Hello:
As I installed amavisd-new-2.4??? on a Solaris 10 machine, I started getting
some errors in my logs. I ignored the errors until I had some time to look
deep since this is a non-production system. As I upgraded another system,
this time a Solaris 9 machine, I started to see the same problem. Looks as
SpamAssassin is choking on a piece of mail but I doubt that could be the
problem. Both of these machines are processing exactly the same mail as my
email gateway is delivering email to these two machines in parallel. When
the Solaris 10 machine started to experience this problem, I looked at the
logs of the Solaris 9 machine and they were clean, no trace of any problem.
I hope someone can spot the problem.
Thanks,
Ronald Vazquez
Mar 24 06:09:03 grande amavis[26977]: [ID 702911 mail.debug] (26977-02)
process_request: fileno sock=12, STDIN=13, STDOUT=14
Mar 24 06:09:03 grande amavis[26977]: [ID 702911 mail.info] (26977-03)
LMTP::10024 /var/amavis/tmp/amavis-20060324T050603-26977:
<[EMAIL PROTECTED]> -> <[EMAIL PROTECTED]> SIZE=7177
Received: from ctcministries.org ([127.0.0.1]) by localhost
(mail.ctcministries.org [127.0.0.1]) (amavisd-new, port 10024) with LMTP for
<[EMAIL PROTECTED]>; Fri, 24 Mar 2006 06:09:03 -0500 (EST)
Mar 24 06:09:03 grande amavis[26977]: [ID 702911 mail.info] (26977-03) Actual
message size 7320 B greater than the declared 7177 B
Mar 24 06:09:03 grande amavis[26977]: [ID 702911 mail.debug] (26977-03) body
hash: 3dfb55ef7f9f1c3a5d8710f5e0cbce45
Mar 24 06:09:03 grande amavis[26977]: [ID 702911 mail.info] (26977-03)
Checking: DCNNNbkIQ08m <[EMAIL PROTECTED]> ->
<[EMAIL PROTECTED]>
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.info] (26977-03) p003 1
Content-Type: multipart/mixed
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.info] (26977-03) p004
1/1 Content-Type: multipart/alternative
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.info] (26977-03) p001
1/1/1 Content-Type: text/html, size: 1435 B, name:
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.info] (26977-03) p002
1/2 Content-Type: text/plain, size: 1907 B, name: SpamAssassinReport.txt
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.debug] (26977-03)
Checking for banned types and filenames
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.debug] (26977-03)
collect banned table[0]: [EMAIL PROTECTED], tables:
DEFAULT=>Amavis::Lookup::RE=ARRAY(0xb0335c)
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.debug] (26977-03) p.path
[EMAIL PROTECTED]: "P=p003,L=1,M=multipart/mixed |
P=p002,L=1/2,M=text/plain,T=asc,N=SpamAssassinReport.txt"
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.debug] (26977-03) p.path
[EMAIL PROTECTED]: "P=p003,L=1,M=multipart/mixed |
P=p004,L=1/1,M=multipart/alternative | P=p001,L=1/1/1,M=text/html,T=html"
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.debug] (26977-03) Using
ClamAV-clamd: (built-in interface)
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.debug] (26977-03) Using
(ClamAV-clamd) on dir:
CONTSCAN /var/amavis/tmp/amavis-20060324T050603-26977/parts
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.debug] (26977-03)
ClamAV-clamd: Connecting to socket /var/amavis/clamd
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.debug] (26977-03)
ClamAV-clamd: Sending
CONTSCAN /var/amavis/tmp/amavis-20060324T050603-26977/parts\n to UNIX
socket /var/amavis/clamd
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.debug] (26977-03) ask_av
(ClamAV-clamd): /var/amavis/tmp/amavis-20060324T050603-26977/parts CLEAN
Mar 24 06:09:04 grande amavis[26977]: [ID 702911 mail.debug] (26977-03)
ClamAV-clamd result: clean
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03)
spam_scan: score=18.408
tests=[HTML_FONT_BIG=0.256,HTML_MESSAGE=0.001,HTML_TAG_EXIST_TBODY=0.126,INVALID_TZ_EST=0.737,MPART_ALT_DIFF=0.137,MSGID_DOLLARS_RANDOM=3.2,RCVD_HELO_IP_MISMATCH=3.2,RCVD_NUMERIC_HELO=1.253,UNPARSEABLE_RELAY=0.001,UPPERCASE_25_50=0,URIBL_JP_SURBL=3.36,URIBL_OB_SURBL=2.617,X_MESSAGE_INFO=3.52]
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03)
SPAM-KILL, <[EMAIL PROTECTED]> -> <[EMAIL PROTECTED]>,
score=18.408, kill=6.31
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03)
do_notify_and_quarantine: ccat=Spam, (5,0)
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03) local
delivery: <[EMAIL PROTECTED]> -> <spam-quarantine>,
mbx=/var/virusmails/spam-DCNNNbkIQ08m.gz
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03) SPAM,
<[EMAIL PROTECTED]> -> <[EMAIL PROTECTED]>, Yes,
score=18.408 tag=2 tag2=6.31 kill=6.31 tests=[HTML_FONT_BIG=0.256,
HTML_MESSAGE=0.001, HTML_TAG_EXIST_TBODY=0.126, INVALID_TZ_EST=0.737,
MPART_ALT_DIFF=0.137, MSGID_DOLLARS_RANDOM=3.2, RCVD_HELO_IP_MISMATCH=3.2,
RCVD_NUMERIC_HELO=1.253, UNPARSEABLE_RELAY=0.001, UPPERCASE_25_50=0,
URIBL_JP_SURBL=3.36, URIBL_OB_SURBL=2.617, X_MESSAGE_INFO=3.52],
autolearn=spam, quarantine DCNNNbkIQ08m (spam-quarantine)
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03) DSN:
FILTER 550 Spam, spam level 18.408 exceeds cutoff level 10,
<[EMAIL PROTECTED]> -> <[EMAIL PROTECTED]>
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.notice] (26977-03)
Blocked SPAM, [44.25.10.14] <[EMAIL PROTECTED]> ->
<[EMAIL PROTECTED]>, quarantine: spam-DCNNNbkIQ08m.gz, Message-ID:
<[EMAIL PROTECTED]>, mail_id: DCNNNbkIQ08m,
Hits: 18.408, 3556 ms
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03) TIMING
[total 3575 ms] - SMTP LHLO: 10 (0%)0, SMTP pre-MAIL: 2 (0%)0, SMTP
pre-DATA-flush: 17 (0%)1, SMTP DATA: 82 (2%)3, body_digest: 7 (0%)3,
gen_mail_id: 1 (0%)3, mime_decode: 82 (2%)6, get-file-type2: 268 (7%)13,
decompose_part: 5 (0%)13, parts_decode: 0 (0%)13, AV-scan-1: 65 (2%)15,
spam-wb-list: 9 (0%)15, SA msg read: 4 (0%)15, SA parse: 16 (0%)16, SA check:
2888 (81%)97, SA finish: 11 (0%)97, update_cache: 5 (0%)97,
decide_mail_destiny: 5 (0%)97, write-header: 42 (1%)98,
save-to-local-mailbox: 4 (0%)99, prepare-dsn: 5 (0%)99, main_log_entry: 29
(1%)99, update_snmp: 4 (0%)100, unlink-2-files: 12 (0%)100, rundown: 2 (0%)
100
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03-2)
LMTP::10024 /var/amavis/tmp/amavis-20060324T050603-26977: <> ->
<[EMAIL PROTECTED]> SIZE=8201 Received: from ctcministries.org
([127.0.0.1]) by localhost (mail.ctcministries.org [127.0.0.1]) (amavisd-new,
port 10024) with LMTP for <[EMAIL PROTECTED]>; Fri, 24 Mar 2006
06:09:07 -0500 (EST)
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03-2)
Actual message size 9090 B greater than the declared 8201 B
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2) body
hash: 519819b55a448c98c8b128fd234fe097
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03-2)
Checking: ruG6o3X2ZE5G <> -> <[EMAIL PROTECTED]>
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03-2) p005
1 Content-Type: multipart/report
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03-2) p001
1/1 Content-Type: text/plain, size: 453 B, name:
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03-2) p002
1/2 Content-Type: message/delivery-status, size: 291 B, name:
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03-2) p006
1/3 Content-Type: message/rfc822
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03-2) p007
1/3/1 Content-Type: multipart/mixed
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03-2) p008
1/3/1/1 Content-Type: multipart/alternative
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03-2) p003
1/3/1/1/1 Content-Type: text/html, size: 1435 B, name:
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.info] (26977-03-2) p004
1/3/1/2 Content-Type: text/plain, size: 1907 B, name: SpamAssassinReport.txt
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
Checking for banned types and filenames
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
collect banned table[0]: [EMAIL PROTECTED], tables:
DEFAULT=>Amavis::Lookup::RE=ARRAY(0xb0335c)
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
p.path [EMAIL PROTECTED]: "P=p005,L=1,M=multipart/report |
P=p001,L=1/1,M=text/plain,T=asc"
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
p.path [EMAIL PROTECTED]: "P=p005,L=1,M=multipart/report |
P=p002,L=1/2,M=message/delivery-status,T=asc"
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
p.path [EMAIL PROTECTED]: "P=p005,L=1,M=multipart/report |
P=p006,L=1/3,M=message/rfc822 | P=p007,L=1/3/1,M=multipart/mixed |
P=p004,L=1/3/1/2,M=text/plain,T=asc,N=SpamAssassinReport.txt"
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
p.path [EMAIL PROTECTED]: "P=p005,L=1,M=multipart/report |
P=p006,L=1/3,M=message/rfc822 | P=p007,L=1/3/1,M=multipart/mixed |
P=p008,L=1/3/1/1,M=multipart/alternative |
P=p003,L=1/3/1/1/1,M=text/html,T=html"
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
Using ClamAV-clamd: (built-in interface)
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
Using (ClamAV-clamd) on dir:
CONTSCAN /var/amavis/tmp/amavis-20060324T050603-26977/parts
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
ClamAV-clamd: Connecting to socket /var/amavis/clamd
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
ClamAV-clamd: Sending
CONTSCAN /var/amavis/tmp/amavis-20060324T050603-26977/parts\n to UNIX
socket /var/amavis/clamd
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
ask_av (ClamAV-clamd): /var/amavis/tmp/amavis-20060324T050603-26977/parts
CLEAN
Mar 24 06:09:07 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
ClamAV-clamd result: clean
Mar 24 06:09:08 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
spam_scan: score=10.048
tests=[AWL=3.552,HTML_FONT_BIG=0.256,HTML_MESSAGE=0.001,HTML_TAG_EXIST_TBODY=0.126,MPART_ALT_DIFF=0.137,NO_RELAYS=-0.001,UPPERCASE_25_50=0,URIBL_JP_SURBL=3.36,URIBL_OB_SURBL=2.617]
Mar 24 06:09:08 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
SPAM-KILL, <> -> <[EMAIL PROTECTED]>, score=10.048, kill=6.31
Mar 24 06:09:08 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
do_notify_and_quarantine: ccat=Spam, (5,0)
Mar 24 06:09:08 grande amavis[26977]: [ID 702911 mail.error] (26977-03-2) (!!)
TROUBLE in check_mail: quar+notif FAILED: Assert 1 failed in
wrap: /X-Spam-Report: Spam detection software, running on the system
"grande.ctcministries.org", has\n\tidentified this incoming email as possible
spam. The original message\n\thas been attached to this so you can view it
(if it isn't spam) or label\n\tsimilar future email. If you have any
questions, see\n\troot for details. \n\tContent preview: The original
message was received at Fri, 24 Mar 2006\n\t 06:08:58 -0500 (EST) from
gorgeous [192.168.1.51] ----- The following\n\t addresses had permanent fatal
errors -----\n\t <[EMAIL PROTECTED]> (reason: 550 5.7.1
Rejected,\n\t id=26977-03 - SPAM) [...] \n\tContent analysis details:
(10.0 points, 5.0 required) \n\tpts rule name
description\n\t---- ----------------------
--------------------------------------------------\n\t-0.0 NO_RELAYS
Informational: message was not relaye
Mar 24 06:09:08 grande amavis[26977]: [ID 702911 mail.error] (26977-03-2)
(!!) ...TML_TAG_EXIST_TBODY BODY: HTML has "tbody" tag\n\t0.0 HTML_MESSAGE
BODY: HTML included in message\n\t0.3 HTML_FONT_BIG BODY: HTML tag
for a big font size\n\t0.1 MPART_ALT_DIFF BODY: HTML and text parts
are different\n\t3.4 URIBL_JP_SURBL Contains an URL listed in the JP
SURBL blocklist\n\t [URIs: voddo.cn]\n\t2.6
URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist\n\t
[URIs: voddo.cn]\n\t0.0 UPPERCASE_25_50 message body is 25-50%
uppercase/, / / at /usr/local/sbin/amavisd line 2664, <GEN5> line 1090.
Mar 24 06:09:08 grande amavis[26977]: [ID 702911 mail.warning] (26977-03-2)
(!) PRESERVING EVIDENCE in /var/amavis/tmp/amavis-20060324T050603-26977
Mar 24 06:09:08 grande amavis[26977]: [ID 702911 mail.info] (26977-03-2)
TIMING [total 1459 ms] - SMTP pre-DATA-flush: 8 (1%)1, SMTP DATA: 15 (1%)2,
body_digest: 5 (0%)2, gen_mail_id: 1 (0%)2, mime_decode: 134 (9%)11,
get-file-type4: 255 (17%)29, decompose_part: 2 (0%)29, decompose_part: 1 (0%)
29, decompose_part: 5 (0%)29, parts_decode: 0 (0%)29, AV-scan-1: 73 (5%)34,
spam-wb-list: 8 (1%)35, SA msg read: 5 (0%)35, SA parse: 14 (1%)36, SA check:
779 (53%)90, SA finish: 10 (1%)90, update_cache: 5 (0%)91,
decide_mail_destiny: 5 (0%)91, rundown: 132 (9%)100
Mar 24 06:09:08 grande amavis[26977]: [ID 702911 mail.debug] (26977-03-2)
load: 0 %, total idle 3772.148 s, busy 13.598 s
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
AMaViS-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/
