Hi again Jason, thanks for your response. See below for the log results and
header for an email that looks to me as if it should't have been
quarantined. Any ideas on the reason ? Note that the subject and email
address are not in the quarantine-attachments.txt file. I've attached the
email using ms outlook if that's any help.
As you suggested, I have reinstalled Qmail-Scanner with logging on as
follows :
./configure --scanners fast_spamassassin=#####SPAM#### --notify
none --fix-mime yes --ignore-eol-check yes --unzip yes --log-details
syslog --install
Then from /var/log/maillog I picked out one entry that related to a message
that looks like it shouldn't have been quarantined.
Jun 18 10:41:55 netServ spamd[437]: connection from
localhost.datataker.com.au [127.0.0.1] at port 2201
Jun 18 10:41:55 netServ spamd[50208]: handle_user: unable to find user
'[EMAIL PROTECTED]'!
Jun 18 10:41:55 netServ spamd[50208]: Still running as root: user not
specified with -u, not found, or set to root. Fall back to nobody.
Jun 18 10:41:55 netServ spamd[50208]: checking message
<[EMAIL PROTECTED]> for
[EMAIL PROTECTED]:65534.
Jun 18 10:41:55 netServ spamd[50208]: clean message (0.6/5.0) for
[EMAIL PROTECTED]:65534 in 0.3 seconds, 5027 bytes.
Jun 18 10:41:55 netServ qmail-scanner[50203]:
Clear:RC:0(207.155.248.71):SA:0(0.6/5.0): 0 1100 [EMAIL PROTECTED] <>
virus_found_in_sent_message_"Fw:_DT800-19_Product_reports"
[EMAIL PROTECTED]
quarantine-event.txt:1000
Jun 18 10:41:55 netServ qmail-scanner[50203]:
Clear:RC:0(207.155.248.71):SA:0(0.6/5.0): 0 1100 [EMAIL PROTECTED] <>
virus_found_in_sent_message_"Fw:_DT800-19_Product_reports"
[EMAIL PROTECTED]
quarantine-event.txt:1000
Jun 18 10:41:55 netServ qmail-scanner[50203]:
Perlscan::RC:0(207.155.248.71):SA:0(0.6/5.0): 0.737186 5027
[EMAIL PROTECTED] [EMAIL PROTECTED]
Fw:_DT800-19_Product_reports <[EMAIL PROTECTED]>
1087519315.50205-0.netServ.datataker.com.au:860
1087519315.50205-1.netServ.datataker.com.au:2757
This is the header for the message.
Received: from unknown (HELO devonshire.xo.com) (207.155.248.71)
by 0 with SMTP; 18 Jun 2004 00:41:54 -0000
Received: from martinw2k (69-168-179-220.clvdoh.adelphia.net
[69.168.179.220])
by devonshire.xo.com
id UAA14651; Thu, 17 Jun 2004 20:41:43 -0400 (EDT)
[ConcentricHost SMTP Relay 1.17]
Errors-To: <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
From: "Pete Martin" <[EMAIL PROTECTED]>
To: "Owen Castle" <[EMAIL PROTECTED]>
Subject: Fw: DT800-19 Product reports
Date: Thu, 17 Jun 2004 20:45:10 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0010_01C454AB.FB24CBD0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4927.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4927.1200
On Wed, Jun 16, 2004 at 09:18:33AM +1000, Andrew van Tilburg wrote:
> Hi all. I'm running Qmail-Scanner 1.22 with Perl 5.00503 on Freebsd 4.5.
> Qmail-Scanner works great, but I'm finding the odd email that gets
> quarantined for reason(s) I can't figure out. I have just upgraded from
Well the reason is logged - so why are they being quarantined?
If you tail the quarantined msg, you will see extra Q-S details - including
why it was quarantined, and of course, if you used "--log-details syslog",
it would have shown up in your syslogs too...
I think I need to make that the default...
--
Cheers
--- Begin Message ---
|
Owen,
This fixed the problem. Don't know how it got
mixed up as we did not open the boxes.
Thanks for your help
Pete
----- Original Message -----
Sent: Thursday, June 17, 2004 7:38 PM
Subject: RE: DT800-19 Product reports
Dear
Peter,
Now it
is OK, thanks a lot.
Enrique
Enrique,
I received these back from Australia this
morning. Are these the documents that were marked incorrectly? If
this is not what you need, please scan a copy of the incorrect paperwork and
email it back to me so that I can know what we are asking Australia
for.
Thank you & regards,
Pete Martin
|
--- End Message ---
