Mails get quarantined multiple times

[Ryan Braganza]

I received a mail with queue id 9DECD35316. This mail was supposed to get
quarantined due to a size restriction but instead of getting quarantined
once it keeps getting quarantine until we removed this email manually from
queue

Mailscanner version is mailscanner-4.70.7-1


The logs show... .. any idea what could be wrong ?

Sep 29 12:47:29 smtp MailScanner[31421]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.4515E
Sep 29 12:47:39 smtp MailScanner[31490]: Content Checks: Message
9DECD35316.4DCC2 is bigger than 13312000 bytes
Sep 29 12:47:39 smtp MailScanner[31490]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.4DCC2
Sep 29 12:47:46 smtp MailScanner[31411]: Content Checks: Message
9DECD35316.E2456 is bigger than 13312000 bytes
Sep 29 12:47:46 smtp MailScanner[31411]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.E2456
Sep 29 12:47:52 smtp MailScanner[31336]: Content Checks: Message
9DECD35316.21440 is bigger than 13312000 bytes
Sep 29 12:47:52 smtp MailScanner[31336]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.21440
Sep 29 12:47:59 smtp MailScanner[31513]: Content Checks: Message
9DECD35316.383FF is bigger than 13312000 bytes
Sep 29 12:47:59 smtp MailScanner[31513]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.383FF
Sep 29 12:48:05 smtp MailScanner[31553]: Content Checks: Message
9DECD35316.CDB95 is bigger than 13312000 bytes
Sep 29 12:48:05 smtp MailScanner[31553]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.CDB95
Sep 29 12:48:11 smtp MailScanner[31523]: Content Checks: Message
9DECD35316.F07D0 is bigger than 13312000 bytes
Sep 29 12:48:11 smtp MailScanner[31523]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.F07D0
Sep 29 12:48:18 smtp MailScanner[31582]: Content Checks: Message
9DECD35316.C9CE2 is bigger than 13312000 bytes
Sep 29 12:48:18 smtp MailScanner[31582]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.C9CE2
Sep 29 12:48:24 smtp MailScanner[31499]: Content Checks: Message
9DECD35316.01EFE is bigger than 13312000 bytes

[Glenn Steen]

Oooh, that's old!

Don't think MailScanner had the crash detection code in it then, so
basically any email that could crash MailScanner (it happens,
infriquently, but...:-), would appear as a loop of the kind you
describe. only remedy back then was to do what you've done already...
Removing the offending message from the queue manually.

If you upgrade to the latest/greatest, it includes logic (the
processing database feature) that will automatically remove any
message/queue ID (and quarantine it) that gets seen more than a set
number of times (6 by default).

So... go do that upgrade;)

Cheers!
--
-- Glenn

Post by Ryan Braganza
I received a mail with queue id 9DECD35316. This mail was supposed to get
quarantined due to a size restriction but instead of getting quarantined
once it keeps getting quarantine until we removed this email manually from
queue
Mailscanner version is mailscanner-4.70.7-1
The logs show... .. any idea what could be wrong ?
Sep 29 12:47:29 smtp MailScanner[31421]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.4515E
Sep 29 12:47:39 smtp MailScanner[31490]: Content Checks: Message
9DECD35316.4DCC2 is bigger than 13312000 bytes
Sep 29 12:47:39 smtp MailScanner[31490]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.4DCC2
Sep 29 12:47:46 smtp MailScanner[31411]: Content Checks: Message
9DECD35316.E2456 is bigger than 13312000 bytes
Sep 29 12:47:46 smtp MailScanner[31411]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.E2456
Sep 29 12:47:52 smtp MailScanner[31336]: Content Checks: Message
9DECD35316.21440 is bigger than 13312000 bytes
Sep 29 12:47:52 smtp MailScanner[31336]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.21440
Sep 29 12:47:59 smtp MailScanner[31513]: Content Checks: Message
9DECD35316.383FF is bigger than 13312000 bytes
Sep 29 12:47:59 smtp MailScanner[31513]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.383FF
Sep 29 12:48:05 smtp MailScanner[31553]: Content Checks: Message
9DECD35316.CDB95 is bigger than 13312000 bytes
Sep 29 12:48:05 smtp MailScanner[31553]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.CDB95
Sep 29 12:48:11 smtp MailScanner[31523]: Content Checks: Message
9DECD35316.F07D0 is bigger than 13312000 bytes
Sep 29 12:48:11 smtp MailScanner[31523]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.F07D0
Sep 29 12:48:18 smtp MailScanner[31582]: Content Checks: Message
9DECD35316.C9CE2 is bigger than 13312000 bytes
Sep 29 12:48:18 smtp MailScanner[31582]: Saved entire message to
/usr/local/spool/MailScanner/quarantine/20140929/9DECD35316.C9CE2
Sep 29 12:48:24 smtp MailScanner[31499]: Content Checks: Message
9DECD35316.01EFE is bigger than 13312000 bytes
--
--------------------------------------------------------------------------------------------------------------------------------------
?Race the rain, Ride the wind & Chase the sunset.
Only a biker understands.?
--------------------------------------------------------------------------------------------------------------------------------------
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

[Ryan Braganza]

Thanks Glenn I will go for an upgrade

Post by Glenn Steen
Oooh, that's old!
Don't think MailScanner had the crash detection code in it then, so
basically any email that could crash MailScanner (it happens,
infriquently, but...:-), would appear as a loop of the kind you
describe. only remedy back then was to do what you've done already...
Removing the offending message from the queue manually.
If you upgrade to the latest/greatest, it includes logic (the
processing database feature) that will automatically remove any
message/queue ID (and quarantine it) that gets seen more than a set
number of times (6 by default).
So... go do that upgrade;)
Cheers!
--
-- Glenn

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20140930/cc8d71ca/attachment.html