<div dir="ltr">Robert,<div><br></div><div style>There are three primary things I check for when dealing with this problem:</div><div style><br></div><div style>1. Selinux. You know the drill for this one.</div><div style>2. MailScanner Run As and directory ownership and permissions.</div>
<div style>3. Making sure you add the -U option to MailScanner for the newer versions of perl. </div><div style><br></div><div style><div>sed -i 's:#!/usr/bin/perl -I:#!/usr/bin/perl -U -I:g' /usr/sbin/MailScanner</div>
<div><br></div><div><br></div><div style>Jerry Benton</div><div style><br></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, May 15, 2013 at 7:31 PM, Robert Lopez <span dir="ltr"><<a href="mailto:rlopezcnm@gmail.com" target="_blank">rlopezcnm@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Do I have a MailScanner configuration problem or is this expected behavior?<br>
<br>
MailScanner 4.84.5-3<br>
Clamd 0.97.7-1<br>
SpamAssassin 3.3.1<br>
Perl 5.10.1<br>
Postfix 2.10.0<br>
<br>
A new email gateway is sending the much discussed "Problem Email"<br>
messages. As far as I see there is not a problem with anything other<br>
than the emails that are listed in the "Problem Email" messages.<br>
<br>
However, I see a pattern that looks like this, where there are<br>
apparently multiple attempts to scan of each email by SpamAssassin:<br>
<br>
May 15 10:18:08 mg08 postfix/cleanup[7331]: 780574C02AB: hold: header<br>
Received: from <a href="http://apn-37-7-144-188.dynamic.gprs.plus.pl" target="_blank">apn-37-7-144-188.dynamic.gprs.plus.pl</a> (unknown<br>
<a href="tel:%5B5.174.118.246" value="+15174118246">[5.174.118.246</a>])??by <a href="http://mg08.cnm.edu" target="_blank">mg08.cnm.edu</a> (Postfix) with ESMTP id<br>
780574C02AB??for <<a href="mailto:xxxxxxxx@cnm.edu">xxxxxxxx@cnm.edu</a>>; Wed, 15 May 2013 10:18:06 -0600<br>
(MDT) from unknown<a href="tel:%5B5.174.118.246" value="+15174118246">[5.174.118.246</a>];<br>
from=<<a href="mailto:wBlUzCw213@apostolic-voice.org">wBlUzCw213@apostolic-voice.org</a>> to=<<a href="mailto:xxxxxxxx@cnm.edu">xxxxxxxx@cnm.edu</a>><br>
proto=ESMTP helo=<<a href="http://apn-37-7-144-188.dynamic.gprs.plus.pl" target="_blank">apn-37-7-144-188.dynamic.gprs.plus.pl</a>><br>
May 15 10:18:08 mg08 postfix/cleanup[7331]: 780574C02AB: warning:<br>
header Subject: I cant be the only one in this from<br>
unknown<a href="tel:%5B5.174.118.246" value="+15174118246">[5.174.118.246</a>]; from=<<a href="mailto:wBlUzCw213@apostolic-voice.org">wBlUzCw213@apostolic-voice.org</a>><br>
to=<<a href="mailto:xxxxxxxx@cnm.edu">xxxxxxxx@cnm.edu</a>> proto=ESMTP<br>
helo=<<a href="http://apn-37-7-144-188.dynamic.gprs.plus.pl" target="_blank">apn-37-7-144-188.dynamic.gprs.plus.pl</a>><br>
May 15 10:18:08 mg08 postfix/cleanup[7331]: 780574C02AB:<br>
message-id=<<a href="mailto:9BAEEC48-4130-08D1-E84A-F0DF63F3D233@apn-37-7-144-188.dynamic.gprs.plus.pl">9BAEEC48-4130-08D1-E84A-F0DF63F3D233@apn-37-7-144-188.dynamic.gprs.plus.pl</a>><br>
May 15 10:18:13 mg08 MailScanner[4633]: Message 780574C02AB.A2DEA from<br>
5.174.118.246 (<a href="mailto:wbluzcw213@apostolic-voice.org">wbluzcw213@apostolic-voice.org</a>) to <a href="http://cnm.edu" target="_blank">cnm.edu</a> is spam,<br>
SpamAssassin (not cached, score=16.991, required 6,<br>
autolearn=disabled, CK_HELO_GENERIC 0.25, HELO_DYNAMIC_IPADDR 3.24,<br>
RDNS_NONE 1.27, URIBL_AB_SURBL 4.50, URIBL_BLACK 1.77, URIBL_DBL_SPAM<br>
1.70, URIBL_JP_SURBL 1.95, URIBL_SBL 0.64, URIBL_WS_SURBL 1.66)<br>
May 15 10:18:13 mg08 MailScanner[4633]: Non-delivery of spam: message<br>
780574C02AB.A2DEA from <a href="mailto:wbluzcw213@apostolic-voice.org">wbluzcw213@apostolic-voice.org</a> to<br>
<a href="mailto:xxxxxxxx@cnm.edu">xxxxxxxx@cnm.edu</a> with subject I cant be the only one in this<br>
May 15 10:18:13 mg08 MailScanner[4633]: Spam Actions: message<br>
780574C02AB.A2DEA actions are store<br>
May 15 10:20:54 mg08 MailScanner[7342]: Making attempt 2 at processing<br>
message 780574C02AB.A2DEA<br>
May 15 10:20:54 mg08 MailScanner[7342]: SpamAssassin cache hit for<br>
message 780574C02AB.A2DEA<br>
May 15 10:20:54 mg08 MailScanner[7342]: Message 780574C02AB.A2DEA from<br>
5.174.118.246 (<a href="mailto:wbluzcw213@apostolic-voice.org">wbluzcw213@apostolic-voice.org</a>) to <a href="http://cnm.edu" target="_blank">cnm.edu</a> is spam,<br>
SpamAssassin (cached, score=16.991, required 6, autolearn=disabled,<br>
CK_HELO_GENERIC 0.25, HELO_DYNAMIC_IPADDR 3.24, RDNS_NONE 1.27,<br>
URIBL_AB_SURBL 4.50, URIBL_BLACK 1.77, URIBL_DBL_SPAM 1.70,<br>
URIBL_JP_SURBL 1.95, URIBL_SBL 0.64, URIBL_WS_SURBL 1.66)<br>
May 15 10:20:54 mg08 MailScanner[7342]: Non-delivery of spam: message<br>
780574C02AB.A2DEA from <a href="mailto:wbluzcw213@apostolic-voice.org">wbluzcw213@apostolic-voice.org</a> to<br>
<a href="mailto:xxxxxxxx@cnm.edu">xxxxxxxx@cnm.edu</a> with subject I cant be the only one in this<br>
May 15 10:20:54 mg08 MailScanner[7342]: Spam Actions: message<br>
780574C02AB.A2DEA actions are store<br>
May 15 10:25:16 mg08 MailScanner[4579]: Making attempt 3 at processing<br>
message 780574C02AB.A2DEA<br>
May 15 10:25:16 mg08 MailScanner[4579]: SpamAssassin cache hit for<br>
message 780574C02AB.A2DEA<br>
May 15 10:25:16 mg08 MailScanner[4579]: Message 780574C02AB.A2DEA from<br>
5.174.118.246 (<a href="mailto:wbluzcw213@apostolic-voice.org">wbluzcw213@apostolic-voice.org</a>) to <a href="http://cnm.edu" target="_blank">cnm.edu</a> is spam,<br>
SpamAssassin (cached, score=16.991, required 6, autolearn=disabled,<br>
CK_HELO_GENERIC 0.25, HELO_DYNAMIC_IPADDR 3.24, RDNS_NONE 1.27,<br>
URIBL_AB_SURBL 4.50, URIBL_BLACK 1.77, URIBL_DBL_SPAM 1.70,<br>
URIBL_JP_SURBL 1.95, URIBL_SBL 0.64, URIBL_WS_SURBL 1.66)<br>
May 15 10:25:16 mg08 MailScanner[4579]: Non-delivery of spam: message<br>
780574C02AB.A2DEA from <a href="mailto:wbluzcw213@apostolic-voice.org">wbluzcw213@apostolic-voice.org</a> to<br>
<a href="mailto:xxxxxxxx@cnm.edu">xxxxxxxx@cnm.edu</a> with subject I cant be the only one in this<br>
May 15 10:25:16 mg08 MailScanner[4579]: Spam Actions: message<br>
780574C02AB.A2DEA actions are store<br>
May 15 10:28:34 mg08 MailScanner[4746]: Making attempt 4 at processing<br>
message 780574C02AB.A2DEA<br>
May 15 10:28:34 mg08 MailScanner[4746]: SpamAssassin cache hit for<br>
message 780574C02AB.A2DEA<br>
May 15 10:28:34 mg08 MailScanner[4746]: Message 780574C02AB.A2DEA from<br>
5.174.118.246 (<a href="mailto:wbluzcw213@apostolic-voice.org">wbluzcw213@apostolic-voice.org</a>) to <a href="http://cnm.edu" target="_blank">cnm.edu</a> is spam,<br>
SpamAssassin (cached, score=16.991, required 6, autolearn=disabled,<br>
CK_HELO_GENERIC 0.25, HELO_DYNAMIC_IPADDR 3.24, RDNS_NONE 1.27,<br>
URIBL_AB_SURBL 4.50, URIBL_BLACK 1.77, URIBL_DBL_SPAM 1.70,<br>
URIBL_JP_SURBL 1.95, URIBL_SBL 0.64, URIBL_WS_SURBL 1.66)<br>
May 15 10:28:34 mg08 MailScanner[4746]: Non-delivery of spam: message<br>
780574C02AB.A2DEA from <a href="mailto:wbluzcw213@apostolic-voice.org">wbluzcw213@apostolic-voice.org</a> to<br>
<a href="mailto:xxxxxxxx@cnm.edu">xxxxxxxx@cnm.edu</a> with subject I cant be the only one in this<br>
May 15 10:28:34 mg08 MailScanner[4746]: Spam Actions: message<br>
780574C02AB.A2DEA actions are store<br>
May 15 10:30:38 mg08 MailScanner[7382]: Making attempt 5 at processing<br>
message 780574C02AB.A2DEA<br>
May 15 10:30:38 mg08 MailScanner[7382]: SpamAssassin cache hit for<br>
message 780574C02AB.A2DEA<br>
May 15 10:30:38 mg08 MailScanner[7382]: Message 780574C02AB.A2DEA from<br>
5.174.118.246 (<a href="mailto:wbluzcw213@apostolic-voice.org">wbluzcw213@apostolic-voice.org</a>) to <a href="http://cnm.edu" target="_blank">cnm.edu</a> is spam,<br>
SpamAssassin (cached, score=16.991, required 6, autolearn=disabled,<br>
CK_HELO_GENERIC 0.25, HELO_DYNAMIC_IPADDR 3.24, RDNS_NONE 1.27,<br>
URIBL_AB_SURBL 4.50, URIBL_BLACK 1.77, URIBL_DBL_SPAM 1.70,<br>
URIBL_JP_SURBL 1.95, URIBL_SBL 0.64, URIBL_WS_SURBL 1.66)<br>
May 15 10:30:38 mg08 MailScanner[7382]: Non-delivery of spam: message<br>
780574C02AB.A2DEA from <a href="mailto:wbluzcw213@apostolic-voice.org">wbluzcw213@apostolic-voice.org</a> to<br>
<a href="mailto:xxxxxxxx@cnm.edu">xxxxxxxx@cnm.edu</a> with subject I cant be the only one in this<br>
May 15 10:30:38 mg08 MailScanner[7382]: Spam Actions: message<br>
780574C02AB.A2DEA actions are store<br>
May 15 10:34:24 mg08 MailScanner[7439]: Making attempt 6 at processing<br>
message 780574C02AB.A2DEA<br>
May 15 10:34:24 mg08 MailScanner[7439]: SpamAssassin cache hit for<br>
message 780574C02AB.A2DEA<br>
May 15 10:34:24 mg08 MailScanner[7439]: Message 780574C02AB.A2DEA from<br>
5.174.118.246 (<a href="mailto:wbluzcw213@apostolic-voice.org">wbluzcw213@apostolic-voice.org</a>) to <a href="http://cnm.edu" target="_blank">cnm.edu</a> is spam,<br>
SpamAssassin (cached, score=16.991, required 6, autolearn=disabled,<br>
CK_HELO_GENERIC 0.25, HELO_DYNAMIC_IPADDR 3.24, RDNS_NONE 1.27,<br>
URIBL_AB_SURBL 4.50, URIBL_BLACK 1.77, URIBL_DBL_SPAM 1.70,<br>
URIBL_JP_SURBL 1.95, URIBL_SBL 0.64, URIBL_WS_SURBL 1.66)<br>
May 15 10:34:24 mg08 MailScanner[7439]: Non-delivery of spam: message<br>
780574C02AB.A2DEA from <a href="mailto:wbluzcw213@apostolic-voice.org">wbluzcw213@apostolic-voice.org</a> to<br>
<a href="mailto:xxxxxxxx@cnm.edu">xxxxxxxx@cnm.edu</a> with subject I cant be the only one in this<br>
May 15 10:34:24 mg08 MailScanner[7439]: Spam Actions: message<br>
780574C02AB.A2DEA actions are store<br>
May 15 10:34:24 mg08 MailScanner[7422]: Warning: skipping message<br>
780574C02AB.A2DEA as it has been attempted too many times<br>
May 15 10:34:24 mg08 MailScanner[7422]: Quarantined message<br>
780574C02AB.A2DEA as it caused MailScanner to crash several times<br>
May 15 10:34:24 mg08 MailScanner[7422]: Saved entire message to<br>
/var/spool/MailScanner/quarantine/20130515/780574C02AB.A2DEA<br>
<br>
<br>
Do I have a MailScanner configuration problem or is this expected behavior?<br>
<br>
<br>
--<br>
Robert Lopez<br>
Unix Systems Administrator<br>
Central New Mexico Community College (CNM)<br>
525 Buena Vista SE<br>
Albuquerque, New Mexico 87106<br>
<span class="HOEnZb"><font color="#888888">--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><div><div><br>--<br></div>Jerry Benton<br></div>Mailborder Systems<br><a href="http://www.mailborder.com" target="_blank">www.mailborder.com</a><br>
</div>
</div>