100 Subject: Bounces from Yahoo In-Reply-To: <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> <999FAE18E4344005BCFD1094438097AF@SAHOMELT> <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> Message-ID: Hi Kevin! Well, If you don't need to reorder the headers, why not try change that setting?;-) And I wounder... Do you use Baruwa? Their MailScanner isn't "MailScanner" as such, it is Baruwa MailScanner... Over the years we've had a few "forks", and well... One need ask these things, to clear up if the error is present in the current plain-vanilla code:-) Cheers -- -- Glenn On 2 December 2014 at 23:19, Kevin Miller wrote: > Mine are set to the top. I don't have DKIM set up however. Not sure if that matters. > > I don't think I've ever changed that and have been running MailScanner since 2003 or so. It's only become an issue for us recently. > > > ...Kevin > -- > Kevin Miller > Network/email Administrator, CBJ MIS Dept. > 155 South Seward Street > Juneau, Alaska 99801 > Phone: (907) 586-0242, Fax: (907) 586-4500 > Registered Linux User No: 307357 > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From rcooper at dwford.com Wed Dec 3 16:42:26 2014 From: rcooper at dwford.com (Rick Cooper) Date: Wed, 3 Dec 2014 11:42:26 -0500 Subject: Bounces from Yahoo In-Reply-To: <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local><999FAE18E4344005BCFD1094438097AF@SAHOMELT> <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> Message-ID: Kevin Miller wrote: > Mine are set to the top. I don't have DKIM set up however. Not sure > if that matters. > > I don't think I've ever changed that and have been running > MailScanner since 2003 or so. It's only become an issue for us > recently. > > > ...Kevin > -- > Kevin Miller > Network/email Administrator, CBJ MIS Dept. > 155 South Seward Street > Juneau, Alaska 99801 > Phone: (907) 586-0242, Fax: (907) 586-4500 > Registered Linux User No: 307357 Doesn't matter if you use DKIM or not, if you don't then there is no reason to be concerned about maintaining header order as you cannot break the signature if none exist unless you are forwarding for a system that does sign their messages. Since this has never occurred for me I have no way to get an original message but I am wondering, since it always seems to be the subject that is duplicated, if it has something to do with the subject rewrite settings, or a syntax issue with the original subject line not matching the test for delete header From kevin.miller at juneau.org Wed Dec 3 18:50:09 2014 From: kevin.miller at juneau.org (Kevin Miller) Date: Wed, 3 Dec 2014 18:50:09 +0000 Subject: Bounces from Yahoo In-Reply-To: References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> <999FAE18E4344005BCFD1094438097AF@SAHOMELT> <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> Message-ID: It's worth a shot I guess. I don't use Baruwa - that was just where we found a similar symptom reported. Rick noted that there was a similar issue for exim from 2009. Baruwa uses exim IIRC so maybe it was a lingering bug that Julian fixed part of and the other part was more subtle? I run a pretty much plain vanilla MailScanner, with MailWatch. I tried Baruwa but had issues getting it running (which I now forget) and didn't really want to learn exim so I cut my losses and bailed on that. Some of my users have a bad habit of using their company email for personal stuff (institutionally we don't really care) but may try forwarding stuff so this gives me pause: # So if some of your users forward mail from PayPal, Ebay or Yahoo! to # accounts stored on Gmail or Googlemail, then you need to set this to "yes" # and "Multiple Headers = add" to avoid breaking the DKIM signature. On the other hand, if it is personal stuff I don't have any particular obligation to make it work. There may be times though that they need to forward business related mail. I guess we'll see. I'll apply these changes and see what happens. #mkm Multiple Headers = add Multiple Headers = append #mkm Place New Headers At Top Of Message = yes Place New Headers At Top Of Message = no Unfortunately, we can't duplicate the problem at will. It just happens sometimes... ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- > bounces at lists.mailscanner.info] On Behalf Of Glenn Steen > Sent: Tuesday, December 02, 2014 11:50 PM > To: MailScanner discussion > Subject: Re: Bounces from Yahoo > > Hi Kevin! > > Well, If you don't need to reorder the headers, why not try change that > setting?;-) > > And I wounder... Do you use Baruwa? Their MailScanner isn't > "MailScanner" as such, it is Baruwa MailScanner... Over the years we've > had a few "forks", and well... One need ask these things, to clear up if > the error is present in the current plain-vanilla code:-) > > Cheers > -- > -- Glenn > > > On 2 December 2014 at 23:19, Kevin Miller > wrote: > > Mine are set to the top. I don't have DKIM set up however. Not sure > if that matters. > > > > I don't think I've ever changed that and have been running MailScanner > since 2003 or so. It's only become an issue for us recently. > > > > > > ...Kevin > > -- > > Kevin Miller > > Network/email Administrator, CBJ MIS Dept. > > 155 South Seward Street > > Juneau, Alaska 99801 > > Phone: (907) 586-0242, Fax: (907) 586-4500 > > Registered Linux User No: 307357 > > -- > > MailScanner mailing list > > mailscanner at lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > Support MailScanner development - buy the book off the website! > > > > -- > -- Glenn > email: glenn < dot > steen < at > gmail < dot > com > work: glenn < dot > steen < at > ap1 < dot > se > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From kevin.miller at juneau.org Wed Dec 3 18:52:32 2014 From: kevin.miller at juneau.org (Kevin Miller) Date: Wed, 3 Dec 2014 18:52:32 +0000 Subject: Bounces from Yahoo In-Reply-To: References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local><999FAE18E4344005BCFD1094438097AF@SAHOMELT> <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> Message-ID: > -----Original Message----- > Doesn't matter if you use DKIM or not, if you don't then there is no > reason to be concerned about maintaining header order as you cannot break > the signature if none exist unless you are forwarding for a system that > does sign their messages. Since this has never occurred for me I have no way > to get an original message but I am wondering, since it always seems to be > the subject that is duplicated, if it has something to do with the subject > rewrite settings, or a syntax issue with the original subject line not > matching the test for delete header I just replied to Glenn - going to give it a shot and see what happens. It may break forwarding, but that may or may not be an issue... ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 From jeremy at fluxlabs.net Thu Dec 4 16:23:59 2014 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Thu, 4 Dec 2014 16:23:59 +0000 Subject: Bounces from Yahoo In-Reply-To: References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> <999FAE18E4344005BCFD1094438097AF@SAHOMELT> <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> Message-ID: <8BDD3C9E-571F-403E-88E8-B42101B57C81@fluxlabs.net> Baruwa Community uses sources from mailscanner.info for its install guide. Baruwa Enterprise has a patched/modified version of MS only available to paid. Andrew from the Baruwa Project has supplied me with the patch necessary to fix the issue. Can anyone get this added ? I will supply to whoever needs it. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Dec 3, 2014, at 2:50 AM, Glenn Steen > wrote: Hi Kevin! Well, If you don't need to reorder the headers, why not try change that setting?;-) And I wounder... Do you use Baruwa? Their MailScanner isn't "MailScanner" as such, it is Baruwa MailScanner... Over the years we've had a few "forks", and well... One need ask these things, to clear up if the error is present in the current plain-vanilla code:-) Cheers -- -- Glenn -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141204/141163b7/attachment.html From steve.freegard at fsl.com Thu Dec 4 22:35:51 2014 From: steve.freegard at fsl.com (Steve Freegard) Date: Thu, 04 Dec 2014 22:35:51 +0000 Subject: Bounces from Yahoo In-Reply-To: <8BDD3C9E-571F-403E-88E8-B42101B57C81@fluxlabs.net> References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> <999FAE18E4344005BCFD1094438097AF@SAHOMELT> <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> <8BDD3C9E-571F-403E-88E8-B42101B57C81@fluxlabs.net> <5480E1C7.80608@fsl.com> Message-ID: On 04/12/14 16:23, Jeremy McSpadden wrote: > Baruwa Enterprise has a patched/modified version of MS only available to > paid. Um - isn't that a violation of the GPL? Any modifications to code that is part of MailScanner should have the sources available to anyone that requests it (typically it's easiest to put patches up on a website though, to avoid CD requests). At FSL we made a point of contributing anything we did to MailScanner back to the community; like ConfigSQL which I expect Baruwa uses. Kind regards, Steve. From jeremy at fluxlabs.net Thu Dec 4 22:51:38 2014 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Thu, 4 Dec 2014 22:51:38 +0000 Subject: Bounces from Yahoo In-Reply-To: References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> <999FAE18E4344005BCFD1094438097AF@SAHOMELT> <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> <8BDD3C9E-571F-403E-88E8-B42101B57C81@fluxlabs.net> <5480E1C7.80608@fsl.com>, Message-ID: <4D3ADE11-5261-4134-A0CC-92C384A6D943@fluxlabs.net> I believe you also have a private RPM build /repo that is only available to paid customers ? I believe that's all they have done. I will upload the patch and post shortly. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Dec 4, 2014, at 4:46 PM, Steve Freegard > wrote: On 04/12/14 16:23, Jeremy McSpadden wrote: Baruwa Enterprise has a patched/modified version of MS only available to paid. Um - isn't that a violation of the GPL? Any modifications to code that is part of MailScanner should have the sources available to anyone that requests it (typically it's easiest to put patches up on a website though, to avoid CD requests). At FSL we made a point of contributing anything we did to MailScanner back to the community; like ConfigSQL which I expect Baruwa uses. Kind regards, Steve. -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141204/470b8a07/attachment.html From kevin.miller at juneau.org Thu Dec 4 23:02:34 2014 From: kevin.miller at juneau.org (Kevin Miller) Date: Thu, 4 Dec 2014 23:02:34 +0000 Subject: Bounces from Yahoo In-Reply-To: <4D3ADE11-5261-4134-A0CC-92C384A6D943@fluxlabs.net> References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> <999FAE18E4344005BCFD1094438097AF@SAHOMELT> <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> <8BDD3C9E-571F-403E-88E8-B42101B57C81@fluxlabs.net> <5480E1C7.80608@fsl.com>, <4D3ADE11-5261-4134-A0CC-92C384A6D943@fluxlabs.net> Message-ID: > I will upload the patch and post shortly. Thanks Jeremy. Is it exim specific or more generic? ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141204/ff743915/attachment.html From jerry.benton at mailborder.com Thu Dec 4 23:45:37 2014 From: jerry.benton at mailborder.com (Jerry Benton) Date: Thu, 4 Dec 2014 18:45:37 -0500 Subject: Bounces from Yahoo In-Reply-To: <8BDD3C9E-571F-403E-88E8-B42101B57C81@fluxlabs.net> References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> <999FAE18E4344005BCFD1094438097AF@SAHOMELT> <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> <8BDD3C9E-571F-403E-88E8-B42101B57C81@fluxlabs.net> Message-ID: <552F48C8-DE55-4CFE-A4CD-09752ADA2665@mailborder.com> Yes, I can add it. - Jerry Benton www.mailborder.com > On Dec 4, 2014, at 11:23 AM, Jeremy McSpadden wrote: > > Baruwa Community uses sources from mailscanner.info for its install guide. > > Baruwa Enterprise has a patched/modified version of MS only available to paid. > > Andrew from the Baruwa Project has supplied me with the patch necessary to fix the issue. Can anyone get this added ? I will supply to whoever needs it. > > -- > Jeremy McSpadden > Flux Labs | http://www.fluxlabs.net | Endless Solutions > Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 > >> On Dec 3, 2014, at 2:50 AM, Glenn Steen > wrote: >> >> Hi Kevin! >> >> Well, If you don't need to reorder the headers, why not try change >> that setting?;-) >> >> And I wounder... Do you use Baruwa? Their MailScanner isn't >> "MailScanner" as such, it is Baruwa MailScanner... Over the years >> we've had a few "forks", and well... One need ask these things, to >> clear up if the error is present in the current plain-vanilla code:-) >> >> Cheers >> -- >> -- Glenn >> >> > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141204/4bafb9b8/attachment.html From andrew at topdog.za.net Fri Dec 5 07:39:25 2014 From: andrew at topdog.za.net (Andrew Colin Kissa) Date: Fri, 5 Dec 2014 09:39:25 +0200 Subject: Bounces from Yahoo In-Reply-To: References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> <999FAE18E4344005BCFD1094438097AF@SAHOMELT> <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> <8BDD3C9E-571F-403E-88E8-B42101B57C81@fluxlabs.net> <5480E1C7.80608@fsl.com> Message-ID: On 05 Dec 2014, at 12:35 AM, Steve Freegard wrote: > Um - isn't that a violation of the GPL? Any modifications to code that > is part of MailScanner should have the sources available to anyone that > requests it (typically it's easiest to put patches up on a website > though, to avoid CD requests). > > At FSL we made a point of contributing anything we did to MailScanner > back to the community; like ConfigSQL which I expect Baruwa uses. Just to clarify, most of our changes are not compatible with mailscanner proper, for example we have no interest in any other MTA apart from Exim thus we have stripped all that code out. We have code in to hook up search indexing which too would not be compatible. All other changes that are compatible we have pushed to Github. At no point have we withheld our changes from anyone who has requested them. As stated on the Baruwa mailing list anyone is welcome to request our tree and shift through it and pull out whatever they want to and incorporate in mailscanner proper. I just do not have the time to do it right now. - Andrew -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 841 bytes Desc: Message signed with OpenPGP using GPGMail Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141205/d20dc065/attachment.bin From andrew at topdog.za.net Fri Dec 5 08:25:37 2014 From: andrew at topdog.za.net (Andrew Colin Kissa) Date: Fri, 5 Dec 2014 10:25:37 +0200 Subject: Bounces from Yahoo In-Reply-To: References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> <999FAE18E4344005BCFD1094438097AF@SAHOMELT> <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> Message-ID: <45236BA5-478D-4FEB-A018-798AEDEE8339@topdog.za.net> On 03 Dec 2014, at 8:50 PM, Kevin Miller wrote: > Unfortunately, we can't duplicate the problem at will. It just happens sometimes? A simple way to trigger it with Exim i found was to have space before the subject text. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 841 bytes Desc: Message signed with OpenPGP using GPGMail Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141205/65e86210/attachment.bin From andrew at topdog.za.net Fri Dec 5 08:28:04 2014 From: andrew at topdog.za.net (Andrew Colin Kissa) Date: Fri, 5 Dec 2014 10:28:04 +0200 Subject: Bounces from Yahoo In-Reply-To: References: <1e6fe8d8453c4cf6a4cf35e70d85d4b2@City-Exch-DB1.cbj.local> <999FAE18E4344005BCFD1094438097AF@SAHOMELT> <119f2ac5379247cdb10ff1f960404dbc@City-Exch-DB1.cbj.local> <8BDD3C9E-571F-403E-88E8-B42101B57C81@fluxlabs.net> <5480E1C7.80608@fsl.com>, <4D3ADE11-5261-4134-A0CC-92C384A6D943@fluxlabs.net> Message-ID: <75BE860F-4B96-4E4E-A6AF-CC93FB240584@topdog.za.net> On 05 Dec 2014, at 1:02 AM, Kevin Miller wrote: > Thanks Jeremy. Is it exim specific or more generic? It may work with other MTA's but only tested with Exim, Exim's header changes work differently from other MTA's as MailScanner just adds a flag to the -H file and Exim it self deletes the header. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 841 bytes Desc: Message signed with OpenPGP using GPGMail Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141205/dd48efaf/attachment.bin From mejaz at cyberia.net.sa Thu Dec 11 13:30:04 2014 From: mejaz at cyberia.net.sa (Mohammed Ejaz) Date: Thu, 11 Dec 2014 16:30:04 +0300 Subject: Email-bounce. Message-ID: <01c101d01546$94c9c6d0$be5d5470$@cyberia.net.sa> hello, some of my user receiving the below error when sending their emails, would you please shed some light what could be the reason for it. thanks in advance Ejaz Our virus detector failed to completely analyse a message you sent:- To: irene.gorget at lactalis.com.ua Subject: RE: current result versus B2015 - UFIC Date: Thu Dec 11 14:59:29 2014 Any parts of the message that could not be analysed will not have been delivered. If you are using Microsoft Outlook, we strongly recommend you change your outgoing message format from "Rich Text" to "HTML" or "Plain Text". 1) Click on the "Tools" menu and choose "Options..." 2) Go to the "Mail Format" tab 3) For message format, select "HTML" or "Plain text" 4) Click OK The virus detector said this about the message: Report: Report: MailScanner: Message attempted to kill MailScanner -- MailScanner Email Virus Scanner Your Organisation Name Here www.your-organisation.com For all your IT requirements visit: http://www.transtec.co.uk Please don't print this e-mail unless you really need to. Save -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141211/813686ff/attachment.html From jerry.benton at mailborder.com Thu Dec 11 15:14:50 2014 From: jerry.benton at mailborder.com (Jerry Benton) Date: Thu, 11 Dec 2014 10:14:50 -0500 Subject: Email-bounce. In-Reply-To: <01c101d01546$94c9c6d0$be5d5470$@cyberia.net.sa> References: <01c101d01546$94c9c6d0$be5d5470$@cyberia.net.sa> Message-ID: <5A17ACB9-1E64-417F-A423-F2B913670B02@mailborder.com> TNEF issue. You can replace your TNEF.pm with this version: https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/TNEF.pm Restart MailScanner. - Jerry Benton www.mailborder.com > On Dec 11, 2014, at 8:30 AM, Mohammed Ejaz wrote: > > > > > hello, > > some of my user receiving the below error when sending their emails, would you please shed some light what could be the reason for it. thanks in advance > > Ejaz > > > > > Our virus detector failed to completely analyse a message you sent:- > To: irene.gorget at lactalis.com.ua > Subject: RE: current result versus B2015 - UFIC > Date: Thu Dec 11 14:59:29 2014 > Any parts of the message that could not be analysed will not have been delivered. > > If you are using Microsoft Outlook, we strongly recommend you change your outgoing message format from "Rich Text" to "HTML" or "Plain Text". > > 1) Click on the "Tools" menu and choose "Options..." > 2) Go to the "Mail Format" tab > 3) For message format, select "HTML" or "Plain text" > 4) Click OK > > The virus detector said this about the message: > Report: Report: MailScanner: Message attempted to kill MailScanner > > > -- > MailScanner > Email Virus Scanner > Your Organisation Name Here > www.your-organisation.com > > For all your IT requirements visit: http://www.transtec.co.uk > > Please don't print this e-mail unless you really need to. Save > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141211/5956de80/attachment.html From maxsec at gmail.com Thu Dec 11 15:18:03 2014 From: maxsec at gmail.com (Martin Hepworth) Date: Thu, 11 Dec 2014 15:18:03 +0000 Subject: Email-bounce. In-Reply-To: <01c101d01546$94c9c6d0$be5d5470$@cyberia.net.sa> References: <01c101d01546$94c9c6d0$be5d5470$@cyberia.net.sa> Message-ID: Hi are you using mailscanner as an outbound checker for email? In which case you need to check the users are sending in html format and also adjust the MailScanner signature settings so you get a more helpful message out of it. If not then the folks at the destination need to look at their MailScanner setup, and you need to stop sending in RTF as the message suggests -- Martin Hepworth, CISSP Oxford, UK On 11 December 2014 at 13:30, Mohammed Ejaz wrote: > > > > > > > hello, > > > > some of my user receiving the below error when sending their emails, > would you please shed some light what could be the reason for it. thanks in > advance > > > > Ejaz > > > > > > > > > > Our virus detector failed to completely analyse a message you sent:- > > To: irene.gorget at lactalis.com.ua > > Subject: RE: current result versus B2015 - UFIC > > Date: Thu Dec 11 14:59:29 2014 > > Any parts of the message that could not be analysed will not have been > delivered. > > > > If you are using Microsoft Outlook, we strongly recommend you change your > outgoing message format from "Rich Text" to "HTML" or "Plain Text". > > > > 1) Click on the "Tools" menu and choose "Options..." > > 2) Go to the "Mail Format" tab > > 3) For message format, select "HTML" or "Plain text" > > 4) Click OK > > > > The virus detector said this about the message: > > Report: Report: MailScanner: Message attempted to kill MailScanner > > > > > > -- > > MailScanner > > Email Virus Scanner > > Your Organisation Name Here > > www.your-organisation.com > > > > For all your IT requirements visit: http://www.transtec.co.uk > > > > Please don't print this e-mail unless you really need to. Save > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141211/593631eb/attachment.html From t.sovandara at gmail.com Mon Dec 15 02:24:49 2014 From: t.sovandara at gmail.com (t dara) Date: Mon, 15 Dec 2014 09:24:49 +0700 Subject: Have problem with MailScanner 4.84.6 Cannot Add inline signature Message-ID: Hello, I have problem with MailScanner 4.84.6 Cannot Add inline signature. I see in config file, By default it should be add inline signature. I already to try restart MailScanner and didn't see any error message. Here is my configration Inline HTML Signature = %report-dir%/inline.sig.html Inline Text Signature = %report-dir%/inline.sig.txt Sign Clean Messages = yes Thanks for your help, Sovandara -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141215/ed8e811e/attachment.html From maxsec at gmail.com Mon Dec 15 16:21:12 2014 From: maxsec at gmail.com (Martin Hepworth) Date: Mon, 15 Dec 2014 16:21:12 +0000 Subject: Have problem with MailScanner 4.84.6 Cannot Add inline signature In-Reply-To: References: Message-ID: and MailScanner is definitely scanning those messages as they go through your system? -- Martin Hepworth, CISSP Oxford, UK On 15 December 2014 at 02:24, t dara wrote: > > Hello, > > I have problem with MailScanner 4.84.6 Cannot Add inline signature. > I see in config file, By default it should be add inline signature. I > already to try restart MailScanner and didn't see any error message. > > Here is my configration > Inline HTML Signature = %report-dir%/inline.sig.html > Inline Text Signature = %report-dir%/inline.sig.txt > Sign Clean Messages = yes > > Thanks for your help, > Sovandara > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141215/63dbd513/attachment.html From ugo.vasi at procne.it Mon Dec 15 17:05:28 2014 From: ugo.vasi at procne.it (Ugo Vasi) Date: Mon, 15 Dec 2014 18:05:28 +0100 Subject: TNEF in postfix hold path Message-ID: <548F14D8.4060909@procne.it> Hi all, in a recent installation (debian 7 + mailscanner 4.84.5-4~wheezy + postfix 2.9.6-2) I see this warnings in mail.log: Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnefwaSOJu: uid 102: not a regular file Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnef0R36P5: uid 102: not a regular file Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnefTBC2pw: uid 102: not a regular file Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnefvBgPij: uid 102: not a regular file Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnef9a5yNc: uid 102: not a regular file Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnef2XEO6H: uid 102: not a regular file Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnefceRLQ7: uid 102: not a regular file Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnefFF_uw1: uid 102: not a regular file Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnefq6wleV: uid 102: not a regular file Infact, in the /var/spool/postfix/hold folder, I see these "tnef*" folders that are deleted after a while. I suspect that MailScanner use the TNEF E?expander (/usr/bin/tnef) in the postfix's hold directory. It seems that this does not create problems to the email flow but it is strange... Who can help me to find a solution? Thanks -- U g o V a s i P r o c n e s.r.l >) via Cotonificio 45 33010 Tavagnacco IT phone: +390432486523 fax: +390432486523 Le informazioni contenute in questo messaggio sono riservate e confidenziali ed ? vietata la diffusione in qualunque modo eseguita. Qualora Lei non fosse la persona a cui il presente messaggio ? destinato, La invitiamo ad eliminarlo e a non leggerlo, dandocene gentilmente comunicazione. Per qualsiasi informazione si prega di contattare support at procne.it . Rif. D.L. 196/2003 From t.sovandara at gmail.com Tue Dec 16 07:19:38 2014 From: t.sovandara at gmail.com (t dara) Date: Tue, 16 Dec 2014 14:19:38 +0700 Subject: Have problem with MailScanner 4.84.6 Cannot Add inline signature In-Reply-To: References: Message-ID: Hi, I see the message go through MailScanner process. And I see MailScanner add its header to each mail that go thought it process. Thanks for your help On Mon, Dec 15, 2014 at 11:21 PM, Martin Hepworth wrote: > > and MailScanner is definitely scanning those messages as they go through > your system? > > -- > Martin Hepworth, CISSP > Oxford, UK > > On 15 December 2014 at 02:24, t dara wrote: > >> Hello, >> >> I have problem with MailScanner 4.84.6 Cannot Add inline signature. >> I see in config file, By default it should be add inline signature. I >> already to try restart MailScanner and didn't see any error message. >> >> Here is my configration >> Inline HTML Signature = %report-dir%/inline.sig.html >> Inline Text Signature = %report-dir%/inline.sig.txt >> Sign Clean Messages = yes >> >> Thanks for your help, >> Sovandara >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141216/8702d8f6/attachment.html From rd at vladville.com Tue Dec 16 18:21:44 2014 From: rd at vladville.com (Vlad Mazek) Date: Tue, 16 Dec 2014 13:21:44 -0500 Subject: MailScanner seems to be skipping messages Message-ID: Im running 4.81.4 with sendmail. I'm starting to see messages not going through MailScanner, is there any scenario you guys would think would cause a message to not be scanned. This is something that is sporadic. Maillogs dont show any entries for these message IDs, which in the past may have been attributed to cached scoring. But I'm not seeing the MailScanner header inserts at all. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141216/3b90d219/attachment.html From t.sovandara at gmail.com Thu Dec 18 01:47:55 2014 From: t.sovandara at gmail.com (t dara) Date: Thu, 18 Dec 2014 08:47:55 +0700 Subject: Have problem with MailScanner 4.84.6 Cannot Add inline signature In-Reply-To: References: Message-ID: Hi, Do you have any idea? Please help. Thanks, Sovandara -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141218/a281eaf6/attachment.html From maxsec at gmail.com Fri Dec 19 07:24:38 2014 From: maxsec at gmail.com (Martin Hepworth) Date: Fri, 19 Dec 2014 07:24:38 +0000 Subject: Have problem with MailScanner 4.84.6 Cannot Add inline signature In-Reply-To: References: Message-ID: No errrors at all in the logs at MailScanner startup and those files exist in the reports directory? -- Martin Hepworth, CISSP Oxford, UK On 18 December 2014 at 01:47, t dara wrote: > > Hi, > > Do you have any idea? Please help. > > Thanks, > Sovandara > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141219/eac5be40/attachment.html From t.sovandara at gmail.com Fri Dec 19 09:44:12 2014 From: t.sovandara at gmail.com (t dara) Date: Fri, 19 Dec 2014 16:44:12 +0700 Subject: Have problem with MailScanner 4.84.6 Cannot Add inline signature In-Reply-To: References: Message-ID: Hi, Yes the report file exist. Normally if report file not exist it will show error message, but on my case I didn't see any error message. Thanks, Sovandara On Fri, Dec 19, 2014 at 2:24 PM, Martin Hepworth wrote: > > No errrors at all in the logs at MailScanner startup and those files exist > in the reports directory? > > -- > Martin Hepworth, CISSP > Oxford, UK > > On 18 December 2014 at 01:47, t dara wrote: > >> Hi, >> >> Do you have any idea? Please help. >> >> Thanks, >> Sovandara >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141219/8a941e0a/attachment.html From maxsec at gmail.com Fri Dec 19 10:41:23 2014 From: maxsec at gmail.com (Martin Hepworth) Date: Fri, 19 Dec 2014 10:41:23 +0000 Subject: Have problem with MailScanner 4.84.6 Cannot Add inline signature In-Reply-To: References: Message-ID: Run a sessions in Debug mode and see what you get and any clues as to why it's not attaching the signature. -- Martin Hepworth, CISSP Oxford, UK On 19 December 2014 at 09:44, t dara wrote: > > Hi, > > Yes the report file exist. Normally if report file not exist it will show > error message, but on my case I didn't see any error message. > > Thanks, > Sovandara > > On Fri, Dec 19, 2014 at 2:24 PM, Martin Hepworth wrote: >> >> No errrors at all in the logs at MailScanner startup and those files >> exist in the reports directory? >> >> -- >> Martin Hepworth, CISSP >> Oxford, UK >> >> On 18 December 2014 at 01:47, t dara wrote: >> >>> Hi, >>> >>> Do you have any idea? Please help. >>> >>> Thanks, >>> Sovandara >>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141219/bc166f00/attachment.html From glenn.steen at gmail.com Fri Dec 19 17:24:15 2014 From: glenn.steen at gmail.com (Glenn Steen) Date: Fri, 19 Dec 2014 18:24:15 +0100 Subject: MailScanner seems to be skipping messages In-Reply-To: References: Message-ID: Do the received lines show th as t the MailScanner system is involved at all? Do you have any ruleset on Scan Messages? Cheers! -- -- Glenn Den 16 dec 2014 19:44 skrev "Vlad Mazek" : > Im running 4.81.4 with sendmail. > > I'm starting to see messages not going through MailScanner, is there any > scenario you guys would think would cause a message to not be scanned. This > is something that is sporadic. > > Maillogs dont show any entries for these message IDs, which in the past > may have been attributed to cached scoring. But I'm not seeing the > MailScanner header inserts at all. > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141219/c2e733dd/attachment.html From t.sovandara at gmail.com Sat Dec 20 01:59:49 2014 From: t.sovandara at gmail.com (t dara) Date: Sat, 20 Dec 2014 08:59:49 +0700 Subject: Have problem with MailScanner 4.84.6 Cannot Add inline signature In-Reply-To: References: Message-ID: Hi, To Run a sessions in Debug mode we just change Debug = no to Debug = yes Please see the log file as in the attachment file. Thanks, Sovandara On Fri, Dec 19, 2014 at 5:41 PM, Martin Hepworth wrote: > Run a sessions in Debug mode and see what you get and any clues as to why > it's not attaching the signature. > > -- > Martin Hepworth, CISSP > Oxford, UK > > On 19 December 2014 at 09:44, t dara wrote: >> >> Hi, >> >> Yes the report file exist. Normally if report file not exist it will show >> error message, but on my case I didn't see any error message. >> >> Thanks, >> Sovandara >> >> On Fri, Dec 19, 2014 at 2:24 PM, Martin Hepworth >> wrote: >>> >>> No errrors at all in the logs at MailScanner startup and those files >>> exist in the reports directory? >>> >>> -- >>> Martin Hepworth, CISSP >>> Oxford, UK >>> >>> On 18 December 2014 at 01:47, t dara wrote: >>> >>>> Hi, >>>> >>>> Do you have any idea? Please help. >>>> >>>> Thanks, >>>> Sovandara >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner at lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141220/d3806110/attachment.html -------------- next part -------------- Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: MailScanner E-Mail Virus Scanner version 4.84.6 starting... Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: Reading configuration file /etc/MailScanner/MailScanner.conf Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: Reading configuration file /etc/MailScanner/conf.d/README Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: Read 876 hostnames from the phishing whitelist Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: Read 5890 hostnames from the phishing blacklists Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: Config: calling custom init function MailWatchLogging Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: Started SQL Logging child Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: Using SpamAssassin results cache Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: Connected to SpamAssassin cache database Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: Enabling SpamAssassin auto-whitelist functionality... Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: Connected to Processing Attempts Database Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: Found 1 messages in the Processing Attempts Database Dec 20 08:46:31 103-224-31-74 MailScanner[19366]: Using locktype = flock Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: MailScanner E-Mail Virus Scanner version 4.84.6 starting... Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: Reading configuration file /etc/MailScanner/MailScanner.conf Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: Reading configuration file /etc/MailScanner/conf.d/README Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: Read 876 hostnames from the phishing whitelist Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: Read 5890 hostnames from the phishing blacklists Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: Config: calling custom init function MailWatchLogging Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: Started SQL Logging child Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: Using SpamAssassin results cache Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: Connected to SpamAssassin cache database Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: Enabling SpamAssassin auto-whitelist functionality... Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: Connected to Processing Attempts Database Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: Found 1 messages in the Processing Attempts Database Dec 20 08:46:36 103-224-31-74 MailScanner[19370]: Using locktype = flock Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: MailScanner E-Mail Virus Scanner version 4.84.6 starting... Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: Reading configuration file /etc/MailScanner/MailScanner.conf Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: Reading configuration file /etc/MailScanner/conf.d/README Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: Read 876 hostnames from the phishing whitelist Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: Read 5890 hostnames from the phishing blacklists Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: Config: calling custom init function MailWatchLogging Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: Started SQL Logging child Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: Using SpamAssassin results cache Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: Connected to SpamAssassin cache database Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: Enabling SpamAssassin auto-whitelist functionality... Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: Connected to Processing Attempts Database Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: Found 1 messages in the Processing Attempts Database Dec 20 08:46:41 103-224-31-74 MailScanner[19373]: Using locktype = flock Dec 20 08:46:46 103-224-31-74 MailScanner[19351]: Requeue: BD768A5BA2.A2F19 to 006D7A5BD3 From maxsec at gmail.com Sat Dec 20 15:13:29 2014 From: maxsec at gmail.com (Martin Hepworth) Date: Sat, 20 Dec 2014 15:13:29 +0000 Subject: Have problem with MailScanner 4.84.6 Cannot Add inline signature In-Reply-To: References: Message-ID: Ok that requeue aint good That debug run as the same user as 'run as' in the mailscanner.conf file? On Saturday, 20 December 2014, t dara wrote: > Hi, > > To Run a sessions in Debug mode we just change Debug = no to Debug = yes > Please see the log file as in the attachment file. > > Thanks, > Sovandara > > On Fri, Dec 19, 2014 at 5:41 PM, Martin Hepworth > wrote: > >> Run a sessions in Debug mode and see what you get and any clues as to why >> it's not attaching the signature. >> >> -- >> Martin Hepworth, CISSP >> Oxford, UK >> >> On 19 December 2014 at 09:44, t dara > > wrote: >>> >>> Hi, >>> >>> Yes the report file exist. Normally if report file not exist it will >>> show error message, but on my case I didn't see any error message. >>> >>> Thanks, >>> Sovandara >>> >>> On Fri, Dec 19, 2014 at 2:24 PM, Martin Hepworth >> > wrote: >>>> >>>> No errrors at all in the logs at MailScanner startup and those files >>>> exist in the reports directory? >>>> >>>> -- >>>> Martin Hepworth, CISSP >>>> Oxford, UK >>>> >>>> On 18 December 2014 at 01:47, t dara >>> > wrote: >>>> >>>>> Hi, >>>>> >>>>> Do you have any idea? Please help. >>>>> >>>>> Thanks, >>>>> Sovandara >>>>> >>>>> -- >>>>> MailScanner mailing list >>>>> mailscanner at lists.mailscanner.info >>>>> >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>> >>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner at lists.mailscanner.info >>>> >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > -- -- Martin Hepworth, CISSP Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141220/4dd56f46/attachment.html From rd at vladville.com Sun Dec 21 22:48:01 2014 From: rd at vladville.com (Vlad Mazek) Date: Sun, 21 Dec 2014 17:48:01 -0500 Subject: MailScanner seems to be skipping messages In-Reply-To: References: Message-ID: Glenn, None at all to your first question. And the settings is set to just "Yes" on that setting. just sendmail receives and then relays it no MS involvement at all even though there are instances of MS running. These are high volume systems. Would sendmail not being started from the MailScanner init.d cause something like this? On Fri, Dec 19, 2014 at 12:24 PM, Glenn Steen wrote: > Do the received lines show th as t the MailScanner system is involved at > all? > Do you have any ruleset on Scan Messages? > > Cheers! > -- > -- Glenn > Den 16 dec 2014 19:44 skrev "Vlad Mazek" : > >> Im running 4.81.4 with sendmail. >> >> I'm starting to see messages not going through MailScanner, is there any >> scenario you guys would think would cause a message to not be scanned. This >> is something that is sporadic. >> >> Maillogs dont show any entries for these message IDs, which in the past >> may have been attributed to cached scoring. But I'm not seeing the >> MailScanner header inserts at all. >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141221/d9261edf/attachment.html From kevin.miller at juneau.org Mon Dec 22 17:38:19 2014 From: kevin.miller at juneau.org (Kevin Miller) Date: Mon, 22 Dec 2014 17:38:19 +0000 Subject: MailScanner seems to be skipping messages In-Reply-To: References: Message-ID: <597a1f6b7c0d4951a93536f58b525694@City-Exch-DB2.cbj.local> I?ve seen cases where an update to sendmail would set it to start at boot time, so you end up with both MailScanner running as well as non-MailScanner related instances of sendmail. I?d stop all instances, do a chkconfig (or distro specific equivalent) to make sure that sendmail isn?t being started by the system. If it is, set it not to. The MailScanner init script starts sendmail with the appropriate arguments, of course. It may not be that at all ? but it?s where I?d look first? ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Vlad Mazek Sent: Sunday, December 21, 2014 1:48 PM To: MailScanner discussion Subject: Re: MailScanner seems to be skipping messages Glenn, None at all to your first question. And the settings is set to just "Yes" on that setting. just sendmail receives and then relays it no MS involvement at all even though there are instances of MS running. These are high volume systems. Would sendmail not being started from the MailScanner init.d cause something like this? On Fri, Dec 19, 2014 at 12:24 PM, Glenn Steen > wrote: Do the received lines show th as t the MailScanner system is involved at all? Do you have any ruleset on Scan Messages? Cheers! -- -- Glenn Den 16 dec 2014 19:44 skrev "Vlad Mazek" >: Im running 4.81.4 with sendmail. I'm starting to see messages not going through MailScanner, is there any scenario you guys would think would cause a message to not be scanned. This is something that is sporadic. Maillogs dont show any entries for these message IDs, which in the past may have been attributed to cached scoring. But I'm not seeing the MailScanner header inserts at all. -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141222/42727a83/attachment.html From t.sovandara at gmail.com Tue Dec 23 01:03:14 2014 From: t.sovandara at gmail.com (t dara) Date: Tue, 23 Dec 2014 08:03:14 +0700 Subject: Have problem with MailScanner 4.84.6 Cannot Add inline signature In-Reply-To: References: Message-ID: Hi, On MailScanner.conf file I use run as user= postfix. To run debug mode I just change this 2 line Debug = no --> Debug = yes Debug SpamAssassin = no ---> Debug SpamAssassin = yes Finally I restart MailScanner by trying this 2 command - service MailScanner startin or - service MailScanner restart But when change to debug mode I didn't see any log run on /var/log/maillog. And my email cannot send or receive. Thanks, Sovandara On Sat, Dec 20, 2014 at 10:13 PM, Martin Hepworth wrote: > Ok that requeue aint good > > That debug run as the same user as 'run as' in the mailscanner.conf file? > > > > On Saturday, 20 December 2014, t dara wrote: > >> Hi, >> >> To Run a sessions in Debug mode we just change Debug = no to Debug = yes >> Please see the log file as in the attachment file. >> >> Thanks, >> Sovandara >> >> On Fri, Dec 19, 2014 at 5:41 PM, Martin Hepworth >> wrote: >> >>> Run a sessions in Debug mode and see what you get and any clues as to >>> why it's not attaching the signature. >>> >>> -- >>> Martin Hepworth, CISSP >>> Oxford, UK >>> >>> On 19 December 2014 at 09:44, t dara wrote: >>>> >>>> Hi, >>>> >>>> Yes the report file exist. Normally if report file not exist it will >>>> show error message, but on my case I didn't see any error message. >>>> >>>> Thanks, >>>> Sovandara >>>> >>>> On Fri, Dec 19, 2014 at 2:24 PM, Martin Hepworth >>>> wrote: >>>>> >>>>> No errrors at all in the logs at MailScanner startup and those files >>>>> exist in the reports directory? >>>>> >>>>> -- >>>>> Martin Hepworth, CISSP >>>>> Oxford, UK >>>>> >>>>> On 18 December 2014 at 01:47, t dara wrote: >>>>> >>>>>> Hi, >>>>>> >>>>>> Do you have any idea? Please help. >>>>>> >>>>>> Thanks, >>>>>> Sovandara >>>>>> >>>>>> -- >>>>>> MailScanner mailing list >>>>>> mailscanner at lists.mailscanner.info >>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>> >>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>> >>>>>> Support MailScanner development - buy the book off the website! >>>>>> >>>>>> >>>>> -- >>>>> MailScanner mailing list >>>>> mailscanner at lists.mailscanner.info >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>> >>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner at lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> > > -- > -- > Martin Hepworth, CISSP > Oxford, UK > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141223/1d3d3412/attachment.html From maxsec at gmail.com Tue Dec 23 08:49:22 2014 From: maxsec at gmail.com (Martin Hepworth) Date: Tue, 23 Dec 2014 08:49:22 +0000 Subject: Have problem with MailScanner 4.84.6 Cannot Add inline signature In-Reply-To: References: Message-ID: Debug is very command line Once you've made the changes to MailScanner.conf, stopped the service then "su -" to postfix user (make sure it has a valid shell first!), run MailScanner from the command line it will run once then stop and dump the debug to the command line so you can try and spot why the Signature rule isnt running. -- Martin Hepworth, CISSP Oxford, UK On 23 December 2014 at 01:03, t dara wrote: > Hi, > > On MailScanner.conf file I use run as user= postfix. > To run debug mode I just change this 2 line > Debug = no --> Debug = yes > Debug SpamAssassin = no ---> Debug SpamAssassin = yes > Finally I restart MailScanner by trying this 2 command > - service MailScanner startin or > - service MailScanner restart > But when change to debug mode I didn't see any log run on > /var/log/maillog. And my email cannot send or receive. > > Thanks, > Sovandara > > > > On Sat, Dec 20, 2014 at 10:13 PM, Martin Hepworth > wrote: > >> Ok that requeue aint good >> >> That debug run as the same user as 'run as' in the mailscanner.conf file? >> >> >> >> On Saturday, 20 December 2014, t dara wrote: >> >>> Hi, >>> >>> To Run a sessions in Debug mode we just change Debug = no to Debug = yes >>> Please see the log file as in the attachment file. >>> >>> Thanks, >>> Sovandara >>> >>> On Fri, Dec 19, 2014 at 5:41 PM, Martin Hepworth >>> wrote: >>> >>>> Run a sessions in Debug mode and see what you get and any clues as to >>>> why it's not attaching the signature. >>>> >>>> -- >>>> Martin Hepworth, CISSP >>>> Oxford, UK >>>> >>>> On 19 December 2014 at 09:44, t dara wrote: >>>>> >>>>> Hi, >>>>> >>>>> Yes the report file exist. Normally if report file not exist it will >>>>> show error message, but on my case I didn't see any error message. >>>>> >>>>> Thanks, >>>>> Sovandara >>>>> >>>>> On Fri, Dec 19, 2014 at 2:24 PM, Martin Hepworth >>>>> wrote: >>>>>> >>>>>> No errrors at all in the logs at MailScanner startup and those files >>>>>> exist in the reports directory? >>>>>> >>>>>> -- >>>>>> Martin Hepworth, CISSP >>>>>> Oxford, UK >>>>>> >>>>>> On 18 December 2014 at 01:47, t dara wrote: >>>>>> >>>>>>> Hi, >>>>>>> >>>>>>> Do you have any idea? Please help. >>>>>>> >>>>>>> Thanks, >>>>>>> Sovandara >>>>>>> >>>>>>> -- >>>>>>> MailScanner mailing list >>>>>>> mailscanner at lists.mailscanner.info >>>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>>> >>>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>>> >>>>>>> Support MailScanner development - buy the book off the website! >>>>>>> >>>>>>> >>>>>> -- >>>>>> MailScanner mailing list >>>>>> mailscanner at lists.mailscanner.info >>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>> >>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>> >>>>>> Support MailScanner development - buy the book off the website! >>>>>> >>>>>> >>>>> -- >>>>> MailScanner mailing list >>>>> mailscanner at lists.mailscanner.info >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>> >>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner at lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> >> >> -- >> -- >> Martin Hepworth, CISSP >> Oxford, UK >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141223/e72ced7a/attachment.html From nerijusb at dtiltas.lt Tue Dec 23 13:11:32 2014 From: nerijusb at dtiltas.lt (Nerijus Baliunas) Date: Tue, 23 Dec 2014 15:11:32 +0200 Subject: archiving rules Message-ID: Hello, I have Non Spam Actions = %rules-dir%/archive-nonspam.rules and archive-nonspam.rules is: To: *@domain.lt deliver header "X-Spam-Status: No" forward _TOUSER_ at backup.domain.lt From: *@domain.lt deliver header "X-Spam-Status: No" forward _FROMUSER_.Sent at backup.domain.lt FromOrTo: default deliver header "X-Spam-Status: No" Messages are archived correctly. The problem is, when the message is sent like this: To: user1 at externaldomain.lt Cc: user2 at domain.lt The message is sent to both user1 at backup.domain.lt and user2 at backup.domain.lt. Is it possible _TOUSER_ in above rule to be used only if recipient domain is local, i.e. domain.lt? Regards, Nerijus From nerijusb at dtiltas.lt Tue Dec 23 14:23:22 2014 From: nerijusb at dtiltas.lt (Nerijus Baliunas) Date: Tue, 23 Dec 2014 16:23:22 +0200 Subject: archiving rules In-Reply-To: References: Message-ID: On Tue, 23 Dec 2014 15:11:32 +0200 Nerijus Baliunas wrote: > Messages are archived correctly. The problem is, when the message is sent like this: > To: user1 at externaldomain.lt > Cc: user2 at domain.lt > > The message is sent to both user1 at backup.domain.lt and user2 at backup.domain.lt. > Is it possible TOUSER in above rule to be used only if recipient domain is local, i.e. domain.lt? I use postfix and have in main.cf: virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_domains_maps.cf, backup.domain.lt virtual_transport = dovecot dovecot_destination_recipient_limit = 1 backup_destination_recipient_limit = 1 transport: backup.domain.lt backup: master.cf: dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/dovecot-lda -f ${sender} -d ${user}@${nexthop} backup unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/dovecot-lda -f ${sender} -d backup at domain.lt -m ${user} So all the backup email goes to backup at domain.lt mailbox and subdirs (named as expanded _TOUSER_) are created because of -m ${user}. The problem is, that subdirs are created even for external users, if a message is sent To: user1 at externaldomain.lt and Cc: user2 at domain.lt. Regards, Nerijus From carlosr at jovenclub.cu Tue Dec 23 21:32:29 2014 From: carlosr at jovenclub.cu (Carlos R Laguna) Date: Tue, 23 Dec 2014 16:32:29 -0500 Subject: Mailscanner process mail too slow Message-ID: <5499DF6D.6080001@jovenclub.cu> Hi everyone, i am having some issue here, but can't figure out what is it, my current box is mailscanner 4.86.6-1 ubuntu 12.04.5. The symptoms are: mail processing too slow in queue are over 15k mail on hold almost no clamscan process mailscanner log http://paste.desdelinux.net/5097 Any hint will be great* MailScanner --lint output **(connecting to SpamAssassin cache db take up to 15s) Reading configuration file /opt/MailScanner/etc/MailScanner.conf Reading configuration file /opt/MailScanner/etc/conf.d/baruwa.conf Read 876 hostnames from the phishing whitelist Read 5890 hostnames from the phishing blacklists Config: calling custom init function BaruwaLowScore Baruwa: Populating spam score settings Baruwa: Read 20 spam score settings Config: calling custom init function BaruwaShouldScan Baruwa: Starting scanning settings Baruwa: Read 21 settings Config: calling custom init function BaruwaBlacklist Baruwa: Starting blacklists Baruwa: Read 0 blacklist items Baruwa: Ip blocks blacklisted: Config: calling custom init function BaruwaSQL Baruwa: Starting SQL logger Config: calling custom init function BaruwaHighScore Baruwa: Populating high spam score settings Baruwa: Read 20 high spam score settings Config: calling custom init function BaruwaWhitelist Baruwa: Starting whitelists Baruwa: Read 1 whitelist items Baruwa: Ip blocks whitelisted: Checking version numbers... Version number in MailScanner.conf (4.84.6) is correct. Your envelope_sender_header in spam.assassin.prefs.conf is correct. MailScanner setting GID to (105) MailScanner setting UID to (104) Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database SpamAssassin reported no errors. Connected to Processing Attempts Database Created Processing Attempts Database successfully There are 390 messages in the Processing Attempts Database Using locktype = flock MailScanner.conf says "Virus Scanners = clamav" Found these virus scanners installed: clamav =========================================================================== Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: Found 1 problems Virus and Content Scanning: Starting 1.message: Eicar-Test-Signature FOUND ./1/eicar.com: Eicar-Test-Signature FOUND Virus Scanning: ClamAV found 2 infections Infected message 1 came from 10.1.1.1 Virus Scanning: Found 2 viruses =========================================================================== Virus Scanner test reports: ClamAV said "eicar.com contains Eicar-Test-Signature" If any of your virus scanners (clamav) are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. Config: calling custom end function BaruwaLowScore Baruwa: Shutting down spam score settings Config: calling custom end function BaruwaShouldScan Baruwa: Shutting down scanning settings Config: calling custom end function BaruwaBlacklist Baruwa: Shutting down blacklists Config: calling custom end function BaruwaSQL Baruwa: Shutting down SQL logger Config: calling custom end function BaruwaHighScore Baruwa: Shutting down high spam score settings Config: calling custom end function BaruwaWhitelist Baruwa: Shutting down whitelists Thanks for your time and effort. regards ________________________________________________________________ XII Edicion del Evento Nacional de Informatica para Jovenes. INFOCLUB. Abril. 2015. Ver www.jovenclub.cu ________________________________________________________________ From steve.freegard at fsl.com Tue Dec 23 22:07:27 2014 From: steve.freegard at fsl.com (Steve Freegard) Date: Tue, 23 Dec 2014 22:07:27 +0000 Subject: Mailscanner process mail too slow In-Reply-To: <5499DF6D.6080001@jovenclub.cu> References: <5499DF6D.6080001@jovenclub.cu> <5499E79F.7040200@fsl.com> Message-ID: On 23/12/14 21:32, Carlos R Laguna wrote: > Any hint will be great* > > MailScanner.conf says "Virus Scanners = clamav" > Found these virus scanners installed: clamav clamscan is *really* slow. You should be using clamd; it's massively faster. Regards, Steve. From kevin.miller at juneau.org Tue Dec 23 22:21:32 2014 From: kevin.miller at juneau.org (Kevin Miller) Date: Tue, 23 Dec 2014 22:21:32 +0000 Subject: Mailscanner process mail too slow In-Reply-To: <5499DF6D.6080001@jovenclub.cu> References: <5499DF6D.6080001@jovenclub.cu> Message-ID: If you haven't already done so, one thing that can help, assuming you have the spare RAM is to add this to your /etc/fstab: none /var/spool/MailScanner/incoming tmpfs defaults,size=1024m 0 0 That's the working directory where messages are scanned and evaluated. Doing it in RAM is much faster than on disk. Adjust the size as appropriate if needed. I'm using a gig of memory - I could probably get by with a lot less as I don't have that busy of a mail server. What is Max Children set to in MailScanner.conf? ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- > bounces at lists.mailscanner.info] On Behalf Of Carlos R Laguna > Sent: Tuesday, December 23, 2014 12:32 PM > To: mailscanner at lists.mailscanner.info > Subject: Mailscanner process mail too slow > > Hi everyone, i am having some issue here, but can't figure out what is > it, my current box is mailscanner 4.86.6-1 ubuntu 12.04.5. > The symptoms are: > mail processing too slow > in queue are over 15k mail on hold > almost no clamscan process > > mailscanner log http://paste.desdelinux.net/5097 > > Any hint will be great* > > MailScanner --lint output **(connecting to SpamAssassin cache db take up > to 15s) > > > Reading configuration file /opt/MailScanner/etc/MailScanner.conf > Reading configuration file /opt/MailScanner/etc/conf.d/baruwa.conf > Read 876 hostnames from the phishing whitelist > Read 5890 hostnames from the phishing blacklists > Config: calling custom init function BaruwaLowScore > Baruwa: Populating spam score settings > Baruwa: Read 20 spam score settings > Config: calling custom init function BaruwaShouldScan > Baruwa: Starting scanning settings > Baruwa: Read 21 settings > Config: calling custom init function BaruwaBlacklist > Baruwa: Starting blacklists > Baruwa: Read 0 blacklist items > Baruwa: Ip blocks blacklisted: > Config: calling custom init function BaruwaSQL > Baruwa: Starting SQL logger > Config: calling custom init function BaruwaHighScore > Baruwa: Populating high spam score settings > Baruwa: Read 20 high spam score settings > Config: calling custom init function BaruwaWhitelist > Baruwa: Starting whitelists > Baruwa: Read 1 whitelist items > Baruwa: Ip blocks whitelisted: > > Checking version numbers... > Version number in MailScanner.conf (4.84.6) is correct. > > Your envelope_sender_header in spam.assassin.prefs.conf is correct. > MailScanner setting GID to (105) > MailScanner setting UID to (104) > > Checking for SpamAssassin errors (if you use it)... > Using SpamAssassin results cache > Connected to SpamAssassin cache database > SpamAssassin reported no errors. > Connected to Processing Attempts Database > Created Processing Attempts Database successfully > There are 390 messages in the Processing Attempts Database > Using locktype = flock > MailScanner.conf says "Virus Scanners = clamav" > Found these virus scanners installed: clamav > ======================================================================== > === > Filename Checks: Windows/DOS Executable (1 eicar.com) > Other Checks: Found 1 problems > Virus and Content Scanning: Starting > 1.message: Eicar-Test-Signature FOUND > > ./1/eicar.com: Eicar-Test-Signature FOUND > > Virus Scanning: ClamAV found 2 infections > Infected message 1 came from 10.1.1.1 > Virus Scanning: Found 2 viruses > ======================================================================== > === > Virus Scanner test reports: > ClamAV said "eicar.com contains Eicar-Test-Signature" > > If any of your virus scanners (clamav) > are not listed there, you should check that they are installed correctly > and that MailScanner is finding them correctly via its > virus.scanners.conf. > Config: calling custom end function BaruwaLowScore > Baruwa: Shutting down spam score settings > Config: calling custom end function BaruwaShouldScan > Baruwa: Shutting down scanning settings > Config: calling custom end function BaruwaBlacklist > Baruwa: Shutting down blacklists > Config: calling custom end function BaruwaSQL > Baruwa: Shutting down SQL logger > Config: calling custom end function BaruwaHighScore > Baruwa: Shutting down high spam score settings > Config: calling custom end function BaruwaWhitelist > Baruwa: Shutting down whitelists > > Thanks for your time and effort. regards > ________________________________________________________________ > XII Edicion del Evento Nacional de Informatica para Jovenes. INFOCLUB. > Abril. 2015. Ver www.jovenclub.cu > ________________________________________________________________ > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From carlosr at jovenclub.cu Tue Dec 23 23:47:12 2014 From: carlosr at jovenclub.cu (Carlos R Laguna) Date: Tue, 23 Dec 2014 18:47:12 -0500 Subject: Mailscanner process mail too slow In-Reply-To: References: <5499DF6D.6080001@jovenclub.cu> <5499E79F.7040200@fsl.com> Message-ID: <5499FF00.9070205@jovenclub.cu> El 23/12/14 a las 17:07, Steve Freegard escibi??: > On 23/12/14 21:32, Carlos R Laguna wrote: > >> Any hint will be great* >> >> MailScanner.conf says "Virus Scanners = clamav" >> Found these virus scanners installed: clamav > clamscan is *really* slow. You should be using clamd; it's massively > faster. > > Regards, > Steve. Hi Steve Thanks for the reply, i was working on it at the moment your email come in. I will update any improvement. Thanks again and regards. ________________________________________________________________ XII Edicion del Evento Nacional de Informatica para Jovenes. INFOCLUB. Abril. 2015. Ver www.jovenclub.cu ________________________________________________________________ -- Este mensaje ha sido analizado por MailScanner en busca de virus y otros contenidos peligrosos, y se considera que est? limpio. From carlosr at jovenclub.cu Wed Dec 24 00:57:33 2014 From: carlosr at jovenclub.cu (Carlos R Laguna) Date: Tue, 23 Dec 2014 19:57:33 -0500 Subject: Mailscanner process mail too slow In-Reply-To: References: <5499DF6D.6080001@jovenclub.cu> Message-ID: <549A0F7D.50808@jovenclub.cu> El 23/12/14 a las 17:21, Kevin Miller escibi?: > If you haven't already done so, one thing that can help, assuming you have the spare RAM is to add this to your /etc/fstab: > > none /var/spool/MailScanner/incoming tmpfs defaults,size=1024m 0 0 > > That's the working directory where messages are scanned and evaluated. Doing it in RAM is much faster than on disk. > > Adjust the size as appropriate if needed. I'm using a gig of memory - I could probably get by with a lot less as I don't have that busy of a mail server. > > What is Max Children set to in MailScanner.conf? > > ...Kevin > -- > Kevin Miller > Network/email Administrator, CBJ MIS Dept. > 155 South Seward Street > Juneau, Alaska 99801 > Phone: (907) 586-0242, Fax: (907) 586-4500 > Registered Linux User No: 307357 > >> -----Original Message----- >> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- >> bounces at lists.mailscanner.info] On Behalf Of Carlos R Laguna >> Sent: Tuesday, December 23, 2014 12:32 PM >> To: mailscanner at lists.mailscanner.info >> Subject: Mailscanner process mail too slow >> >> Hi everyone, i am having some issue here, but can't figure out what is >> it, my current box is mailscanner 4.86.6-1 ubuntu 12.04.5. >> The symptoms are: >> mail processing too slow >> in queue are over 15k mail on hold >> almost no clamscan process >> >> mailscanner log http://paste.desdelinux.net/5097 >> >> Any hint will be great* >> >> MailScanner --lint output **(connecting to SpamAssassin cache db take up >> to 15s) >> >> >> Reading configuration file /opt/MailScanner/etc/MailScanner.conf >> Reading configuration file /opt/MailScanner/etc/conf.d/baruwa.conf >> Read 876 hostnames from the phishing whitelist >> Read 5890 hostnames from the phishing blacklists >> Config: calling custom init function BaruwaLowScore >> Baruwa: Populating spam score settings >> Baruwa: Read 20 spam score settings >> Config: calling custom init function BaruwaShouldScan >> Baruwa: Starting scanning settings >> Baruwa: Read 21 settings >> Config: calling custom init function BaruwaBlacklist >> Baruwa: Starting blacklists >> Baruwa: Read 0 blacklist items >> Baruwa: Ip blocks blacklisted: >> Config: calling custom init function BaruwaSQL >> Baruwa: Starting SQL logger >> Config: calling custom init function BaruwaHighScore >> Baruwa: Populating high spam score settings >> Baruwa: Read 20 high spam score settings >> Config: calling custom init function BaruwaWhitelist >> Baruwa: Starting whitelists >> Baruwa: Read 1 whitelist items >> Baruwa: Ip blocks whitelisted: >> >> Checking version numbers... >> Version number in MailScanner.conf (4.84.6) is correct. >> >> Your envelope_sender_header in spam.assassin.prefs.conf is correct. >> MailScanner setting GID to (105) >> MailScanner setting UID to (104) >> >> Checking for SpamAssassin errors (if you use it)... >> Using SpamAssassin results cache >> Connected to SpamAssassin cache database >> SpamAssassin reported no errors. >> Connected to Processing Attempts Database >> Created Processing Attempts Database successfully >> There are 390 messages in the Processing Attempts Database >> Using locktype = flock >> MailScanner.conf says "Virus Scanners = clamav" >> Found these virus scanners installed: clamav >> ======================================================================== >> === >> Filename Checks: Windows/DOS Executable (1 eicar.com) >> Other Checks: Found 1 problems >> Virus and Content Scanning: Starting >> 1.message: Eicar-Test-Signature FOUND >> >> ./1/eicar.com: Eicar-Test-Signature FOUND >> >> Virus Scanning: ClamAV found 2 infections >> Infected message 1 came from 10.1.1.1 >> Virus Scanning: Found 2 viruses >> ======================================================================== >> === >> Virus Scanner test reports: >> ClamAV said "eicar.com contains Eicar-Test-Signature" >> >> If any of your virus scanners (clamav) >> are not listed there, you should check that they are installed correctly >> and that MailScanner is finding them correctly via its >> virus.scanners.conf. >> Config: calling custom end function BaruwaLowScore >> Baruwa: Shutting down spam score settings >> Config: calling custom end function BaruwaShouldScan >> Baruwa: Shutting down scanning settings >> Config: calling custom end function BaruwaBlacklist >> Baruwa: Shutting down blacklists >> Config: calling custom end function BaruwaSQL >> Baruwa: Shutting down SQL logger >> Config: calling custom end function BaruwaHighScore >> Baruwa: Shutting down high spam score settings >> Config: calling custom end function BaruwaWhitelist >> Baruwa: Shutting down whitelists >> >> Thanks for your time and effort. regards >> ________________________________________________________________ >> XII Edicion del Evento Nacional de Informatica para Jovenes. INFOCLUB. >> Abril. 2015. Ver www.jovenclub.cu >> ________________________________________________________________ >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! Hi Kevin Actually ... (This is a container **openvz) Filesystem Size Used Avail Use% Mounted on /dev/simfs 60G 49G 11G 82% / none 1.5G 4.0K 1.5G 1% /dev none 308M 80K 308M 1% /run none 5.0M 0 5.0M 0% /run/lock none 1.5G 108K 1.5G 1% /run/shm tmpfs 1.5G 52M 1.5G 4% /var/spool/MailScanner/incoming tmpfs 1.5G 68K 1.5G 1% /tmp the max of children is 15 in a Intel Xeon x 6 4Gb of ram, at this time the mail is flowing again, but it always does at this specific hour so i am not sure if the change to clamd work or not.Thanks for your time and efforts. Regards ________________________________________________________________ XII Edicion del Evento Nacional de Informatica para Jovenes. INFOCLUB. Abril. 2015. Ver www.jovenclub.cu ________________________________________________________________ From carlosr at jovenclub.cu Wed Dec 24 00:57:33 2014 From: carlosr at jovenclub.cu (Carlos R Laguna) Date: Tue, 23 Dec 2014 19:57:33 -0500 Subject: Mailscanner process mail too slow In-Reply-To: References: <5499DF6D.6080001@jovenclub.cu> Message-ID: <549A0F7D.50808@jovenclub.cu> El 23/12/14 a las 17:21, Kevin Miller escibi?: > If you haven't already done so, one thing that can help, assuming you have the spare RAM is to add this to your /etc/fstab: > > none /var/spool/MailScanner/incoming tmpfs defaults,size=1024m 0 0 > > That's the working directory where messages are scanned and evaluated. Doing it in RAM is much faster than on disk. > > Adjust the size as appropriate if needed. I'm using a gig of memory - I could probably get by with a lot less as I don't have that busy of a mail server. > > What is Max Children set to in MailScanner.conf? > > ...Kevin > -- > Kevin Miller > Network/email Administrator, CBJ MIS Dept. > 155 South Seward Street > Juneau, Alaska 99801 > Phone: (907) 586-0242, Fax: (907) 586-4500 > Registered Linux User No: 307357 > >> -----Original Message----- >> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- >> bounces at lists.mailscanner.info] On Behalf Of Carlos R Laguna >> Sent: Tuesday, December 23, 2014 12:32 PM >> To: mailscanner at lists.mailscanner.info >> Subject: Mailscanner process mail too slow >> >> Hi everyone, i am having some issue here, but can't figure out what is >> it, my current box is mailscanner 4.86.6-1 ubuntu 12.04.5. >> The symptoms are: >> mail processing too slow >> in queue are over 15k mail on hold >> almost no clamscan process >> >> mailscanner log http://paste.desdelinux.net/5097 >> >> Any hint will be great* >> >> MailScanner --lint output **(connecting to SpamAssassin cache db take up >> to 15s) >> >> >> Reading configuration file /opt/MailScanner/etc/MailScanner.conf >> Reading configuration file /opt/MailScanner/etc/conf.d/baruwa.conf >> Read 876 hostnames from the phishing whitelist >> Read 5890 hostnames from the phishing blacklists >> Config: calling custom init function BaruwaLowScore >> Baruwa: Populating spam score settings >> Baruwa: Read 20 spam score settings >> Config: calling custom init function BaruwaShouldScan >> Baruwa: Starting scanning settings >> Baruwa: Read 21 settings >> Config: calling custom init function BaruwaBlacklist >> Baruwa: Starting blacklists >> Baruwa: Read 0 blacklist items >> Baruwa: Ip blocks blacklisted: >> Config: calling custom init function BaruwaSQL >> Baruwa: Starting SQL logger >> Config: calling custom init function BaruwaHighScore >> Baruwa: Populating high spam score settings >> Baruwa: Read 20 high spam score settings >> Config: calling custom init function BaruwaWhitelist >> Baruwa: Starting whitelists >> Baruwa: Read 1 whitelist items >> Baruwa: Ip blocks whitelisted: >> >> Checking version numbers... >> Version number in MailScanner.conf (4.84.6) is correct. >> >> Your envelope_sender_header in spam.assassin.prefs.conf is correct. >> MailScanner setting GID to (105) >> MailScanner setting UID to (104) >> >> Checking for SpamAssassin errors (if you use it)... >> Using SpamAssassin results cache >> Connected to SpamAssassin cache database >> SpamAssassin reported no errors. >> Connected to Processing Attempts Database >> Created Processing Attempts Database successfully >> There are 390 messages in the Processing Attempts Database >> Using locktype = flock >> MailScanner.conf says "Virus Scanners = clamav" >> Found these virus scanners installed: clamav >> ======================================================================== >> === >> Filename Checks: Windows/DOS Executable (1 eicar.com) >> Other Checks: Found 1 problems >> Virus and Content Scanning: Starting >> 1.message: Eicar-Test-Signature FOUND >> >> ./1/eicar.com: Eicar-Test-Signature FOUND >> >> Virus Scanning: ClamAV found 2 infections >> Infected message 1 came from 10.1.1.1 >> Virus Scanning: Found 2 viruses >> ======================================================================== >> === >> Virus Scanner test reports: >> ClamAV said "eicar.com contains Eicar-Test-Signature" >> >> If any of your virus scanners (clamav) >> are not listed there, you should check that they are installed correctly >> and that MailScanner is finding them correctly via its >> virus.scanners.conf. >> Config: calling custom end function BaruwaLowScore >> Baruwa: Shutting down spam score settings >> Config: calling custom end function BaruwaShouldScan >> Baruwa: Shutting down scanning settings >> Config: calling custom end function BaruwaBlacklist >> Baruwa: Shutting down blacklists >> Config: calling custom end function BaruwaSQL >> Baruwa: Shutting down SQL logger >> Config: calling custom end function BaruwaHighScore >> Baruwa: Shutting down high spam score settings >> Config: calling custom end function BaruwaWhitelist >> Baruwa: Shutting down whitelists >> >> Thanks for your time and effort. regards >> ________________________________________________________________ >> XII Edicion del Evento Nacional de Informatica para Jovenes. INFOCLUB. >> Abril. 2015. Ver www.jovenclub.cu >> ________________________________________________________________ >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! Hi Kevin Actually ... (This is a container **openvz) Filesystem Size Used Avail Use% Mounted on /dev/simfs 60G 49G 11G 82% / none 1.5G 4.0K 1.5G 1% /dev none 308M 80K 308M 1% /run none 5.0M 0 5.0M 0% /run/lock none 1.5G 108K 1.5G 1% /run/shm tmpfs 1.5G 52M 1.5G 4% /var/spool/MailScanner/incoming tmpfs 1.5G 68K 1.5G 1% /tmp the max of children is 15 in a Intel Xeon x 6 4Gb of ram, at this time the mail is flowing again, but it always does at this specific hour so i am not sure if the change to clamd work or not.Thanks for your time and efforts. Regards ________________________________________________________________ XII Edicion del Evento Nacional de Informatica para Jovenes. INFOCLUB. Abril. 2015. Ver www.jovenclub.cu ________________________________________________________________ -- Este mensaje ha sido analizado por MailScanner en busca de virus y otros contenidos peligrosos, y se considera que est? limpio. From carlosr at jovenclub.cu Wed Dec 24 02:48:41 2014 From: carlosr at jovenclub.cu (Carlos R Laguna) Date: Tue, 23 Dec 2014 21:48:41 -0500 Subject: Mailscanner process mail too slow In-Reply-To: References: <5499DF6D.6080001@jovenclub.cu> Message-ID: <549A2989.2010609@jovenclub.cu> El 23/12/14 a las 17:21, Kevin Miller escibi?: > If you haven't already done so, one thing that can help, assuming you have the spare RAM is to add this to your /etc/fstab: > > none /var/spool/MailScanner/incoming tmpfs defaults,size=1024m 0 0 > > That's the working directory where messages are scanned and evaluated. Doing it in RAM is much faster than on disk. > > Adjust the size as appropriate if needed. I'm using a gig of memory - I could probably get by with a lot less as I don't have that busy of a mail server. > > What is Max Children set to in MailScanner.conf? > > ...Kevin > -- > Kevin Miller > Network/email Administrator, CBJ MIS Dept. > 155 South Seward Street > Juneau, Alaska 99801 > Phone: (907) 586-0242, Fax: (907) 586-4500 > Registered Linux User No: 307357 > >> -----Original Message----- >> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- >> bounces at lists.mailscanner.info] On Behalf Of Carlos R Laguna >> Sent: Tuesday, December 23, 2014 12:32 PM >> To: mailscanner at lists.mailscanner.info >> Subject: Mailscanner process mail too slow >> >> Hi everyone, i am having some issue here, but can't figure out what is >> it, my current box is mailscanner 4.86.6-1 ubuntu 12.04.5. >> The symptoms are: >> mail processing too slow >> in queue are over 15k mail on hold >> almost no clamscan process >> >> mailscanner log http://paste.desdelinux.net/5097 >> >> Any hint will be great* >> >> MailScanner --lint output **(connecting to SpamAssassin cache db take up >> to 15s) >> >> >> Reading configuration file /opt/MailScanner/etc/MailScanner.conf >> Reading configuration file /opt/MailScanner/etc/conf.d/baruwa.conf >> Read 876 hostnames from the phishing whitelist >> Read 5890 hostnames from the phishing blacklists >> Config: calling custom init function BaruwaLowScore >> Baruwa: Populating spam score settings >> Baruwa: Read 20 spam score settings >> Config: calling custom init function BaruwaShouldScan >> Baruwa: Starting scanning settings >> Baruwa: Read 21 settings >> Config: calling custom init function BaruwaBlacklist >> Baruwa: Starting blacklists >> Baruwa: Read 0 blacklist items >> Baruwa: Ip blocks blacklisted: >> Config: calling custom init function BaruwaSQL >> Baruwa: Starting SQL logger >> Config: calling custom init function BaruwaHighScore >> Baruwa: Populating high spam score settings >> Baruwa: Read 20 high spam score settings >> Config: calling custom init function BaruwaWhitelist >> Baruwa: Starting whitelists >> Baruwa: Read 1 whitelist items >> Baruwa: Ip blocks whitelisted: >> >> Checking version numbers... >> Version number in MailScanner.conf (4.84.6) is correct. >> >> Your envelope_sender_header in spam.assassin.prefs.conf is correct. >> MailScanner setting GID to (105) >> MailScanner setting UID to (104) >> >> Checking for SpamAssassin errors (if you use it)... >> Using SpamAssassin results cache >> Connected to SpamAssassin cache database >> SpamAssassin reported no errors. >> Connected to Processing Attempts Database >> Created Processing Attempts Database successfully >> There are 390 messages in the Processing Attempts Database >> Using locktype = flock >> MailScanner.conf says "Virus Scanners = clamav" >> Found these virus scanners installed: clamav >> ======================================================================== >> === >> Filename Checks: Windows/DOS Executable (1 eicar.com) >> Other Checks: Found 1 problems >> Virus and Content Scanning: Starting >> 1.message: Eicar-Test-Signature FOUND >> >> ./1/eicar.com: Eicar-Test-Signature FOUND >> >> Virus Scanning: ClamAV found 2 infections >> Infected message 1 came from 10.1.1.1 >> Virus Scanning: Found 2 viruses >> ======================================================================== >> === >> Virus Scanner test reports: >> ClamAV said "eicar.com contains Eicar-Test-Signature" >> >> If any of your virus scanners (clamav) >> are not listed there, you should check that they are installed correctly >> and that MailScanner is finding them correctly via its >> virus.scanners.conf. >> Config: calling custom end function BaruwaLowScore >> Baruwa: Shutting down spam score settings >> Config: calling custom end function BaruwaShouldScan >> Baruwa: Shutting down scanning settings >> Config: calling custom end function BaruwaBlacklist >> Baruwa: Shutting down blacklists >> Config: calling custom end function BaruwaSQL >> Baruwa: Shutting down SQL logger >> Config: calling custom end function BaruwaHighScore >> Baruwa: Shutting down high spam score settings >> Config: calling custom end function BaruwaWhitelist >> Baruwa: Shutting down whitelists >> >> Thanks for your time and effort. regards >> ________________________________________________________________ >> XII Edicion del Evento Nacional de Informatica para Jovenes. INFOCLUB. >> Abril. 2015. Ver www.jovenclub.cu >> ________________________________________________________________ >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! Hi Kevin Actually ... (This is a container **openvz) Filesystem Size Used Avail Use% Mounted on /dev/simfs 60G 49G 11G 82% / none 1.5G 4.0K 1.5G 1% /dev none 308M 80K 308M 1% /run none 5.0M 0 5.0M 0% /run/lock none 1.5G 108K 1.5G 1% /run/shm tmpfs 1.5G 52M 1.5G 4% /var/spool/MailScanner/incoming tmpfs 1.5G 68K 1.5G 1% /tmp the max of children is 15 in a Intel Xeon x 6 4Gb of ram, at this time the mail is flowing again, but it always does at this specific hour so i am not sure if the change to clamd work or not.Thanks for your time and efforts. Regards ________________________________________________________________ XII Edicion del Evento Nacional de Informatica para Jovenes. INFOCLUB. Abril. 2015. Ver www.jovenclub.cu ________________________________________________________________ -- Este mensaje ha sido analizado por MailScanner en busca de virus y otros contenidos peligrosos, y se considera que est? limpio. From ugo.vasi at procne.it Wed Dec 24 07:45:35 2014 From: ugo.vasi at procne.it (Ugo Vasi) Date: Wed, 24 Dec 2014 08:45:35 +0100 Subject: TNEF in postfix hold path In-Reply-To: <548F14D8.4060909@procne.it> References: <548F14D8.4060909@procne.it> Message-ID: <549A6F1F.6020000@procne.it> Any idea? Thanks and happy holidays! Il 15/12/2014 18:05, Ugo Vasi ha scritto: > Hi all, > in a recent installation (debian 7 + mailscanner 4.84.5-4~wheezy + > postfix 2.9.6-2) I see this warnings in mail.log: > > Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnefwaSOJu: uid > 102: not a regular file > Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnef0R36P5: uid > 102: not a regular file > Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnefTBC2pw: uid > 102: not a regular file > Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnefvBgPij: uid > 102: not a regular file > Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnef9a5yNc: uid > 102: not a regular file > Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnef2XEO6H: uid > 102: not a regular file > Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnefceRLQ7: uid > 102: not a regular file > Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnefFF_uw1: uid > 102: not a regular file > Dec 15 17:57:23 mail postfix/showq[18891]: warning: hold/tnefq6wleV: uid > 102: not a regular file > > Infact, in the /var/spool/postfix/hold folder, I see these "tnef*" > folders that are deleted after a while. > > I suspect that MailScanner use the TNEF E?expander (/usr/bin/tnef) in > the postfix's hold directory. > > > It seems that this does not create problems to the email flow but it is > strange... > > Who can help me to find a solution? > > Thanks > -- U g o V a s i P r o c n e s.r.l >) via Cotonificio 45 33010 Tavagnacco IT phone: +390432486523 fax: +390432486523 Le informazioni contenute in questo messaggio sono riservate e confidenziali ed ? vietata la diffusione in qualunque modo eseguita. Qualora Lei non fosse la persona a cui il presente messaggio ? destinato, La invitiamo ad eliminarlo e a non leggerlo, dandocene gentilmente comunicazione. Per qualsiasi informazione si prega di contattare support at procne.it . Rif. D.L. 196/2003 From steve.freegard at fsl.com Wed Dec 24 11:40:17 2014 From: steve.freegard at fsl.com (Steve Freegard) Date: Wed, 24 Dec 2014 11:40:17 +0000 Subject: Mailscanner process mail too slow In-Reply-To: <549A2989.2010609@jovenclub.cu> References: <5499DF6D.6080001@jovenclub.cu> <549A2989.2010609@jovenclub.cu> <549AA621.4070402@fsl.com> Message-ID: On 24/12/14 02:48, Carlos R Laguna wrote: > i am not sure if the change to clamd work or not. The speed difference between the two is huge: [root at mail1-ec2 ~]# clamdscan -c /etc/clamd.d/scan.conf /tmp/test.eml /tmp/test.eml: OK ----------- SCAN SUMMARY ----------- Infected files: 0 Time: 0.016 sec (0 m 0 s) .vs. [root at mail1-ec2 ~]# clamscan /tmp/test.eml /tmp/test.eml: OK ----------- SCAN SUMMARY ----------- Known viruses: 4687566 Engine version: 0.98.4 Scanned directories: 0 Scanned files: 1 Infected files: 0 Data scanned: 0.00 MB Data read: 0.00 MB (ratio 0.00:1) Time: 18.914 sec (0 m 18 s) So 18.9 seconds .vs. 0.016 seconds. That would allow MailScanner to scan only 3000 messages per hour (with 15 children: (3600/18)*15 = 3000 that 200 messages per child) whereas with clamd that would be 3,375,000 messages. However that doesn't take into consideration the overhead of unpacking the messages, SpamAssassin scans (usually 3 seconds each minimum) and all the other stuff that MailScanner does, but you get the idea; the difference between the two is massive. MailScanner --lint should tell you if clamd is working or not as it should report that it found 'clamd' and detect the Eicar test: [root at mta41 ~]# MailScanner --lint Trying to setlogsock(unix) ConfigSQL configuration loaded with serial 594, next check in 900 seconds Reading ruleset allowexternal for keyword allowexternal Checking version numbers... Version number in MailScanner.conf (4.77.10) is correct. Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database SpamAssassin reported no errors. I have found clamd f-prot-6 scanners installed, and will use them all by default. Connected to Processing Attempts Database Created Processing Attempts Database successfully There are 0 messages in the Processing Attempts Database Using locktype = posix MailScanner.conf says "Virus Scanners = auto" Found these virus scanners installed: clamd, f-prot-6 =========================================================================== Filename Checks: Blocked Filename Detected (1 eicar.com) Other Checks: Found 1 problems Virus and Content Scanning: Starting Clamd::INFECTED:: Eicar-Test-Signature :: ./1/ Virus Scanning: Clamd found 1 infections Scanning: - at /usr/lib/MailScanner/MailScanner/SweepViruses.pm line 2338 Virus Scanning: F-Prot6 found 1 infections Infected message 1 came from 10.1.1.1 Infected message 1.message->eicar.com came from Virus Scanning: Found 2 viruses =========================================================================== If any of your virus scanners (clamd,f-prot-6) are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. Regards, Steve. From t.sovandara at gmail.com Wed Dec 24 17:07:25 2014 From: t.sovandara at gmail.com (t dara) Date: Thu, 25 Dec 2014 00:07:25 +0700 Subject: Have problem with MailScanner 4.84.6 Cannot Add inline signature In-Reply-To: References: Message-ID: Hi, Please see the log when I run check_MailScanner command on debug mode and I "su" to postfix user. Thanks, Sovandara On Tue, Dec 23, 2014 at 3:49 PM, Martin Hepworth wrote: > Debug is very command line > > Once you've made the changes to MailScanner.conf, stopped the service then > > "su -" to postfix user (make sure it has a valid shell first!), > run MailScanner from the command line > > it will run once then stop and dump the debug to the command line so you > can try and spot why the Signature rule isnt running. > > > > -- > Martin Hepworth, CISSP > Oxford, UK > > On 23 December 2014 at 01:03, t dara wrote: > >> Hi, >> >> On MailScanner.conf file I use run as user= postfix. >> To run debug mode I just change this 2 line >> Debug = no --> Debug = yes >> Debug SpamAssassin = no ---> Debug SpamAssassin = yes >> Finally I restart MailScanner by trying this 2 command >> - service MailScanner startin or >> - service MailScanner restart >> But when change to debug mode I didn't see any log run on >> /var/log/maillog. And my email cannot send or receive. >> >> Thanks, >> Sovandara >> >> >> >> On Sat, Dec 20, 2014 at 10:13 PM, Martin Hepworth >> wrote: >> >>> Ok that requeue aint good >>> >>> That debug run as the same user as 'run as' in the mailscanner.conf file? >>> >>> >>> >>> On Saturday, 20 December 2014, t dara wrote: >>> >>>> Hi, >>>> >>>> To Run a sessions in Debug mode we just change Debug = no to Debug = >>>> yes >>>> Please see the log file as in the attachment file. >>>> >>>> Thanks, >>>> Sovandara >>>> >>>> On Fri, Dec 19, 2014 at 5:41 PM, Martin Hepworth >>>> wrote: >>>> >>>>> Run a sessions in Debug mode and see what you get and any clues as to >>>>> why it's not attaching the signature. >>>>> >>>>> -- >>>>> Martin Hepworth, CISSP >>>>> Oxford, UK >>>>> >>>>> On 19 December 2014 at 09:44, t dara wrote: >>>>>> >>>>>> Hi, >>>>>> >>>>>> Yes the report file exist. Normally if report file not exist it will >>>>>> show error message, but on my case I didn't see any error message. >>>>>> >>>>>> Thanks, >>>>>> Sovandara >>>>>> >>>>>> On Fri, Dec 19, 2014 at 2:24 PM, Martin Hepworth >>>>>> wrote: >>>>>>> >>>>>>> No errrors at all in the logs at MailScanner startup and those files >>>>>>> exist in the reports directory? >>>>>>> >>>>>>> -- >>>>>>> Martin Hepworth, CISSP >>>>>>> Oxford, UK >>>>>>> >>>>>>> On 18 December 2014 at 01:47, t dara wrote: >>>>>>> >>>>>>>> Hi, >>>>>>>> >>>>>>>> Do you have any idea? Please help. >>>>>>>> >>>>>>>> Thanks, >>>>>>>> Sovandara >>>>>>>> >>>>>>>> -- >>>>>>>> MailScanner mailing list >>>>>>>> mailscanner at lists.mailscanner.info >>>>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>>>> >>>>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>>>> >>>>>>>> Support MailScanner development - buy the book off the website! >>>>>>>> >>>>>>>> >>>>>>> -- >>>>>>> MailScanner mailing list >>>>>>> mailscanner at lists.mailscanner.info >>>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>>> >>>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>>> >>>>>>> Support MailScanner development - buy the book off the website! >>>>>>> >>>>>>> >>>>>> -- >>>>>> MailScanner mailing list >>>>>> mailscanner at lists.mailscanner.info >>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>> >>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>> >>>>>> Support MailScanner development - buy the book off the website! >>>>>> >>>>>> >>>>> -- >>>>> MailScanner mailing list >>>>> mailscanner at lists.mailscanner.info >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>> >>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>> >>> >>> -- >>> -- >>> Martin Hepworth, CISSP >>> Oxford, UK >>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141225/bfc76904/attachment.html -------------- next part -------------- bash-4.1$ check_MailScanner Starting MailScanner...00:00:32 Dec 25 00:00:32.784 [1130] dbg: logger: adding facilities: all 00:00:32 Dec 25 00:00:32.784 [1130] dbg: logger: logging level is DBG 00:00:32 Dec 25 00:00:32.784 [1130] dbg: generic: SpamAssassin version 3.4.0 00:00:32 Dec 25 00:00:32.784 [1130] dbg: generic: Perl 5.010001, PREFIX=/usr/local, DEF_RULES_DIR=/usr/local/share/spamassassin, LOCAL_RULES_DIR=/etc/mail/spamassassin, LOCAL_STATE_DIR=/var/lib/spamassassin 00:00:32 Dec 25 00:00:32.785 [1130] dbg: config: timing enabled 00:00:32 Dec 25 00:00:32.785 [1130] dbg: config: score set 0 chosen. 00:00:32 Use of uninitialized value $filename in concatenation (.) or string at /usr/local/share/perl5/Mail/SpamAssassin.pm line 1247. 00:00:32 Use of uninitialized value $filename in concatenation (.) or string at /usr/local/share/perl5/Mail/SpamAssassin.pm line 1249. 00:00:32 Dec 25 00:00:32.787 [1130] dbg: config: read_scoreonly_config: cannot open "": No such file or directory 00:00:32 Building a message batch to scan... From carlosr at jovenclub.cu Wed Dec 24 23:41:30 2014 From: carlosr at jovenclub.cu (Carlos R Laguna) Date: Wed, 24 Dec 2014 18:41:30 -0500 Subject: Mailscanner process mail too slow In-Reply-To: References: <5499DF6D.6080001@jovenclub.cu> <549A2989.2010609@jovenclub.cu> <549AA621.4070402@fsl.com> Message-ID: <549B4F2A.2020209@jovenclub.cu> El 24/12/14 a las 06:40, Steve Freegard escibi?: > On 24/12/14 02:48, Carlos R Laguna wrote: >> i am not sure if the change to clamd work or not. > The speed difference between the two is huge: > > [root at mail1-ec2 ~]# clamdscan -c /etc/clamd.d/scan.conf /tmp/test.eml > /tmp/test.eml: OK > > ----------- SCAN SUMMARY ----------- > Infected files: 0 > Time: 0.016 sec (0 m 0 s) > > .vs. > > [root at mail1-ec2 ~]# clamscan /tmp/test.eml > /tmp/test.eml: OK > > ----------- SCAN SUMMARY ----------- > Known viruses: 4687566 > Engine version: 0.98.4 > Scanned directories: 0 > Scanned files: 1 > Infected files: 0 > Data scanned: 0.00 MB > Data read: 0.00 MB (ratio 0.00:1) > Time: 18.914 sec (0 m 18 s) > > So 18.9 seconds .vs. 0.016 seconds. > > That would allow MailScanner to scan only 3000 messages per hour (with > 15 children: (3600/18)*15 = 3000 that 200 messages per child) whereas > with clamd that would be 3,375,000 messages. However that doesn't take > into consideration the overhead of unpacking the messages, SpamAssassin > scans (usually 3 seconds each minimum) and all the other stuff that > MailScanner does, but you get the idea; the difference between the two > is massive. > > MailScanner --lint should tell you if clamd is working or not as it > should report that it found 'clamd' and detect the Eicar test: > > [root at mta41 ~]# MailScanner --lint > Trying to setlogsock(unix) > ConfigSQL configuration loaded with serial 594, next check in 900 seconds > Reading ruleset allowexternal for keyword allowexternal > > Checking version numbers... > Version number in MailScanner.conf (4.77.10) is correct. > > Checking for SpamAssassin errors (if you use it)... > Using SpamAssassin results cache > Connected to SpamAssassin cache database > SpamAssassin reported no errors. > I have found clamd f-prot-6 scanners installed, and will use them all by > default. > Connected to Processing Attempts Database > Created Processing Attempts Database successfully > There are 0 messages in the Processing Attempts Database > Using locktype = posix > MailScanner.conf says "Virus Scanners = auto" > Found these virus scanners installed: clamd, f-prot-6 > =========================================================================== > Filename Checks: Blocked Filename Detected (1 eicar.com) > Other Checks: Found 1 problems > Virus and Content Scanning: Starting > Clamd::INFECTED:: Eicar-Test-Signature :: ./1/ > Virus Scanning: Clamd found 1 infections > Scanning: - > at /usr/lib/MailScanner/MailScanner/SweepViruses.pm line 2338 > Virus Scanning: F-Prot6 found 1 infections > Infected message 1 came from 10.1.1.1 > Infected message 1.message->eicar.com came from > Virus Scanning: Found 2 viruses > =========================================================================== > > If any of your virus scanners (clamd,f-prot-6) > are not listed there, you should check that they are installed correctly > and that MailScanner is finding them correctly via its virus.scanners.conf. > > Regards, > Steve. Hi, and thank for your reply However the mail queue persist to over 13k, system load ~0.30 memory consumption 60% of 4Gb almost no cpu over 25%. A litle more information, this deploy has 5 server two mailscanner using baruwa in cluster, the mysql server is a percona mariadb cluster 3 there is almost 2million messages in the db and another 1million in archive the sa_bayes database is also in this cluster. At this point no sure if there is a botleneck impacting mailscanner process. Thanks for all yours answers. and Regards MailScanner --lint Trying to setlogsock(unix) Reading configuration file /opt/MailScanner/etc/MailScanner.conf Reading configuration file /opt/MailScanner/etc/conf.d/baruwa.conf Read 876 hostnames from the phishing whitelist Read 5890 hostnames from the phishing blacklists Config: calling custom init function BaruwaLowScore Baruwa: Populating spam score settings Baruwa: Read 20 spam score settings Config: calling custom init function BaruwaShouldScan Baruwa: Starting scanning settings Baruwa: Read 21 settings Config: calling custom init function BaruwaBlacklist Baruwa: Starting blacklists Baruwa: Read 0 blacklist items Baruwa: Ip blocks blacklisted: Config: calling custom init function BaruwaSQL Baruwa: Starting SQL logger Config: calling custom init function BaruwaHighScore Baruwa: Populating high spam score settings Baruwa: Read 20 high spam score settings Config: calling custom init function BaruwaWhitelist Baruwa: Starting whitelists Baruwa: Read 1 whitelist items Baruwa: Ip blocks whitelisted: Checking version numbers... Version number in MailScanner.conf (4.84.6) is correct. Your envelope_sender_header in spam.assassin.prefs.conf is correct. MailScanner setting GID to (105) MailScanner setting UID to (104) Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database SpamAssassin reported no errors. Connected to Processing Attempts Database Created Processing Attempts Database successfully There are 326 messages in the Processing Attempts Database Using locktype = flock MailScanner.conf says "Virus Scanners = clamd" Found these virus scanners installed: clamd =========================================================================== Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: Found 1 problems Virus and Content Scanning: Starting Clamd::INFECTED::Eicar-Test-Signature :: ./1/ Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com Virus Scanning: Clamd found 2 infections Infected message 1 came from 10.1.1.1 Virus Scanning: Found 2 viruses =========================================================================== Virus Scanner test reports: Clamd said "eicar.com was infected: Eicar-Test-Signature" If any of your virus scanners (clamd) are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. Config: calling custom end function BaruwaLowScore Baruwa: Shutting down spam score settings Config: calling custom end function BaruwaShouldScan Baruwa: Shutting down scanning settings Config: calling custom end function BaruwaBlacklist Baruwa: Shutting down blacklists Config: calling custom end function BaruwaSQL Baruwa: Shutting down SQL logger Config: calling custom end function BaruwaHighScore Baruwa: Shutting down high spam score settings Config: calling custom end function BaruwaWhitelist Baruwa: Shutting down whitelists MailScanner.conf http://paste.desdelinux.net/5098 ________________________________________________________________ XII Edicion del Evento Nacional de Informatica para Jovenes. INFOCLUB. Abril. 2015. Ver www.jovenclub.cu ________________________________________________________________ -- Este mensaje ha sido analizado por MailScanner en busca de virus y otros contenidos peligrosos, y se considera que est? limpio. From doctor at doctor.nl2k.ab.ca Sat Dec 27 21:44:39 2014 From: doctor at doctor.nl2k.ab.ca (The Doctor) Date: Sat, 27 Dec 2014 14:44:39 -0700 Subject: Help Message-ID: <20141227214437.GA23321@doctor.nl2k.ab.ca> Get my perl working , however, I get ktrace check_mailscanner Starting MailScanner...Can't locate object method "bootstrap" via package "DBI" at /usr/contrib/lib/perl5/site_perl/5.18.2/i386-bsdos/DBI.pm line 277. BEGIN failed--compilation aborted at /usr/contrib/lib/perl5/site_perl/5.18.2/i386-bsdos/DBI.pm line 284. Compilation failed in require at /opt/MailScanner/lib/MailScanner/ConfigSQL.pm line 36. BEGIN failed--compilation aborted at /opt/MailScanner/lib/MailScanner/ConfigSQL.pm line 36. Compilation failed in require at /opt/MailScanner/lib/Config.pm line 47. Compilation failed in require at /usr/libdata/perl5/5.18.2/i386-bsdos/DynaLoader.pm line 22. BEGIN failed--compilation aborted at /usr/libdata/perl5/5.18.2/i386-bsdos/DynaLoader.pm line 22. Compilation failed in require at /usr/contrib/lib/perl5/site_perl/5.18.2/i386-bsdos/Time/HiRes.pm line 7. Compilation failed in require at /opt/MailScanner/bin/MailScanner line 90. BEGIN failed--compilation aborted at /opt/MailScanner/bin/MailScanner line 90. Failed. You have new mail in /var/mail/doctor doctor.nl2k.ab.ca/~$ kdump 8702 ktrace RET ktrace 0 8702 ktrace CALL execve(0x8047168,0x8047630,0x8047638) 8702 ktrace NAMI "./check_mailscanner" 8702 ktrace RET execve -1 errno 2 No such file or directory 8702 ktrace CALL execve(0x8047168,0x8047630,0x8047638) 8702 ktrace NAMI "./check_mailscanner" 8702 ktrace RET execve -1 errno 2 No such file or directory 8702 ktrace CALL execve(0x8047168,0x8047630,0x8047638) 8702 ktrace NAMI "/root/bin/check_mailscanner" 8702 ktrace RET execve -1 errno 2 No such file or directory 8702 ktrace CALL execve(0x8047168,0x8047630,0x8047638) 8702 ktrace NAMI "/root/bin/check_mailscanner" 8702 ktrace RET execve -1 errno 2 No such file or directory 8702 ktrace CALL execve(0x8047168,0x8047630,0x8047638) 8702 ktrace NAMI "/usr/bin/check_mailscanner" 8702 ktrace NAMI "/bin/sh" 8702 ktrace NAMI "/shlib/libc_s.4.3.0" 8702 check_mailscanne RET execve 0 8702 check_mailscanne CALL open(0x8067030,0,0) 8702 check_mailscanne NAMI "/shlib/libcompat_s.4.3.0" 8702 check_mailscanne RET open 3 8702 check_mailscanne CALL mmap(0xa00c0000,0x1000,0x5,0x12,0x3,0,0,0) 8702 check_mailscanne RET mmap -1609826304/0xa00c0000 8702 check_mailscanne CALL mmap(0xa00c1000,0x3000,0x5,0x12,0x3,0,0x1000,0) 8702 check_mailscanne RET mmap -1609822208/0xa00c1000 8702 check_mailscanne CALL mmap(0xa00cc000,0x1000,0x3,0x12,0x3,0,0x4000,0) 8702 check_mailscanne RET mmap -1609777152/0xa00cc000 8702 check_mailscanne CALL close(0x3) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL open(0x8067049,0,0x1000) 8702 check_mailscanne NAMI "/shlib/libncurses_s.4.3.0" 8702 check_mailscanne RET open 3 8702 check_mailscanne CALL mmap(0xa0500000,0x1000,0x5,0x12,0x3,0,0,0) 8702 check_mailscanne RET mmap -1605369856/0xa0500000 8702 check_mailscanne CALL mmap(0xa0501000,0x29000,0x5,0x12,0x3,0,0x1000,0) 8702 check_mailscanne RET mmap -1605365760/0xa0501000 8702 check_mailscanne CALL mmap(0xa0540000,0x1000,0x3,0x12,0x3,0,0x2a000,0) 8702 check_mailscanne RET mmap -1605107712/0xa0540000 8702 check_mailscanne CALL mmap(0xa0541000,0x3000,0x3,0x1010,0xffffffff,0,0,0) 8702 check_mailscanne RET mmap -1605103616/0xa0541000 8702 check_mailscanne CALL close(0x3) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL getpid 8702 check_mailscanne RET getpid 8702/0x21fe 8702 check_mailscanne CALL geteuid 8702 check_mailscanne RET geteuid 0 8702 check_mailscanne CALL mmap(0,0x1000,0x3,0x1002,0xffffffff,0,0,0) 8702 check_mailscanne RET mmap 1208385536/0x48068000 8702 check_mailscanne CALL break(0x806aea8) 8702 check_mailscanne RET break 134656000/0x806b000 8702 check_mailscanne CALL break(0x806aea8) 8702 check_mailscanne RET break 134656000/0x806b000 8702 check_mailscanne CALL break(0x806c000) 8702 check_mailscanne RET break 134660096/0x806c000 8702 check_mailscanne CALL break(0x806c000) 8702 check_mailscanne RET break 134660096/0x806c000 8702 check_mailscanne CALL break(0x806d000) 8702 check_mailscanne RET break 134664192/0x806d000 8702 check_mailscanne CALL stat(0x806aa38,0x8047480) 8702 check_mailscanne NAMI "/var/mail/doctor" 8702 check_mailscanne RET stat 0 8702 check_mailscanne CALL open(0x8047fb9,0,0x10) 8702 check_mailscanne NAMI "/usr/bin/check_mailscanner" 8702 check_mailscanne RET open 3 8702 check_mailscanne CALL fcntl(0x3,0,0xa) 8702 check_mailscanne RET fcntl 10/0xa 8702 check_mailscanne CALL close(0x3) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL sigaction(SIGint,0,0x8047480) 8702 check_mailscanne RET sigaction 0 8702 check_mailscanne CALL sigaction(SIGint,0x8047480,0x8047474) 8702 check_mailscanne RET sigaction 0 8702 check_mailscanne CALL sigaction(SIGquit,0,0x8047470) 8702 check_mailscanne RET sigaction 0 8702 check_mailscanne CALL sigaction(SIGquit,0x8047470,0x8047464) 8702 check_mailscanne RET sigaction 0 8702 check_mailscanne CALL sigaction(SIGterm,0,0x8047480) 8702 check_mailscanne RET sigaction 0 8702 check_mailscanne CALL sigaction(SIGterm,0x8047480,0x8047474) 8702 check_mailscanne RET sigaction 0 8702 check_mailscanne CALL getuid 8702 check_mailscanne RET getuid 0 8702 check_mailscanne CALL geteuid 8702 check_mailscanne RET geteuid 0 8702 check_mailscanne CALL getgid 8702 check_mailscanne RET getgid 0 8702 check_mailscanne CALL getegid 8702 check_mailscanne RET getegid 0 8702 check_mailscanne CALL read(0xa,0x806a5a0,0x3ff) 8702 check_mailscanne GIO fd 10 read 1023 bytes "#!/bin/sh # # check_mailscanner # # $Id: check_mailscanner 4164 2007-09-03 17:14:03Z sysjkf $ # # Script to check whether mailscanner process is running, and # start it up if not. # # Copyright (C) 2002 Julian Field, Nick Phillips # # This program is free software; you can redistribute it and/or modi\ fy # it under the terms of the GNU General Public License as published \ by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-13\ 07 USA # # The author, Julian Field, can be contacted by email at #" 8702 check_mailscanne RET read 1023/0x3ff 8702 check_mailscanne CALL read(0xa,0x806a5a0,0x3ff) 8702 check_mailscanne GIO fd 10 read 1023 bytes " Jules at JulianField.net # or by paper mail at # Julian Field # Dept of Electronics & Computer Science # University of Southampton # Southampton # SO17 1BJ # United Kingdom # # Check that the virus scanner is still running. # Re-start it if necessary. # This can also be used from the init script to # start it in the first place. # This can be called with a "-q" command-line option so that it is qui\ et # unless MailScanner actually had to be started. process=MailScanner msbindir=/opt/MailScanner/bin config=/opt/MailScanner/etc/MailScanner.conf # These seem to get put all over the shop... PATH=/usr/bin:/bin export PATH PERL=perl AWK=awk GREP=grep FGREP=fgrep EGREP=egrep PGREP=pgrep PS=ps UNAME='uname -a' #TAINTWARN='-Tw' TAINTWARN= RETVALUE=" Done." # If this does not work on your system, please don't # just send us a version that does, please please please # send example output that demonstrates *why* it doesn't # work, what version of what system you are running etc. # " 8702 check_mailscanne RET read 1023/0x3ff 8702 check_mailscanne CALL break(0x806d000) 8702 check_mailscanne RET break 134664192/0x806d000 8702 check_mailscanne CALL break(0x806e000) 8702 check_mailscanne RET break 134668288/0x806e000 8702 check_mailscanne CALL read(0xa,0x806a5a0,0x3ff) 8702 check_mailscanne GIO fd 10 read 1023 bytes "If you do this then I *will* make this work right for # everybody. # -- Nick Phillips if $UNAME | $FGREP "SunOS" >/dev/null ; then # Version for Solaris/SysV systems: pid=`$PGREP $process` elif $UNAME | $FGREP "HP" >/dev/null ; then # Version for HP-UX pid=`ps -efx | fgrep $msbindir/$process | fgrep -v fgrep | awk '{print $2}'` elif $UNAME | $FGREP "SCO" >/dev/null ; then pid=`ps -e -o pid -o args | fgrep $msbindir/$process | grep -v grep | sed -e 's/^ *//' -e 's/ .*//'` elif $UNAME | $FGREP "Linux" >/dev/null ; then pid=`$PS axww | $EGREP $process'[:]|\\['$process'\\]|[ ]'$msbindir/$process | awk '{ print $1 }'` elif $UNAME | $FGREP "BSD" >/dev/null ; then pid=`$PS -axww | $EGREP '[ ]('$msbindir/$process')|'$process'[:]' | $AWK '{print $1}'` elif $UNAME | $FGREP "OSF" >/dev/null ; then pid=`ps -e -o pid -o args | $GREP '[ ]'$process | grep -v grep | awk '{ pr" 8702 check_mailscanne RET read 1023/0x3ff 8702 check_mailscanne CALL break(0x806e000) 8702 check_mailscanne RET break 134668288/0x806e000 8702 check_mailscanne CALL break(0x806f000) 8702 check_mailscanne RET break 134672384/0x806f000 8702 check_mailscanne CALL break(0x806f000) 8702 check_mailscanne RET break 134672384/0x806f000 8702 check_mailscanne CALL break(0x8070000) 8702 check_mailscanne RET break 134676480/0x8070000 8702 check_mailscanne CALL read(0xa,0x806a5a0,0x3ff) 8702 check_mailscanne GIO fd 10 read 821 bytes "int $1 }'` elif $UNAME | $FGREP "Darwin" >/dev/null ; then # ie Mac OSX pid=`$PS axww | $EGREP '[ ]('$msbindir/$process')|'$process'[:]' | $AWK '{print $1}'` else # not BSD; everything else seems to do POSIX pid=`COLUMNS=500 $PS -ef | $EGREP '([ ]'$msbindir/$process')|'$process'[:]' | $AWK '{print $2}'` fi # Not needed after 4.61.6. ## Make it run SpamAssassin out of tmpfs #if [ -d /dev/shm ]; then # TMPDIR=/dev/shm # export TMPDIR #fi if [ "x$pid" = "x" ]; then # Quietly try to raise the open_files limit ulimit -n 2000 >/dev/null 2>&1 # Restart it PATH=${msbindir}:$PATH echo -n 'Starting MailScanner...' cd $msbindir $process $config || RETVALUE=" Failed." echo "$RETVALUE" else if [ "x$1" != "x-q" ]; then echo MailScanner running with pid $pid fi fi " 8702 check_mailscanne RET read 821/0x335 8702 check_mailscanne CALL pipe 8702 check_mailscanne RET pipe 3 8702 check_mailscanne CALL fork 8702 check_mailscanne RET fork 8705/0x2201 8702 check_mailscanne CALL close(0x4) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL fork 8702 check_mailscanne RET fork 8706/0x2202 8702 check_mailscanne CALL close(0x3) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL close(0xffffffff) 8702 check_mailscanne RET close -1 errno 9 Bad file descriptor 8702 check_mailscanne CALL getpgrp 8702 check_mailscanne RET getpgrp 8702/0x21fe 8702 check_mailscanne CALL wait4(0xffffffff,0x8047428,0x2,0) 8702 check_mailscanne RET wait4 8706/0x2202 8702 check_mailscanne CALL wait4(0xffffffff,0x8047428,0x2,0) 8702 check_mailscanne RET wait4 8705/0x2201 8702 check_mailscanne CALL pipe 8702 check_mailscanne RET pipe 3 8702 check_mailscanne CALL fork 8702 check_mailscanne RET fork 8707/0x2203 8702 check_mailscanne CALL close(0x4) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL fork 8702 check_mailscanne RET fork 8708/0x2204 8702 check_mailscanne CALL close(0x3) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL close(0xffffffff) 8702 check_mailscanne RET close -1 errno 9 Bad file descriptor 8702 check_mailscanne CALL getpgrp 8702 check_mailscanne RET getpgrp 8702/0x21fe 8702 check_mailscanne CALL wait4(0xffffffff,0x80473f8,0x2,0) 8702 check_mailscanne RET wait4 8708/0x2204 8702 check_mailscanne CALL wait4(0xffffffff,0x80473f8,0x2,0) 8702 check_mailscanne RET wait4 8707/0x2203 8702 check_mailscanne CALL pipe 8702 check_mailscanne RET pipe 3 8702 check_mailscanne CALL fork 8702 check_mailscanne RET fork 8709/0x2205 8702 check_mailscanne CALL close(0x4) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL fork 8702 check_mailscanne RET fork 8710/0x2206 8702 check_mailscanne CALL close(0x3) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL close(0xffffffff) 8702 check_mailscanne RET close -1 errno 9 Bad file descriptor 8702 check_mailscanne CALL getpgrp 8702 check_mailscanne RET getpgrp 8702/0x21fe 8702 check_mailscanne CALL wait4(0xffffffff,0x80473c8,0x2,0) 8702 check_mailscanne RET wait4 8710/0x2206 8702 check_mailscanne CALL wait4(0xffffffff,0x80473c8,0x2,0) 8702 check_mailscanne RET wait4 8709/0x2205 8702 check_mailscanne CALL pipe 8702 check_mailscanne RET pipe 3 8702 check_mailscanne CALL fork 8702 check_mailscanne RET fork 8711/0x2207 8702 check_mailscanne CALL close(0x4) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL fork 8702 check_mailscanne RET fork 8712/0x2208 8702 check_mailscanne CALL close(0x3) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL close(0xffffffff) 8702 check_mailscanne RET close -1 errno 9 Bad file descriptor 8702 check_mailscanne CALL getpgrp 8702 check_mailscanne RET getpgrp 8702/0x21fe 8702 check_mailscanne CALL wait4(0xffffffff,0x8047398,0x2,0) 8702 check_mailscanne RET wait4 8712/0x2208 8702 check_mailscanne CALL wait4(0xffffffff,0x8047398,0x2,0) 8702 check_mailscanne RET wait4 8711/0x2207 8702 check_mailscanne CALL pipe 8702 check_mailscanne RET pipe 3 8702 check_mailscanne CALL fork 8702 check_mailscanne RET fork 8713/0x2209 8702 check_mailscanne CALL close(0x4) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL fork 8702 check_mailscanne RET fork 8714/0x220a 8702 check_mailscanne CALL close(0x3) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL close(0xffffffff) 8702 check_mailscanne RET close -1 errno 9 Bad file descriptor 8702 check_mailscanne CALL getpgrp 8702 check_mailscanne RET getpgrp 8702/0x21fe 8702 check_mailscanne CALL wait4(0xffffffff,0x8047368,0x2,0) 8702 check_mailscanne RET wait4 8713/0x2209 8702 check_mailscanne CALL wait4(0xffffffff,0x8047368,0x2,0) 8702 check_mailscanne RET wait4 8714/0x220a 8702 check_mailscanne CALL pipe 8702 check_mailscanne RET pipe 3 8702 check_mailscanne CALL fork 8702 check_mailscanne RET fork 8715/0x220b 8702 check_mailscanne CALL close(0x4) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL read(0x3,0x804722c,0x80) 8702 check_mailscanne GIO fd 3 read 0 bytes "" 8702 check_mailscanne RET read 0 8702 check_mailscanne CALL close(0x3) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL getpgrp 8702 check_mailscanne RET getpgrp 8702/0x21fe 8702 check_mailscanne CALL wait4(0xffffffff,0x8047198,0x2,0) 8702 check_mailscanne RET wait4 8715/0x220b 8702 check_mailscanne CALL break(0x8070000) 8702 check_mailscanne RET break 134676480/0x8070000 8702 check_mailscanne CALL break(0x8071000) 8702 check_mailscanne RET break 134680576/0x8071000 8702 check_mailscanne CALL sigprocmask(0x1,0) 8702 check_mailscanne RET sigprocmask 0 8702 check_mailscanne CALL fcntl(0x1,0,0xa) 8702 check_mailscanne RET fcntl 11/0xb 8702 check_mailscanne CALL open(0x806e2b4,0x601,0x1b6) 8702 check_mailscanne NAMI "/dev/null" 8702 check_mailscanne RET open 3 8702 check_mailscanne CALL dup2(0x3,0x1) 8702 check_mailscanne RET dup2 1 8702 check_mailscanne CALL close(0x3) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL fcntl(0x2,0,0xa) 8702 check_mailscanne RET fcntl 12/0xc 8702 check_mailscanne CALL dup2(0x1,0x2) 8702 check_mailscanne RET dup2 2 8702 check_mailscanne CALL getrlimit(0x8,0x80472ec) 8702 check_mailscanne RET getrlimit 0 8702 check_mailscanne CALL setrlimit(0x8,0x80472ec) 8702 check_mailscanne RET setrlimit 0 8702 check_mailscanne CALL dup2(0xb,0x1) 8702 check_mailscanne RET dup2 1 8702 check_mailscanne CALL close(0xb) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL dup2(0xc,0x2) 8702 check_mailscanne RET dup2 2 8702 check_mailscanne CALL close(0xc) 8702 check_mailscanne RET close 0 8702 check_mailscanne CALL write(0x1,0x8070000,0x17) 8702 check_mailscanne GIO fd 1 wrote 23 bytes "Starting MailScanner..." 8702 check_mailscanne RET write 23/0x17 8702 check_mailscanne CALL stat(0x806e2c0,0x80472fc) 8702 check_mailscanne NAMI "/opt/MailScanner/bin" 8702 check_mailscanne RET stat 0 8702 check_mailscanne CALL lstat(0x806e2d8,0x804725c) 8702 check_mailscanne NAMI "/opt" 8702 check_mailscanne RET lstat 0 8702 check_mailscanne CALL lstat(0x806e2d8,0x804725c) 8702 check_mailscanne NAMI "/opt/MailScanner" 8702 check_mailscanne RET lstat 0 8702 check_mailscanne CALL readlink(0x806e2d8,0x806e2ec,0xd) 8702 check_mailscanne NAMI "/opt/MailScanner" 8702 check_mailscanne RET readlink 13/0xd 8702 check_mailscanne CALL lstat(0x806e300,0x804725c) 8702 check_mailscanne NAMI "/usr" 8702 check_mailscanne RET lstat 0 8702 check_mailscanne CALL lstat(0x806e300,0x804725c) 8702 check_mailscanne NAMI "/usr/contrib" 8702 check_mailscanne RET lstat 0 8702 check_mailscanne CALL lstat(0x806e300,0x804725c) 8702 check_mailscanne NAMI "/usr/contrib/bin" 8702 check_mailscanne RET lstat 0 8702 check_mailscanne CALL chdir(0x806e300) 8702 check_mailscanne NAMI "/usr/contrib/bin" 8702 check_mailscanne RET chdir 0 8702 check_mailscanne CALL stat(0x806e2d8,0x80472fc) 8702 check_mailscanne NAMI "/opt/MailScanner/bin/MailScanner" 8702 check_mailscanne RET stat 0 8702 check_mailscanne CALL fork 8702 check_mailscanne RET fork 8732/0x221c 8702 check_mailscanne CALL getpgrp 8702 check_mailscanne RET getpgrp 8702/0x21fe 8702 check_mailscanne CALL wait4(0xffffffff,0x8047328,0x2,0) 8702 check_mailscanne RET wait4 8732/0x221c 8702 check_mailscanne CALL write(0x1,0x8070000,0x9) 8702 check_mailscanne GIO fd 1 wrote 9 bytes " Failed. " 8702 check_mailscanne RET write 9 8702 check_mailscanne CALL read(0xa,0x806a5a0,0x3ff) 8702 check_mailscanne GIO fd 10 read 0 bytes "" 8702 check_mailscanne RET read 0 8702 check_mailscanne CALL exit(0) doctor.nl2k.ab.ca/~$ check_mailscanner Starting MailScanner...Can't locate object method "bootstrap" via package "DBI" at /usr/contrib/lib/perl5/site_perl/5.18.2/i386-bsdos/DBI.pm line 277. BEGIN failed--compilation aborted at /usr/contrib/lib/perl5/site_perl/5.18.2/i386-bsdos/DBI.pm line 284. Compilation failed in require at /opt/MailScanner/lib/MailScanner/ConfigSQL.pm line 36. BEGIN failed--compilation aborted at /opt/MailScanner/lib/MailScanner/ConfigSQL.pm line 36. Compilation failed in require at /opt/MailScanner/lib/Config.pm line 47. Compilation failed in require at /usr/libdata/perl5/5.18.2/i386-bsdos/DynaLoader.pm line 22. BEGIN failed--compilation aborted at /usr/libdata/perl5/5.18.2/i386-bsdos/DynaLoader.pm line 22. Compilation failed in require at /usr/contrib/lib/perl5/site_perl/5.18.2/i386-bsdos/Time/HiRes.pm line 7. Compilation failed in require at /opt/MailScanner/bin/MailScanner line 90. BEGIN failed--compilation aborted at /opt/MailScanner/bin/MailScanner line 90. Failed. You have mail in /var/mail/doctor I did reinstall DBI and still no dice. -- Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca God,Queen and country!Never Satan President Republic!Beware AntiChrist rising! http://www.fullyfollow.me/rootnl2k Look at Psalms 14 and 53 on Atheism Merry Christmas 2014 and Happy New Year 2015 From mailscanner at joolee.nl Sat Dec 27 22:55:58 2014 From: mailscanner at joolee.nl (Joolee) Date: Sat, 27 Dec 2014 23:55:58 +0100 Subject: Help In-Reply-To: <20141227214437.GA23321@doctor.nl2k.ab.ca> References: <20141227214437.GA23321@doctor.nl2k.ab.ca> Message-ID: On 27 December 2014 at 22:44, The Doctor wrote: > /usr/contrib/lib/perl5/site_perl/5.18.2/i386-bsdos/ > Have you checked whether the reinstalled version of DBI actually installed at /usr/contrib/lib/perl5/site_perl/5.18.2/i386-bsdos/ ? -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20141227/21f607eb/attachment.html From doctor at doctor.nl2k.ab.ca Sat Dec 27 23:10:23 2014 From: doctor at doctor.nl2k.ab.ca (The Doctor) Date: Sat, 27 Dec 2014 16:10:23 -0700 Subject: Help In-Reply-To: References: <20141227214437.GA23321@doctor.nl2k.ab.ca> Message-ID: <20141227231022.GA9486@doctor.nl2k.ab.ca> On Sat, Dec 27, 2014 at 11:55:58PM +0100, Joolee wrote: > On 27 December 2014 at 22:44, The Doctor wrote: > > > /usr/contrib/lib/perl5/site_perl/5.18.2/i386-bsdos/ > > > > > Have you checked whether the reinstalled version of DBI actually installed > at /usr/contrib/lib/perl5/site_perl/5.18.2/i386-bsdos/ ? > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! Looks like reload the DBI module doctor.nl2k.ab.ca//usr$ ls /usr/contrib/lib/perl5/site_perl/5.18.2/i386-bsdos/ Bundle/ DBI.pm GD.pm MIME/ Razor2/ Socket6.pm Win32/ Compress/ Digest/ Geo/ Net/ SNMP.pm Storable.pm auto/ DBD/ Filesys/ HTML/ NetAddr/ Scalar/ Sys/ dbixs_rev.pl DBI/ GD/ List/ NetSNMP/ Socket.pm Time/ qd.pl doctor.nl2k.ab.ca//usr$ ls /usr/contrib/lib/perl5/site_perl/5.18.2/i386-bsdos/DBI Changes.pm DBD.pm Profile.pm ProfileDumper.pm PurePerl.pm W32ODBC.pm Const/ FAQ.pm ProfileData.pm ProfileSubs.pm SQL/ DBD/ Gofer/ ProfileDumper/ ProxyServer.pm Util/ doctor.nl2k.ab.ca//usr$ ls /usr/contrib/lib/perl5/site_perl/5.18.2/ App/ Devel/ IO/ Parse/ auto/ Archive/ Digest/ JSON/ Pod/ i386-bsdos/ Benchmark/ ExtUtils/ MIME/ Statistics/ newgetopt.pl CPAN/ File/ Mail/ Sys/ ok.pm Compress/ FileHandle/ Mozilla/ TAP/ spamassassin-run.pod Convert/ Getopt/ Net/ Test/ Date/ HTML/ OLE/ Time/ doctor.nl2k.ab.ca//usr$ ls /usr/contrib/lib/perl5/site_perl/5.18.2/auto Statistics/ doctor.nl2k.ab.ca//usr$ -- Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca God,Queen and country!Never Satan President Republic!Beware AntiChrist rising! http://www.fullyfollow.me/rootnl2k Look at Psalms 14 and 53 on Atheism Merry Christmas 2014 and Happy New Year 2015