Hi,
I was looking through the qms-events.log file and I noticed lots of lines like "1101298025:28594:SMTP-DROP" about 10 an hour.
After enabling Debug in the qmail scanner I can see that the message is drooped because there is no sender or recipient.
Wed, 24 Nov 2004 12:07:05 GMT:28594: +++ starting debugging for process 28594 by uid=89
Wed, 24 Nov 2004 12:07:05 GMT:28594: setting UID to EUID so subprocesses can access files generated by this script
Wed, 24 Nov 2004 12:07:05 GMT:28594: program name is qmail-scanner-queue.pl, version 1.22-st-qms
Wed, 24 Nov 2004 12:07:05 GMT:28594: incoming SMTP connection from via SMTP from 195.8.183.35
Wed, 24 Nov 2004 12:07:05 GMT:28594: w_c: mkdir /var/spool/qmailscan/tmp/sys1.domain-cp.com110129802562028594
Wed, 24 Nov 2004 12:07:05 GMT:28594: w_c: start dumping incoming msg into /var/spool/qmailscan/working/tmp/sys1.domain-cp.com110129802562028594 [1101298025.49252]
Wed, 24 Nov 2004 12:07:05 GMT:28594: w_c: primary Content-Type of multipart/alternative found
Wed, 24 Nov 2004 12:07:05 GMT:28594: w_c: found a top-level boundary definition of \-\-NextMimePartHTML
Wed, 24 Nov 2004 12:07:05 GMT:28594: w_c: attachment 1: Content-Type of text/plain found
Wed, 24 Nov 2004 12:07:05 GMT:28594: w_c: rename new msg from /var/spool/qmailscan/working/tmp/sys1.domain-cp.com110129802562028594 to /var/spool/qmailscan/working/new/sys1.domain-cp.com110129802562028594 [1101298025.55429]
Wed, 24 Nov 2004 12:07:05 GMT:28594: d_m: starting /cp/apps/bin/reformime -x/var/spool/qmailscan/tmp/sys1.domain-cp.com110129802562028594/ </var/spool/qmailscan/working/new/sys1.domain-cp.com110129802562028594 [1101298025.55476]
Wed, 24 Nov 2004 12:07:05 GMT:28594: d_m: finished /cp/apps/bin/reformime -x/var/spool/qmailscan/tmp/sys1.domain-cp.com110129802562028594/ [1101298025.56161]
Wed, 24 Nov 2004 12:07:05 GMT:28594: d_m: Checking all attachments to see if they're MS-TNEF
Wed, 24 Nov 2004 12:07:05 GMT:28594: d_m: is /var/spool/qmailscan/tmp/sys1.domain-cp.com110129802562028594/1101298025.28596-0.sys1.domain-cp.com is a TNEF file?: 256 [1101298025.56413]
Wed, 24 Nov 2004 12:07:05 GMT:28594: d_m: unpacking message took 0.009674 seconds
Wed, 24 Nov 2004 12:07:05 GMT:28594: unsetting QMAILQUEUE env var
Wed, 24 Nov 2004 12:07:05 GMT:28594: g_e_h: no sender and no recips.
Wed, 24 Nov 2004 12:07:05 GMT:28594: cleanup: archiving into /var/spool/qmailscan/archive/new/
Wed, 24 Nov 2004 12:07:05 GMT:28594: --- all finished. Total of 0.076274 secs
Here is the corresponding message :
Received: from unknown (HELO main.ARIA.CO.UK) (195.8.183.35)
by 0 with SMTP; 24 Nov 2004 12:07:05 -0000
Received: from main.aria.co.uk ([192.168.1.89] RDNS failed) by main.ARIA.CO.UK with Microsoft SMTPS
VC(5.0.2195.6713);
Wed, 24 Nov 2004 11:22:59 +0000
From: [EMAIL PROTECTED]
To: Removed My Email Address
Subject: Aria Super Specials
Date: 24 Nov 2004 11:22:59 +0000
MIME-Version: 1.0
X-Mailer: OstroSoft SMTP Component (5.0.4)
Content-Type: multipart/alternative; boundary="--NextMimePartHTML"
Return-Path: [EMAIL PROTECTED]
Message-ID: <[EMAIL PROTECTED]>
X-OriginalArrivalTime: 24 Nov 2004 11:22:59.0777 (UTC) FILETIME=[F449BB10:01C4D217]
----NextMimePartHTML Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit
Aria - Our latest special offers! check out our fantastic prices @ aria.co.uk
-----------------------------------------------------------------------
Dear Ewan,
Welcome to our Super Specials email. These offers are the best in the business and
*** Qmail-Scanner Envelope Details Begin ***
X-Qmail-Scanner-Mail-From: "" via sys1.domain-cp.com
X-Qmail-Scanner-Rcpt-To: ""
X-Qmail-Scanner: 1.22-st-qms (clamdscan: 0.74. spamassassin: 2.63. Clear:RC:0(195.8.183.35):. Pro
cessed in 0.07385 secs)
*** Qmail-Scanner Envelope Details End ***
The only unusual thing I can see about the message is that it ends abruptly. All the dropped email is coming from one of two senders.
I found this in the qmail scanner file : #At the very least this is supposed to be $env_returnpath='F' - so #qmail-smtpd must be officially dropping the incoming message for #some (valid) reason (including the other end dropping the connection).
So i'm now thinking this is probably not a qmail scanner problem. Has anyone seen this before or does anyone have an explanation. The qmail log files are next to useless. Is their a way to find out why qmail is dropping the message?
Thanks, Ewan.
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/
_______________________________________________
Qmail-scanner-general mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
