Eric Shubert wrote:
> I don't see any highlighting.
> Please post to the list. There are many more eyes there. :)
>
> Maxwell Smart wrote:
>> Eric,
>>
>> OK, I have been watching the log with tail -f
>> /var/log/qmail/smtp/current I don't see anything out of the
>> ordinary. Look at the times with the highlighted entry below.
>> Between the simscan
>> and CHKUSER is 6 minutes. I may have restarted my toaster to check mail
>> so it may not be relevant, but may indicate that the problem is in the
>> simscan.
>>
>> Here is a clip of entries with my e mail address.
>>
>> 09-24 14:03:10 CHKUSER accepted rcpt: from <jimmierowe...@estranet.it::>
>> remote <hbympm1:unknown:80.37.56.214> rcpt <c...@yother.com> : found
>> existing recipient
>> 09-24 14:03:10 policy_check: remote jimmierowe...@estranet.it -> local
>> c...@yother.com (UNAUTHENTICATED SENDER)
>> 09-24 14:03:12 simscan:[18048]:CLEAN (4.70/12.00):0.9696s:VicodinES
>> available online
>> today!:80.37.56.214:jimmierowe...@estranet.it:c...@yother.com
>> 09-24 14:14:29 CHKUSER accepted rcpt: from
>> <oss...@laetitia.area510.net::> remote
>> <notify.ossec.net:unknown:192.168.0.2> rcpt <c...@yother.com> : found
>> existing recipient
>> 09-24 14:14:29 policy_check: local oss...@laetitia.area510.net -> local
>> c...@yother.com (UNAUTHENTICATED SENDER)
>> 09-24 14:14:29 simscan:[2708]:CLEAN (-4.40/12.00):0.7645s:OSSEC
>> Notification - laetitia - Alert level
>> 3:192.168.0.2:oss...@laetitia.area510.net:c...@yother.com
>> 09-24 14:18:30 CHKUSER accepted sender: from
>> <c...@yother.com:c...@yother.com:> remote
>> <[192.168.0.86]:unknown:192.168.0.2> rcpt <> : sender accepted
>> 09-24 14:18:30 CHKUSER accepted rcpt: from
>> <c...@yother.com:c...@yother.com:> remote
>> <[192.168.0.86]:unknown:192.168.0.2> rcpt <c...@yother.com> : found
>> existing recipient
>> 09-24 14:18:30 policy_check: local c...@yother.com -> local c...@yother.com
>> (AUTHENTICATED SENDER)
>> 09-24 14:18:30
>> simscan:[2933]:RELAYCLIENT:0.0315s:-:192.168.0.2:c...@yother.com:c...@yother.com
>>
>> 09-24 14:18:43 CHKUSER accepted rcpt: from
>> <qmailtoaster-list-return-3294-cj=yother....@qmailtoaster.com::> remote
>> <mail.qmailtoaster.com:unknown:216.81.238.95> rcpt <c...@yother.com> :
>> found existing recipient
>> 09-24 14:18:43 policy_check: remote
>> qmailtoaster-list-return-3294-cj=yother....@qmailtoaster.com -> local
>> c...@yother.com (UNAUTHENTICATED SENDER)
>> 09-24 14:18:51 simscan:[2950]:CLEAN (-1.60/12.00):7.7640s:Re_
>> [qmailtoaster] Problems emailing large number of
>> recipients:216.81.238.95:qmailtoaster-list-return-3294-cj=yother....@qmailtoaster.com:c...@yother.com
>>
>> 09-24 14:25:04 CHKUSER accepted sender: from
>> <c...@yother.com:c...@yother.com:> remote
>> <[192.168.0.86]:unknown:192.168.0.2> rcpt <> : sender accepted
>> 09-24 14:25:04 CHKUSER relaying rcpt: from
>> <c...@yother.com:c...@yother.com:> remote
>> <[192.168.0.86]:unknown:192.168.0.2> rcpt <e...@shubes.net> : client
>> allowed to relay
>> 09-24 14:25:04 policy_check: local c...@yother.com -> remote
>> e...@shubes.net (AUTHENTICATED SENDER)
>> 09-24 14:25:13
>> simscan:[3243]:RELAYCLIENT:8.4547s:-:192.168.0.2:c...@yother.com:e...@shubes.net
>>
>> 09-24 14:31:46 CHKUSER accepted rcpt: from <e...@shubes.net::> remote
>> <mho-02-ewr.mailhop.org:unknown:204.13.248.72> rcpt <c...@yother.com> :
>> found existing recipient
>> 09-24 14:31:46 policy_check: remote e...@shubes.net -> local
>> c...@yother.com (UNAUTHENTICATED SENDER)
>> 09-24 14:31:47 simscan:[4066]:CLEAN (0.10/12.00):0.8290s:Re_ Area510.net
>> _ e mail delay:204.13.248.72:e...@shubes.net:c...@yother.com
>> 09-24 14:38:48 CHKUSER accepted rcpt: from
>> <jennygreen...@gjensidigenor.no::> remote
>> <h9g3l91:unknown:95.133.78.202> rcpt <c...@yother.com> : found existing
>> recipient
>> 09-24 14:38:48 policy_check: remote jennygreen...@gjensidigenor.no ->
>> local c...@yother.com (UNAUTHENTICATED SENDER)
>> 09-24 14:38:52 simscan:[4776]:CLEAN (5.50/12.00):2.4199s:***SPAM***
>> Great Rxmedications are at your
>> fingertips:95.133.78.202:jennygreen...@gjensidigenor.no:c...@yother.com
>> 09-24 14:40:36 CHKUSER accepted rcpt: from
>> <annabellecampo...@imac.edu.mx::> remote <la1ldu3:unknown:84.61.8.95>
>> rcpt <c...@yother.com> : found existing recipient
>> 09-24 14:40:36 policy_check: remote annabellecampo...@imac.edu.mx ->
>> local c...@yother.com (UNAUTHENTICATED SENDER)
>> 09-24 14:40:39 simscan:[5072]:SPAM REJECT
>> (14.40/12.00):1.8574s:***SPAM*** Do you need to
>> lose_s0me_weight?:84.61.8.95:annabellecampo...@imac.edu.mx:c...@yother.com
>> 09-24 14:40:39 qmail-smtpd: qq hard reject (Your email is considered
>> spam (14.40 spam-hits)): MAILFROM:<annabellecampo...@imac.edu.mx>
>> RCPTTO:c...@yother.com
>> 09-24 14:44:15 CHKUSER accepted rcpt: from <demell...@gmail.com::>
>> remote <mail-fx0-f206.google.com:unknown:209.85.220.206> rcpt
>> <c...@yother.com> : found existing recipient
>> 09-24 14:44:15 policy_check: remote demell...@gmail.com -> local
>> c...@yother.com (UNAUTHENTICATED SENDER)
>> 09-24 14:44:16 simscan:[5181]:CLEAN (-0.10/12.00):0.8569s:Re_ 2000 v70r
>> downpipe:209.85.220.206:demell...@gmail.com:c...@yother.com
>>
>>
>> Eric Shubert wrote:
>>> That directory contains all of your smtp logs.
>>> To view the most recent log:
>>> # qmlog smtp
>>>
>>> To tail the log:
>>> # qmlog -f smtp
>>>
>>> # qmlog
>>> by itself will show you all of the options.
>>>
>>> Maxwell Smart wrote:
>>>> Eric,
>>>>
>>>> I am not sure what log you're talking about /var/log/qmail/smtp/
>>>> contents?? Not sure what I'm looking for.
>>>>
>>>> CJ
>>>>
>>>> Eric Shubert wrote:
>>>>> Have you checked the smtp log on the destination end?
>>>>>
>>>>> Maxwell Smart wrote:
>>>>>> Eric,
>>>>>>
>>>>>> Jake emailed me off list. I do stay on the list to help others.
>>>>>> The
>>>>>> only thing is I am not running Spamdyke. Other ideas?
>>>>>>
>>>>>> CJ
>>>>>>
>>>>>> Eric Shubert wrote:
>>>>>>> Hey Max.
>>>>>>>
>>>>>>> I'm guessing you're seeing graylisting delays. That would
>>>>>>> explain why
>>>>>>> they go through on restarts.
>>>>>>>
>>>>>>> On the destination side, you should see graylisted messages in the
>>>>>>> smtp log.
>>>>>>>
>>>>>>> You can do various configuration setting changes in spamdyke to
>>>>>>> control graylisting. See
>>>>>>> http://www.spamdyke.org/documentation/README.html#GRAYLISTS
>>>>>>>
>>>>>>> Oh, and Max, please try to say on the list as much as possible. It
>>>>>>> helps unknown others that way. ;)
>>>>>>>
>>>
>
>
