One more information,
From the various testing we have been conducted, mail is tagged with "###### TASPAM ######" when : - Sent in bulk (for exemple 200 mails at a time). - Same mail does not get tagged if sent 4 times with 50 recipients at a time. Our mail passes is checked by two instances of amavis : First one on the local mail server where we are just checking for viruses - It is then passed to our gateway mail server where It is "normally" just sent outside (according to the rules from 'MYNET' policy bank). Mail comming from outside our network are checked (anti virus + anti spam) and then forwarded to our local mail server where they are delivered to the various accounts. From my point of view, this would very much look like a memory problem with amavisd-new on our mail gateway, knowing that there is a lot of mail flowing in and out of these machines (there are two of these). Is there any mechanism of caching involved in the process ? … What do you think ? Le 16 janv. 07 à 21:04, Mark Martinec a écrit : > bsd, > >> This mail is sent from inside our network with a destination >> [EMAIL PROTECTED] // our client says that mail is tagged 2 times >> out of three wether sent from his local computer using Outlook or >> Mutt… > > This message went through two instances of amavisd, > first at host mail1.ensta.fr (alias mail.ensta.fr), > and the next one at host ns1.ensta.fr. > > You are only showing log at host ns1.ensta.fr, which tells > that spam checks were bypassed, message was CC_CLEAN > and recipient [EMAIL PROTECTED] was not local, > which are all reasons why a Subject is not modified. > > This is confirmed by: > >> Jan 15 19:01:27 ns1 amavis[81209]: (81209-10) headers CLUSTERING: NEW >> CLUSTER <[EMAIL PROTECTED]>: score=x, tag=0, tag2=0, local=0, >> bl=, s= > > which means: spam score unknown, no tagging, not local, > not blacklisted, no subject tag. > > > This content filter instance did not modify your Subject, > nor did it insert any X-Spam-* header fields. > > What happened at mail1.ensta.fr you are not showing. > > > Assuming you modified log template as intended, the > , Subject: "test" > also indicates the Subject was not modified by previous > MTA instances or content filters, so you should look > for Subject modification culprit at steps following > processing by amavisd at ns1.ensta.fr. > > Btw, you probably left some extra newline (or removed a trailing #) > in the log template I suggested to modify, which is why you > are only seeing ', Subject: "test"' instead of the usual log entry. > > The log template section was supposed to look like: > > __DATA__ > # > # > ====================================================================== > ======= > # This text section governs how a main per-message amavisd-new log > entry is > # formed (config variable $log_templ). An empty text will prevent a > log entry, > # multi-line text will produce several log entries, one for each > nonempty line. > # Syntax is explained in the README.customize file. > [?%#D|#|Passed # > [? [:ccat_maj] |OTHER|CLEAN|TEMPFAIL|OVERSIZED|BAD-HEADER|SPAMMY| > SPAM|\ > UNCHECKED|BANNED (%F)|INFECTED (%V)]# > #([:ccat_maj],[:ccat_min])# > , [? %p ||%p ][?%a||[?%l||LOCAL ]\[%a\] ][?%e||\[%e\] ]%s -> [%D|,]# > [? %q ||, quarantine: %q]# > [? %Q ||, Queue-ID: %Q]# > [? %m ||, Message-ID: %m]# > [? %r ||, Resent-Message-ID: %r]# > , mail_id: %i# > , Hits: [:SCORE]# > #, size: %z# > #, fwd_to: [:remote_mta]# > [~[:remote_mta_smtp_response]|["^$"]||[", queued_as: "]]\ > [remote_mta_smtp_response|[~%x|["queued as ([0-9A-Z]+)$"]|["%1"]|["% > 0"]]|/]# > [? [:header_field|Subject] ||, Subject: [:dquote|[:header_field| > Subject]]]# > #[? [:header_field|From] ||, From: [:uquote|[:header_field|From]]]# > #[? %#T ||, Tests: \[[%T|,]\]]# > #[? [:AUTOLEARN] ||, autolearn=[:AUTOLEARN]]# > , %y ms# > ] > [?%#O|#|Blocked # > [? [:ccat_maj] |OTHER|CLEAN|TEMPFAIL|OVERSIZED|BAD-HEADER|SPAMMY| > SPAM|\ > UNCHECKED|BANNED (%F)|INFECTED (%V)]# > #([:ccat_maj],[:ccat_min])# > , [? %p ||%p ][?%a||[?%l||LOCAL ]\[%a\] ][?%e||\[%e\] ]%s -> [%O|,]# > [? %q ||, quarantine: %q]# > [? %Q ||, Queue-ID: %Q]# > [? %m ||, Message-ID: %m]# > [? %r ||, Resent-Message-ID: %r]# > , mail_id: %i# > , Hits: [:SCORE]# > #, size: %z# > #, smtp_resp: [:smtp_response]# > [? [:header_field|Subject] ||, Subject: [:dquote|[:header_field| > Subject]]]# > #[? [:header_field|From] ||, From: [:uquote|[:header_field|From]]]# > #[? %#T ||, Tests: \[[%T|,]\]]# > #[? [:AUTOLEARN] ||, autolearn=[:AUTOLEARN]]# > , %y ms# > ] > > > > Note the two cases of: > > [? [:header_field|Subject] ||, Subject: [:dquote|[:header_field| > Subject]]]# > > (without an initial #, and with a trailing # kept, which suppresses > breaking > a log entry into several log entries). > > Mark > ________________________________________________ «?»¥«?»§«?»¥«?»§«?»¥«?»§«?»¥«?»§«?»¥«?»§«?»¥«?»§ ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ Gregober ---> PGP ID --> 0x1BA3C2FD bsd @at@ todoo.biz ________________________________________________ «?»¥«?»§«?»¥«?»§«?»¥«?»§«?»¥«?»§«?»¥«?»§«?»¥«?»§ ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ P "Please consider your environmental responsibility before printing this e-mail" ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
