> I'm eagerly awaiting the results of your research :)
Well, I wish I had better news, but the problem (they'd call it a
feature, and for once I think I'd agree) is that MS SMTP "normalizes"
the envelope fields as part of of normal message flow. Thus, even
though the IIS and ORF logs will show extra spaces, they're the only
place where the actual protocol commands are preserved. ORF doesn't do
anything special to change this data; it just automatically changes
after the message is submitted, and subsequent message inspection
during MS SMTP transport will not show any of the original formatting
errors.
The only way you could retain the protocol-level data is by plugging
in another protocol event sink alongside ORF, but running more than
one custom PES on the same system is pretty un-heard-of (I believe
it's possible using different priorities, but I've never seen it in
practice). So you are pretty much stuck with (a) giving up, or (b)
trying the log inspection option. I really wouldn't trust the latter,
since you might actually have to throttle _down_ processing to make
sure that the logs can be parsed in time to intercept the
message...not good.
Sorry I don't have a fix.
--Sandy
------------------------------------
Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]
SpamAssassin plugs into Declude!
http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
