[qmailtoaster] Re: Spamdyke install problem
The spamdyke test takes quite a while if you have a large graylist tree, which you would have if you're running an older version that didn't install the qtp-prune-graylist script for you. There's not a whole lot of space used in the graylist tree, but there can be huge numbers of inodes accumulated over time. I would: # yum update qmailtoaster-plus.repo # yum update qmailtoaster-plus # qtp-prune-graylist (this will take quite a while, perhaps a couple hours - just let it run) # qtp-install-spamdyke -- -Eric 'shubes' On 04/20/2011 06:56 PM, Jeremy Towne wrote: Here is the qtp-whatami qtp-whatami v0.3.7 Wed Apr 20 21:35:28 EDT 2011 DISTRO=CentOS OSVER=4.9 QTARCH=i686 QTKERN=2.6.9-34.EL BUILD_DIST=cnt40 BUILD_DIR=/usr/src/redhat This machine's OS is supported and has been tested I have stopped the install because I am shelled in with my laptop and have to goto work. I have tried a reboot and install even with qmail stopped but still is stuck the next day. The problem seems to be only server 1. The other completed this time tonight. Jeremy On 4/20/2011 9:26 PM, Scott Hughes wrote: Jeremy, Please run qtp-whatami and post the output. Also, how does the install end? Does it lock up? Does it end with a message of some type? I assume you have rebooted and then tried to install it again? Thanks, Scott On Apr 20, 2011, at 8:01 PM, Jeremy Towne wrote: I have been trying to install spamdyke after the last update for a while now with no success. Below is how far I get with 2 different servers. Server 1 strip spamdyke qtp-install-spamdyke v0.3.3 - installing spamdyke-4.2.0 ... qtp-install-spamdyke v0.3.3 - running spamdyke config test ... Server 2 strip spamdyke qtp-install-spamdyke v0.3.3 - installing spamdyke-4.2.0 ... qtp-install-spamdyke v0.3.3 - running spamdyke config test ... spamdyke 4.2.0+TLS+CONFIGTEST+DEBUG (C)2011 Sam Clippinger, samc (at) silence (dot) org http://www.spamdyke.org/ Use -h for an option summary or see README.html for complete option details. SUCCESS: Running tests as user vpopmail(89), group vchkpw(89). SUCCESS: /var/qmail/bin/qmail-smtpd appears to offer TLS support but spamdyke will intercept and decrypt the TLS traffic so all of its filters can operate. SUCCESS: /var/qmail/bin/qmail-smtpd appears to offer SMTP AUTH support. spamdyke will observe any authentication and trust its response. SUCCESS(config-file): Opened for reading: /etc/spamdyke/spamdyke.conf SUCCESS(dns-resolv-conf): Opened for reading: /etc/resolv.conf Jeremy - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] Re: SIMSCAN / Spamassassin
On 04/20/2011 02:51 PM, Scott Hughes wrote: I have noticed on some emails that when SIMSCAN refers the email to Spamassassin, the domain name gets changed, like so (from the Spamassassin log): > 2011-04-20 13:55:32.757156500 Apr 20 13:55:32.751 [17877] info: spamd: > result: . 3 - > HTML_MESSAGE,MIME_QP_LONG_LINE,RCVD_NUMERIC_HELO,RDNS_NONE,SARE_GIF_AT > TACH,T> _FILL_THIS_FORM_SHORT > scantime=6.0,size=11089,user=clamav,uid=89,required_score=3.7,rhost=lo calhost.localdomain,raddr=127.0.0.1,rport=34733,mid=<006301cbff8c$49186170$db492450$@com>,autolearn=no The domain name (in red) was supposed to be ‘ncm20.com’. I have not yet seen any other changed, but I’ll keep looking. Where this causes a problem is if you have a whitelist_from entry set up in your local.cf. Since it doesn’t match that whitelist entry, it doesn’t get whitelisted. Scott I haven't had a chance to look in any depth in my logs, but I suspect it's a problem with simscan. Have you rebuilt/reinstalled simscan since you last updated clamav or spamassassin? I'd give that a try first thing. -- -Eric 'shubes' - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
Re: [qmailtoaster] Spamdyke install problem
Here is the qtp-whatami qtp-whatami v0.3.7 Wed Apr 20 21:35:28 EDT 2011 DISTRO=CentOS OSVER=4.9 QTARCH=i686 QTKERN=2.6.9-34.EL BUILD_DIST=cnt40 BUILD_DIR=/usr/src/redhat This machine's OS is supported and has been tested I have stopped the install because I am shelled in with my laptop and have to goto work. I have tried a reboot and install even with qmail stopped but still is stuck the next day. The problem seems to be only server 1. The other completed this time tonight. Jeremy On 4/20/2011 9:26 PM, Scott Hughes wrote: Jeremy, Please run qtp-whatami and post the output. Also, how does the install end? Does it lock up? Does it end with a message of some type? I assume you have rebooted and then tried to install it again? Thanks, Scott On Apr 20, 2011, at 8:01 PM, Jeremy Towne wrote: I have been trying to install spamdyke after the last update for a while now with no success. Below is how far I get with 2 different servers. Server 1 strip spamdyke qtp-install-spamdyke v0.3.3 - installing spamdyke-4.2.0 ... qtp-install-spamdyke v0.3.3 - running spamdyke config test ... Server 2 strip spamdyke qtp-install-spamdyke v0.3.3 - installing spamdyke-4.2.0 ... qtp-install-spamdyke v0.3.3 - running spamdyke config test ... spamdyke 4.2.0+TLS+CONFIGTEST+DEBUG (C)2011 Sam Clippinger, samc (at) silence (dot) org http://www.spamdyke.org/ Use -h for an option summary or see README.html for complete option details. SUCCESS: Running tests as user vpopmail(89), group vchkpw(89). SUCCESS: /var/qmail/bin/qmail-smtpd appears to offer TLS support but spamdyke will intercept and decrypt the TLS traffic so all of its filters can operate. SUCCESS: /var/qmail/bin/qmail-smtpd appears to offer SMTP AUTH support. spamdyke will observe any authentication and trust its response. SUCCESS(config-file): Opened for reading: /etc/spamdyke/spamdyke.conf SUCCESS(dns-resolv-conf): Opened for reading: /etc/resolv.conf Jeremy - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
Re: [qmailtoaster] Spamdyke install problem
Jeremy, Please run qtp-whatami and post the output. Also, how does the install end? Does it lock up? Does it end with a message of some type? I assume you have rebooted and then tried to install it again? Thanks, Scott On Apr 20, 2011, at 8:01 PM, Jeremy Towne wrote: > I have been trying to install spamdyke after the last update for a while now > with no success. Below is how far I get with 2 different servers. > > Server 1 > strip spamdyke > qtp-install-spamdyke v0.3.3 - installing spamdyke-4.2.0 ... > > qtp-install-spamdyke v0.3.3 - running spamdyke config test ... > > > > Server 2 > strip spamdyke > qtp-install-spamdyke v0.3.3 - installing spamdyke-4.2.0 ... > > qtp-install-spamdyke v0.3.3 - running spamdyke config test ... > > spamdyke 4.2.0+TLS+CONFIGTEST+DEBUG (C)2011 Sam Clippinger, samc (at) silence > (dot) org > http://www.spamdyke.org/ > > Use -h for an option summary or see README.html for complete option details. > > SUCCESS: Running tests as user vpopmail(89), group vchkpw(89). > SUCCESS: /var/qmail/bin/qmail-smtpd appears to offer TLS support but spamdyke > will intercept and decrypt the TLS traffic so all of its filters can operate. > SUCCESS: /var/qmail/bin/qmail-smtpd appears to offer SMTP AUTH support. > spamdyke will observe any authentication and trust its response. > SUCCESS(config-file): Opened for reading: /etc/spamdyke/spamdyke.conf > SUCCESS(dns-resolv-conf): Opened for reading: /etc/resolv.conf > > > Jeremy > > - > Qmailtoaster is sponsored by Vickers Consulting Group > (www.vickersconsulting.com) > Vickers Consulting Group offers Qmailtoaster support and installations. > If you need professional help with your setup, contact them today! > - >Please visit qmailtoaster.com for the latest news, updates, and packages. > To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com >For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com > > - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] Spamdyke install problem
I have been trying to install spamdyke after the last update for a while now with no success. Below is how far I get with 2 different servers. Server 1 strip spamdyke qtp-install-spamdyke v0.3.3 - installing spamdyke-4.2.0 ... qtp-install-spamdyke v0.3.3 - running spamdyke config test ... Server 2 strip spamdyke qtp-install-spamdyke v0.3.3 - installing spamdyke-4.2.0 ... qtp-install-spamdyke v0.3.3 - running spamdyke config test ... spamdyke 4.2.0+TLS+CONFIGTEST+DEBUG (C)2011 Sam Clippinger, samc (at) silence (dot) org http://www.spamdyke.org/ Use -h for an option summary or see README.html for complete option details. SUCCESS: Running tests as user vpopmail(89), group vchkpw(89). SUCCESS: /var/qmail/bin/qmail-smtpd appears to offer TLS support but spamdyke will intercept and decrypt the TLS traffic so all of its filters can operate. SUCCESS: /var/qmail/bin/qmail-smtpd appears to offer SMTP AUTH support. spamdyke will observe any authentication and trust its response. SUCCESS(config-file): Opened for reading: /etc/spamdyke/spamdyke.conf SUCCESS(dns-resolv-conf): Opened for reading: /etc/resolv.conf Jeremy - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] SIMSCAN / Spamassassin
I have noticed on some emails that when SIMSCAN refers the email to Spamassassin, the domain name gets changed, like so (from the Spamassassin log): > 2011-04-20 13:55:32.757156500 Apr 20 13:55:32.751 [17877] info: spamd: > result: . 3 - > HTML_MESSAGE,MIME_QP_LONG_LINE,RCVD_NUMERIC_HELO,RDNS_NONE,SARE_GIF_AT > TACH,T> _FILL_THIS_FORM_SHORT > scantime=6.0,size=11089,user=clamav,uid=89,required_score=3.7,rhost=lo calhost.localdomain,raddr=127.0.0.1,rport=34733,mid=<006301cbff8c$49186170$d b492450$@com>,autolearn=no The domain name (in red) was supposed to be 'ncm20.com'. I have not yet seen any other changed, but I'll keep looking. Where this causes a problem is if you have a whitelist_from entry set up in your local.cf. Since it doesn't match that whitelist entry, it doesn't get whitelisted. Scott
[qmailtoaster] Re: Spamdyke Question
On 04/20/2011 12:17 PM, Scott Hughes wrote: Okay - Here is an example (both SPAMD and SMTP) of what I see happening: SMTP 04-20 13:55:20 tcpserver: pid 14037 from 216.157.241.48 04-20 13:55:20 tcpserver: ok 14037 mail.renshawauto.net:66.255.244.196:25 :216.157.241.48::3 04-20 13:55:20 tcpserver: status: 2/100 04-20 13:55:20 tcpserver: pid 14039 from 216.157.241.10 04-20 13:55:20 tcpserver: ok 14039 mail.renshawauto.net:66.255.244.196:25 :216.157.241.10::41138 04-20 13:55:20 CHKUSER accepted rcpt: from remote rcpt : found existing recipient 04-20 13:55:20 policy_check: remote bounce-339204-130...@listserv.ncm20.com -> local us...@renshawauto.com (UNAUTHENTICATED SENDER) 04-20 13:55:20 policy_check: policy allows transmission 04-20 13:55:20 spamdyke[14037]: ALLOWED from: bounce-339204-130...@listserv.ncm20.com to: us...@renshawauto.com origin_ip: 216.157.241.48 o rigin_rdns: lomwsm01.mwlo.mailwatch.com auth: (unknown) 04-20 13:55:21 tcpserver: status: 3/100 04-20 13:55:21 tcpserver: pid 14047 from 216.157.241.150 04-20 13:55:21 tcpserver: ok 14047 mail.renshawauto.net:66.255.244.196:25 :216.157.241.150::42952 04-20 13:55:25 tcpserver: status: 4/100 04-20 13:55:25 tcpserver: pid 14053 from 216.157.241.82 04-20 13:55:25 tcpserver: ok 14053 mail.renshawauto.net:66.255.244.196:25 :216.157.241.82::57621 04-20 13:55:26 CHKUSER accepted rcpt: from remote rcpt : found existing recipient 04-20 13:55:26 policy_check: remote bounce-339204-136...@listserv.ncm20.com -> local us...@patriotchevy.com (UNAUTHENTICATED SENDER) 04-20 13:55:26 policy_check: policy allows transmission 04-20 13:55:26 spamdyke[14039]: ALLOWED from: bounce-339204-136...@listserv.ncm20.com to: us...@patriotchevy.com origin_ip: 216.157.241.10 origin_rdns: lomwsm04.mwlo.mailwatch.com auth: (unknown) 04-20 13:55:27 simscan:[14038]:CLEAN (3.60/8.00):6.1239s::216.157.241.48:bounce-339204-130...@listserv.ncm20.com: us...@renshawauto.com 04-20 13:55:27 tcpserver: end 14037 status 0 04-20 13:55:27 tcpserver: status: 3/100 04-20 13:55:27 CHKUSER accepted rcpt: from remote rcpt : found existing recipient 04-20 13:55:27 policy_check: remote bounce-339204-130...@listserv.ncm20.com -> local us...@royaloakschevy.com (UNAUTHENTICATED SENDER) 04-20 13:55:27 policy_check: policy allows transmission 04-20 13:55:27 spamdyke[14047]: ALLOWED from: bounce-339204-130...@listserv.ncm20.com to: us...@royaloakschevy.com origin_ip: 216.157.241.150 origin_rdns: lomwsm38.mwlo.mailwatch.com auth: (unknown) 04-20 13:55:30 CHKUSER accepted rcpt: from remote rcpt : found existing recipient 04-20 13:55:30 policy_check: remote bounce-339204-130...@listserv.ncm20.com -> local us...@renshawauto.com (UNAUTHENTICATED SENDER) 04-20 13:55:30 policy_check: policy allows transmission 04-20 13:55:30 spamdyke[14053]: ALLOWED from: bounce-339204-130...@listserv.ncm20.com to: us...@renshawauto.com origin_ip: 216.157.241.82 origin_rdns: lomwsm03.mwlo.mailwatch.com auth: (unknown) 04-20 13:55:31 tcpserver: status: 4/100 04-20 13:55:31 tcpserver: pid 14109 from 188.158.89.123 04-20 13:55:31 tcpserver: ok 14109 mail.renshawauto.net:66.255.244.196:25 :188.158.89.123::2385 04-20 13:55:32 spamdyke[14109]: DENIED_RDNS_MISSING from: info51...@ups.com to: cdeplet...@deborahrenshaw.com origin_ip: 188.158.89.123 origin_rdns: (unknown) auth: (unknown) 04-20 13:55:32 simscan:[14056]:CLEAN (3.60/8.00):6.2346s::216.157.241.10:bounce-339204-136...@listserv.ncm20.com: us...@patriotchevy.com 04-20 13:55:32 tcpserver: end 14039 status 0 04-20 13:55:32 tcpserver: status: 3/100 04-20 13:55:33 tcpserver: end 14109 status 0 04-20 13:55:33 tcpserver: status: 2/100 04-20 13:55:33 simscan:[14063]:CLEAN (3.60/8.00):6.2664s::216.157.241.150:bounce-339204-130...@listserv.ncm20.com :us...@royaloakschevy.com 04-20 13:55:33 tcpserver: end 14047 status 0 04-20 13:55:33 tcpserver: status: 1/100 04-20 13:55:37 tcpserver: status: 2/100 04-20 13:55:37 tcpserver: pid 14169 from 173.208.175.49 04-20 13:55:37 tcpserver: ok 14169 mail.renshawauto.net:66.255.244.196:25 :173.208.175.49::35844 04-20 13:55:37 spamdyke[14169]: DENIED_RDNS_MISSING from: ni...@unerpage.info to: us...@renshawauto.com origin_ip: 173.208.175.49 origin_rdns: (unknown) auth: (unknown) 04-20 13:55:38 tcpserver: end 14169 status 0 04-20 13:55:38 tcpserver: status: 1/100 04-20 13:55:38 simscan:[14102]:CLEAN (3.60/8.00):8.1598s::216.157.241.82:bounce-339204-130...@listserv.ncm20.com: us...@renshawauto.com 04-20 13:55:39 tcpserver: end 14053 status 0 SPAM 2011-04-20 13:55:32.757153500 Apr 20 13:55:32.751 [17877] info: spamd: clean message (3.6/3.7) for clamav:89 in 6.0 seconds, 11089 bytes. 2011-04-20 13:55:32.757156500 Apr 20 13:55:32.751 [17877] info: spamd: result: . 3 - HTML_MESSAGE,MIME_QP_LONG_LINE,RCVD_NUMERIC_HELO,RDNS_NONE,SARE_GIF_ATTACH,T _FILL_THIS_FORM_SHORT scantime=6.0,size=11089,user=clamav,uid=89,required_score=3.7,rhost=localhos t.localdomain,raddr=127.0.0.1,rport=34733,mid=<006301cbff8c$49186170$db49245 0$@com>,
RE: [qmailtoaster] Re: Spamdyke Question
-Original Message- From: Eric Shubert [mailto:e...@shubes.net] Sent: Wednesday, April 20, 2011 1:24 PM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] Re: Spamdyke Question On 04/20/2011 11:16 AM, Scott Hughes wrote: > -Original Message- > From: Eric Shubert [mailto:e...@shubes.net] > Sent: Wednesday, April 20, 2011 12:01 PM > To: qmailtoaster-list@qmailtoaster.com > Subject: [qmailtoaster] Re: Spamdyke Question > > On 04/20/2011 08:45 AM, Scott Hughes wrote: >> -Original Message- >> From: Eric Shubert [mailto:e...@shubes.net] >> Sent: Wednesday, April 20, 2011 8:46 AM >> To: qmailtoaster-list@qmailtoaster.com >> Subject: [qmailtoaster] Re: Spamdyke Question >> >> On 04/20/2011 04:21 AM, Scott Hughes wrote: >>> On Apr 20, 2011, at 12:07 AM, Eric Shubertwrote: >>> On 04/19/2011 06:20 PM, Scott Hughes wrote: > On 4/19/11 6:17 PM, Eric Shubert wrote: >> They're the same value in a QMT I just checked. >> >> Please post the log lines you're talking about (using qmlog formatting >> if you don't mind). >> > > I will post an example of an exact match as soon as I see the next one > come through (should be tomorrow). Here is an example of what I am > talking about in the mean-time: > > SMTP: > > 04-19 15:03:46 simscan:[19032]:CLEAN (2.10/8.00):5.7230s:Re_ > >> > #3:216.157.241.82:bounce-339075-137...@listserv.ncm20.com:joey@renshawauto.c >> om > > > SPAMD: > > 2011-04-19 08:57:11.159507500 Apr 19 08:57:11.159 [6740] info: spamd: > result: . -98 - HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST > >> > scantime=6.0,size=4024,user=clamav,uid=89,required_score=3.5,rhost=localhost >> > .localdomain,raddr=127.0.0.1,rport=50816,mid=> m20.com>,autolearn=no > > > I had to use another method of pulling the SPAMD log. The qmlog kept > telling me there were no logs with 'ncm20' in them, but I knew there > was. I used the -g and then the -lm switches on qmlog. Just for > everyones knowledge, if you pipe a grep command through 'tai64nlocal' > it > will give you normal time and dates. Such as: "grep ncm20.com > /var/log/qmail/spamd/@40004dadbc3029c1626c.s | tai64nlocal". > > As you see above, the SMTP log shows a score of 2.10 and the SPAMD log > shows a score of .-98 > > Thanks, > Scott > > > >> > >> - What you're seeing in the spamd log is not the score. I'm not sure what >> the -98 is. The score is listed on the previous line, in parenthesis, like >> such: (score/threshold), which follows either "clean message" or > "identified >> spam" text, depending on if the score is greater than the threshold or > not. -- -Eric 'shubes' >>> Eric, >>> >>> The .98 is the message score after it is run through Spaamssassin. The >> fact that it has a matching whitelist entry sets the score at -99. Then > the >> scrore is adjusted upwards as it hits more rules for a final score of -98. >>> >>> So again I don't understand why the two scores are different. >>> >>> Scott >>> >>> >> > >> - >> >> Can you post *all* of the spamd log messages for a given email please? >> > > Common, Scott. Give me a break. This is the output from a grep, which > will not necessarily show what I'm looking for. > > I said all messages *for a given email*. Find one, or two. And please > use qmlog to format a little nicer. > > Thanks. > I think I have figured out what you are asking for. How is this: > > 04-20 13:08:16 Apr 20 13:08:16.105 [32297] info: prefork: child states: II > 04-20 13:09:12 Apr 20 13:09:12.244 [17877] info: spamd: connection from > localhost.localdomain [127.0.0.1] at port 41862 > 04-20 13:09:12 Apr 20 13:09:12.251 [17877] info: spamd: processing message > for clamav:89 > 04-20 13:09:12 Apr 20 13:09:12.984 [17877] info: spamd: clean message > (-98.6/3.7) for clamav:89 in 0.7 seconds, 4021 bytes. > 04-20 13:09:12 Apr 20 13:09:12.984 [17877] info: spamd: result: . -98 - > AWL,HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST scantime=0.7,size=4021 > ,user=clamav,uid=89,required_score=3.7,rhost=localhost.localdomain,raddr=127 > .0.0.1,rport=41862,mid=, > autolearn=no > 04-20 13:09:13 Apr 20 13:09:13.182 [32297] info: prefork: child states: II > 04-20 13:09:13 Apr 20 13:09:13.600 [17877] info: spamd: connection from > localhost.localdomain [127.0.0.1] at port 41865 > 04-20 13:09:13 Apr 20 13:09:13.607 [17877] info: spamd: processing message > for clamav:89 > 04-20 13:09:14 Apr 20 13:09:14.298 [17877] info: spamd: clean message > (-98.7/3.7) for clamav:89 in 0.7 seconds, 4014 bytes. > 04-20 13:09:14 Apr 20 13:09:14.299 [17877] info: spamd: result: . -98 - > AWL,HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST scantime=0.7,size=4014 > ,user=clamav,uid=89,required_score=3.7,rhost=lo
RE: [qmailtoaster] Re: Spamdyke Question
-Original Message- From: Eric Shubert [mailto:e...@shubes.net] Sent: Wednesday, April 20, 2011 1:24 PM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] Re: Spamdyke Question On 04/20/2011 11:16 AM, Scott Hughes wrote: > -Original Message- > From: Eric Shubert [mailto:e...@shubes.net] > Sent: Wednesday, April 20, 2011 12:01 PM > To: qmailtoaster-list@qmailtoaster.com > Subject: [qmailtoaster] Re: Spamdyke Question > > On 04/20/2011 08:45 AM, Scott Hughes wrote: >> -Original Message- >> From: Eric Shubert [mailto:e...@shubes.net] >> Sent: Wednesday, April 20, 2011 8:46 AM >> To: qmailtoaster-list@qmailtoaster.com >> Subject: [qmailtoaster] Re: Spamdyke Question >> >> On 04/20/2011 04:21 AM, Scott Hughes wrote: >>> On Apr 20, 2011, at 12:07 AM, Eric Shubertwrote: >>> On 04/19/2011 06:20 PM, Scott Hughes wrote: > On 4/19/11 6:17 PM, Eric Shubert wrote: >> They're the same value in a QMT I just checked. >> >> Please post the log lines you're talking about (using qmlog formatting >> if you don't mind). >> > > I will post an example of an exact match as soon as I see the next one > come through (should be tomorrow). Here is an example of what I am > talking about in the mean-time: > > SMTP: > > 04-19 15:03:46 simscan:[19032]:CLEAN (2.10/8.00):5.7230s:Re_ > >> > #3:216.157.241.82:bounce-339075-137...@listserv.ncm20.com:joey@renshawauto.c >> om > > > SPAMD: > > 2011-04-19 08:57:11.159507500 Apr 19 08:57:11.159 [6740] info: spamd: > result: . -98 - HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST > >> > scantime=6.0,size=4024,user=clamav,uid=89,required_score=3.5,rhost=localhost >> > .localdomain,raddr=127.0.0.1,rport=50816,mid=> m20.com>,autolearn=no > > > I had to use another method of pulling the SPAMD log. The qmlog kept > telling me there were no logs with 'ncm20' in them, but I knew there > was. I used the -g and then the -lm switches on qmlog. Just for > everyones knowledge, if you pipe a grep command through 'tai64nlocal' > it > will give you normal time and dates. Such as: "grep ncm20.com > /var/log/qmail/spamd/@40004dadbc3029c1626c.s | tai64nlocal". > > As you see above, the SMTP log shows a score of 2.10 and the SPAMD log > shows a score of .-98 > > Thanks, > Scott > > > >> > >> - What you're seeing in the spamd log is not the score. I'm not sure what >> the -98 is. The score is listed on the previous line, in parenthesis, like >> such: (score/threshold), which follows either "clean message" or > "identified >> spam" text, depending on if the score is greater than the threshold or > not. -- -Eric 'shubes' >>> Eric, >>> >>> The .98 is the message score after it is run through Spaamssassin. The >> fact that it has a matching whitelist entry sets the score at -99. Then > the >> scrore is adjusted upwards as it hits more rules for a final score of -98. >>> >>> So again I don't understand why the two scores are different. >>> >>> Scott >>> >>> >> > >> - >> >> Can you post *all* of the spamd log messages for a given email please? >> > > Common, Scott. Give me a break. This is the output from a grep, which > will not necessarily show what I'm looking for. > > I said all messages *for a given email*. Find one, or two. And please > use qmlog to format a little nicer. > > Thanks. > I think I have figured out what you are asking for. How is this: > > 04-20 13:08:16 Apr 20 13:08:16.105 [32297] info: prefork: child states: II > 04-20 13:09:12 Apr 20 13:09:12.244 [17877] info: spamd: connection from > localhost.localdomain [127.0.0.1] at port 41862 > 04-20 13:09:12 Apr 20 13:09:12.251 [17877] info: spamd: processing message > for clamav:89 > 04-20 13:09:12 Apr 20 13:09:12.984 [17877] info: spamd: clean message > (-98.6/3.7) for clamav:89 in 0.7 seconds, 4021 bytes. > 04-20 13:09:12 Apr 20 13:09:12.984 [17877] info: spamd: result: . -98 - > AWL,HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST scantime=0.7,size=4021 > ,user=clamav,uid=89,required_score=3.7,rhost=localhost.localdomain,raddr=127 > .0.0.1,rport=41862,mid=, > autolearn=no > 04-20 13:09:13 Apr 20 13:09:13.182 [32297] info: prefork: child states: II > 04-20 13:09:13 Apr 20 13:09:13.600 [17877] info: spamd: connection from > localhost.localdomain [127.0.0.1] at port 41865 > 04-20 13:09:13 Apr 20 13:09:13.607 [17877] info: spamd: processing message > for clamav:89 > 04-20 13:09:14 Apr 20 13:09:14.298 [17877] info: spamd: clean message > (-98.7/3.7) for clamav:89 in 0.7 seconds, 4014 bytes. > 04-20 13:09:14 Apr 20 13:09:14.299 [17877] info: spamd: result: . -98 - > AWL,HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST scantime=0.7,size=4014 > ,user=clamav,uid=89,required_score=3.7,rhost=lo
[qmailtoaster] Re: Spamdyke Question
On 04/20/2011 10:59 AM, Scott Hughes wrote: -Original Message- From: Eric Shubert [mailto:e...@shubes.net] Sent: Wednesday, April 20, 2011 12:01 PM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] Re: Spamdyke Question On 04/20/2011 08:45 AM, Scott Hughes wrote: -Original Message- From: Eric Shubert [mailto:e...@shubes.net] Sent: Wednesday, April 20, 2011 8:46 AM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] Re: Spamdyke Question On 04/20/2011 04:21 AM, Scott Hughes wrote: On Apr 20, 2011, at 12:07 AM, Eric Shubertwrote: On 04/19/2011 06:20 PM, Scott Hughes wrote: On 4/19/11 6:17 PM, Eric Shubert wrote: They're the same value in a QMT I just checked. Please post the log lines you're talking about (using qmlog formatting if you don't mind). I will post an example of an exact match as soon as I see the next one come through (should be tomorrow). Here is an example of what I am talking about in the mean-time: SMTP: 04-19 15:03:46 simscan:[19032]:CLEAN (2.10/8.00):5.7230s:Re_ #3:216.157.241.82:bounce-339075-137...@listserv.ncm20.com:joey@renshawauto.c om SPAMD: 2011-04-19 08:57:11.159507500 Apr 19 08:57:11.159 [6740] info: spamd: result: . -98 - HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST scantime=6.0,size=4024,user=clamav,uid=89,required_score=3.5,rhost=localhost .localdomain,raddr=127.0.0.1,rport=50816,mid= m20.com>,autolearn=no I had to use another method of pulling the SPAMD log. The qmlog kept telling me there were no logs with 'ncm20' in them, but I knew there was. I used the -g and then the -lm switches on qmlog. Just for everyones knowledge, if you pipe a grep command through 'tai64nlocal' it will give you normal time and dates. Such as: "grep ncm20.com /var/log/qmail/spamd/@40004dadbc3029c1626c.s | tai64nlocal". As you see above, the SMTP log shows a score of 2.10 and the SPAMD log shows a score of .-98 Thanks, Scott - What you're seeing in the spamd log is not the score. I'm not sure what the -98 is. The score is listed on the previous line, in parenthesis, like such: (score/threshold), which follows either "clean message" or "identified spam" text, depending on if the score is greater than the threshold or not. -- -Eric 'shubes' Eric, The .98 is the message score after it is run through Spaamssassin. The fact that it has a matching whitelist entry sets the score at -99. Then the scrore is adjusted upwards as it hits more rules for a final score of -98. So again I don't understand why the two scores are different. Scott - Can you post *all* of the spamd log messages for a given email please? Common, Scott. Give me a break. This is the output from a grep, which will not necessarily show what I'm looking for. I said all messages *for a given email*. Find one, or two. And please use qmlog to format a little nicer. Thanks. Just # qmlog spamd and scroll through the list, find a good example, then copy/paste all of the lines for a given email or 3. I don't generally use the the -g option much with qmlog, as it removes context which can be important. I use the -lc option instead if I'm looking for a particular address or host name. - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] Re: Spamdyke Question
On 04/20/2011 11:16 AM, Scott Hughes wrote: -Original Message- From: Eric Shubert [mailto:e...@shubes.net] Sent: Wednesday, April 20, 2011 12:01 PM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] Re: Spamdyke Question On 04/20/2011 08:45 AM, Scott Hughes wrote: -Original Message- From: Eric Shubert [mailto:e...@shubes.net] Sent: Wednesday, April 20, 2011 8:46 AM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] Re: Spamdyke Question On 04/20/2011 04:21 AM, Scott Hughes wrote: On Apr 20, 2011, at 12:07 AM, Eric Shubertwrote: On 04/19/2011 06:20 PM, Scott Hughes wrote: On 4/19/11 6:17 PM, Eric Shubert wrote: They're the same value in a QMT I just checked. Please post the log lines you're talking about (using qmlog formatting if you don't mind). I will post an example of an exact match as soon as I see the next one come through (should be tomorrow). Here is an example of what I am talking about in the mean-time: SMTP: 04-19 15:03:46 simscan:[19032]:CLEAN (2.10/8.00):5.7230s:Re_ #3:216.157.241.82:bounce-339075-137...@listserv.ncm20.com:joey@renshawauto.c om SPAMD: 2011-04-19 08:57:11.159507500 Apr 19 08:57:11.159 [6740] info: spamd: result: . -98 - HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST scantime=6.0,size=4024,user=clamav,uid=89,required_score=3.5,rhost=localhost .localdomain,raddr=127.0.0.1,rport=50816,mid= m20.com>,autolearn=no I had to use another method of pulling the SPAMD log. The qmlog kept telling me there were no logs with 'ncm20' in them, but I knew there was. I used the -g and then the -lm switches on qmlog. Just for everyones knowledge, if you pipe a grep command through 'tai64nlocal' it will give you normal time and dates. Such as: "grep ncm20.com /var/log/qmail/spamd/@40004dadbc3029c1626c.s | tai64nlocal". As you see above, the SMTP log shows a score of 2.10 and the SPAMD log shows a score of .-98 Thanks, Scott - What you're seeing in the spamd log is not the score. I'm not sure what the -98 is. The score is listed on the previous line, in parenthesis, like such: (score/threshold), which follows either "clean message" or "identified spam" text, depending on if the score is greater than the threshold or not. -- -Eric 'shubes' Eric, The .98 is the message score after it is run through Spaamssassin. The fact that it has a matching whitelist entry sets the score at -99. Then the scrore is adjusted upwards as it hits more rules for a final score of -98. So again I don't understand why the two scores are different. Scott - Can you post *all* of the spamd log messages for a given email please? Common, Scott. Give me a break. This is the output from a grep, which will not necessarily show what I'm looking for. I said all messages *for a given email*. Find one, or two. And please use qmlog to format a little nicer. Thanks. I think I have figured out what you are asking for. How is this: 04-20 13:08:16 Apr 20 13:08:16.105 [32297] info: prefork: child states: II 04-20 13:09:12 Apr 20 13:09:12.244 [17877] info: spamd: connection from localhost.localdomain [127.0.0.1] at port 41862 04-20 13:09:12 Apr 20 13:09:12.251 [17877] info: spamd: processing message for clamav:89 04-20 13:09:12 Apr 20 13:09:12.984 [17877] info: spamd: clean message (-98.6/3.7) for clamav:89 in 0.7 seconds, 4021 bytes. 04-20 13:09:12 Apr 20 13:09:12.984 [17877] info: spamd: result: . -98 - AWL,HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST scantime=0.7,size=4021 ,user=clamav,uid=89,required_score=3.7,rhost=localhost.localdomain,raddr=127 .0.0.1,rport=41862,mid=, autolearn=no 04-20 13:09:13 Apr 20 13:09:13.182 [32297] info: prefork: child states: II 04-20 13:09:13 Apr 20 13:09:13.600 [17877] info: spamd: connection from localhost.localdomain [127.0.0.1] at port 41865 04-20 13:09:13 Apr 20 13:09:13.607 [17877] info: spamd: processing message for clamav:89 04-20 13:09:14 Apr 20 13:09:14.298 [17877] info: spamd: clean message (-98.7/3.7) for clamav:89 in 0.7 seconds, 4014 bytes. 04-20 13:09:14 Apr 20 13:09:14.299 [17877] info: spamd: result: . -98 - AWL,HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST scantime=0.7,size=4014 ,user=clamav,uid=89,required_score=3.7,rhost=localhost.localdomain,raddr=127 .0.0.1,rport=41865,mid=, autolearn=no 04-20 13:09:14 Apr 20 13:09:14.495 [32297] info: prefork: child states: II Scott Ok, so one scored -98.6, and the other -98.7. What do the corresponding simscan lines in the smtp log show for these 2 messages? - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! ---
RE: [qmailtoaster] Re: Re; simscan, clamd, spamassassin related issue
Thanks Eric. I'll have to remember that. _ From: Eric Shubert [mailto:e...@shubes.net] Sent: Wednesday, April 20, 2011 12:04 PM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] Re: Re; simscan, clamd, spamassassin related issue On 04/20/2011 09:08 AM, Joel Eddy wrote: > Just an FYi for anyone else that has no output in the clamd mrtg graphs. > After seeing Eric had some issue with simsscan headers or some thing like > that I went and re installed simscan with the new model script. > > After that clamd mrtg started working. It did however hork my simscontrol > file. It also added a tcp.smpt.new file. When I compared it to the old one > It had added the RBLSMTPD line and a few other things. So I copied the new > file over the tcp.smtp file. Now spamassassin is marking spam that it wasn't > before. Clamd is now graphing as well. > > So in short I suspect something either in one up the updates to qmailtoaster > Or maybe upgradeing to CentOS 5.6 altered something along the way. > > But as of now all is working. > > Joel > > - Thanks for the report Joel. FYI, qtp-newmodel backs up all the configuration settings in /usr/src/qtp-upgrade/backups/* folders. In the event that a configuration file gets clobbered, you can find your previous settings there. -- -Eric 'shubes' - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com _ No virus found in this message. Checked by AVG - www.avg.com Version: 10.0.1209 / Virus Database: 1500/3585 - Release Date: 04/20/11
RE: [qmailtoaster] Re: Spamdyke Question
-Original Message- From: Eric Shubert [mailto:e...@shubes.net] Sent: Wednesday, April 20, 2011 12:01 PM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] Re: Spamdyke Question On 04/20/2011 08:45 AM, Scott Hughes wrote: > -Original Message- > From: Eric Shubert [mailto:e...@shubes.net] > Sent: Wednesday, April 20, 2011 8:46 AM > To: qmailtoaster-list@qmailtoaster.com > Subject: [qmailtoaster] Re: Spamdyke Question > > On 04/20/2011 04:21 AM, Scott Hughes wrote: >> On Apr 20, 2011, at 12:07 AM, Eric Shubert wrote: >> >>> On 04/19/2011 06:20 PM, Scott Hughes wrote: On 4/19/11 6:17 PM, Eric Shubert wrote: > They're the same value in a QMT I just checked. > > Please post the log lines you're talking about (using qmlog formatting > if you don't mind). > I will post an example of an exact match as soon as I see the next one come through (should be tomorrow). Here is an example of what I am talking about in the mean-time: SMTP: 04-19 15:03:46 simscan:[19032]:CLEAN (2.10/8.00):5.7230s:Re_ > #3:216.157.241.82:bounce-339075-137...@listserv.ncm20.com:joey@renshawauto.c > om SPAMD: 2011-04-19 08:57:11.159507500 Apr 19 08:57:11.159 [6740] info: spamd: result: . -98 - HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST > scantime=6.0,size=4024,user=clamav,uid=89,required_score=3.5,rhost=localhost > .localdomain,raddr=127.0.0.1,rport=50816,mid= m20.com>,autolearn=no I had to use another method of pulling the SPAMD log. The qmlog kept telling me there were no logs with 'ncm20' in them, but I knew there was. I used the -g and then the -lm switches on qmlog. Just for everyones knowledge, if you pipe a grep command through 'tai64nlocal' it will give you normal time and dates. Such as: "grep ncm20.com /var/log/qmail/spamd/@40004dadbc3029c1626c.s | tai64nlocal". As you see above, the SMTP log shows a score of 2.10 and the SPAMD log shows a score of .-98 Thanks, Scott > > - >>> >>> What you're seeing in the spamd log is not the score. I'm not sure what > the -98 is. The score is listed on the previous line, in parenthesis, like > such: (score/threshold), which follows either "clean message" or "identified > spam" text, depending on if the score is greater than the threshold or not. >>> >>> -- >>> -Eric 'shubes' >>> >> Eric, >> >> The .98 is the message score after it is run through Spaamssassin. The > fact that it has a matching whitelist entry sets the score at -99. Then the > scrore is adjusted upwards as it hits more rules for a final score of -98. >> >> So again I don't understand why the two scores are different. >> >> Scott >> >> > > - > > Can you post *all* of the spamd log messages for a given email please? > Common, Scott. Give me a break. This is the output from a grep, which will not necessarily show what I'm looking for. I said all messages *for a given email*. Find one, or two. And please use qmlog to format a little nicer. Thanks. -- -Eric 'shubes' - I think I have figured out what you are asking for. How is this: 04-20 13:08:16 Apr 20 13:08:16.105 [32297] info: prefork: child states: II 04-20 13:09:12 Apr 20 13:09:12.244 [17877] info: spamd: connection from localhost.localdomain [127.0.0.1] at port 41862 04-20 13:09:12 Apr 20 13:09:12.251 [17877] info: spamd: processing message for clamav:89 04-20 13:09:12 Apr 20 13:09:12.984 [17877] info: spamd: clean message (-98.6/3.7) for clamav:89 in 0.7 seconds, 4021 bytes. 04-20 13:09:12 Apr 20 13:09:12.984 [17877] info: spamd: result: . -98 - AWL,HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST scantime=0.7,size=4021 ,user=clamav,uid=89,required_score=3.7,rhost=localhost.localdomain,raddr=127 .0.0.1,rport=41862,mid=, autolearn=no 04-20 13:09:13 Apr 20 13:09:13.182 [32297] info: prefork: child states: II 04-20 13:09:13 Apr 20 13:09:13.600 [17877] info: spamd: connection from localhost.localdomain [127.0.0.1] at port 41865 04-20 13:09:13 Apr 20 13:09:13.607 [17877] info: spamd: processing message for clamav:89 04-20 13:09:14 Apr 20 13:09:14.298 [17877] info: spamd: clean message (-98.7/3.7) for clamav:89 in 0.7 seconds, 4014 bytes. 04-20 13:09:14 Apr 20 13:09:14.299 [17877] info: spamd: result: . -98 - AWL,HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST scantime=0.7,size=4014 ,user=clamav,uid=89,required_score=3.7,rhost=localhost.localdomain,raddr=127 .0.0.1,rport=41865,mid=, autolearn=no 04-20 13:09:14 Apr 20 13:09:14.495 [32297] info: prefork: child states: II Scott - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsul
RE: [qmailtoaster] Re: Spamdyke Question
-Original Message- From: Eric Shubert [mailto:e...@shubes.net] Sent: Wednesday, April 20, 2011 12:01 PM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] Re: Spamdyke Question On 04/20/2011 08:45 AM, Scott Hughes wrote: > -Original Message- > From: Eric Shubert [mailto:e...@shubes.net] > Sent: Wednesday, April 20, 2011 8:46 AM > To: qmailtoaster-list@qmailtoaster.com > Subject: [qmailtoaster] Re: Spamdyke Question > > On 04/20/2011 04:21 AM, Scott Hughes wrote: >> On Apr 20, 2011, at 12:07 AM, Eric Shubert wrote: >> >>> On 04/19/2011 06:20 PM, Scott Hughes wrote: On 4/19/11 6:17 PM, Eric Shubert wrote: > They're the same value in a QMT I just checked. > > Please post the log lines you're talking about (using qmlog formatting > if you don't mind). > I will post an example of an exact match as soon as I see the next one come through (should be tomorrow). Here is an example of what I am talking about in the mean-time: SMTP: 04-19 15:03:46 simscan:[19032]:CLEAN (2.10/8.00):5.7230s:Re_ > #3:216.157.241.82:bounce-339075-137...@listserv.ncm20.com:joey@renshawauto.c > om SPAMD: 2011-04-19 08:57:11.159507500 Apr 19 08:57:11.159 [6740] info: spamd: result: . -98 - HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST > scantime=6.0,size=4024,user=clamav,uid=89,required_score=3.5,rhost=localhost > .localdomain,raddr=127.0.0.1,rport=50816,mid= m20.com>,autolearn=no I had to use another method of pulling the SPAMD log. The qmlog kept telling me there were no logs with 'ncm20' in them, but I knew there was. I used the -g and then the -lm switches on qmlog. Just for everyones knowledge, if you pipe a grep command through 'tai64nlocal' it will give you normal time and dates. Such as: "grep ncm20.com /var/log/qmail/spamd/@40004dadbc3029c1626c.s | tai64nlocal". As you see above, the SMTP log shows a score of 2.10 and the SPAMD log shows a score of .-98 Thanks, Scott > > - >>> >>> What you're seeing in the spamd log is not the score. I'm not sure what > the -98 is. The score is listed on the previous line, in parenthesis, like > such: (score/threshold), which follows either "clean message" or "identified > spam" text, depending on if the score is greater than the threshold or not. >>> >>> -- >>> -Eric 'shubes' >>> >> Eric, >> >> The .98 is the message score after it is run through Spaamssassin. The > fact that it has a matching whitelist entry sets the score at -99. Then the > scrore is adjusted upwards as it hits more rules for a final score of -98. >> >> So again I don't understand why the two scores are different. >> >> Scott >> >> > > - > > Can you post *all* of the spamd log messages for a given email please? > Common, Scott. Give me a break. This is the output from a grep, which will not necessarily show what I'm looking for. I said all messages *for a given email*. Find one, or two. And please use qmlog to format a little nicer. Thanks. -- -Eric 'shubes' - Sorry Eric. I thought I was giving you what you wanted. Exactly how to I use qmlog to give you what you want? If I use the -g switch I only get one line for the item I am searching for. Scott - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] Re: Re; simscan, clamd, spamassassin related issue
On 04/20/2011 09:08 AM, Joel Eddy wrote: Just an FYi for anyone else that has no output in the clamd mrtg graphs. After seeing Eric had some issue with simsscan headers or some thing like that I went and re installed simscan with the new model script. After that clamd mrtg started working. It did however hork my simscontrol file. It also added a tcp.smpt.new file. When I compared it to the old one It had added the RBLSMTPD line and a few other things. So I copied the new file over the tcp.smtp file. Now spamassassin is marking spam that it wasn't before. Clamd is now graphing as well. So in short I suspect something either in one up the updates to qmailtoaster Or maybe upgradeing to CentOS 5.6 altered something along the way. But as of now all is working. Joel - Thanks for the report Joel. FYI, qtp-newmodel backs up all the configuration settings in /usr/src/qtp-upgrade/backups/* folders. In the event that a configuration file gets clobbered, you can find your previous settings there. -- -Eric 'shubes' - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] Re: Spamdyke Question
On 04/20/2011 08:45 AM, Scott Hughes wrote: -Original Message- From: Eric Shubert [mailto:e...@shubes.net] Sent: Wednesday, April 20, 2011 8:46 AM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] Re: Spamdyke Question On 04/20/2011 04:21 AM, Scott Hughes wrote: On Apr 20, 2011, at 12:07 AM, Eric Shubert wrote: On 04/19/2011 06:20 PM, Scott Hughes wrote: On 4/19/11 6:17 PM, Eric Shubert wrote: They're the same value in a QMT I just checked. Please post the log lines you're talking about (using qmlog formatting if you don't mind). I will post an example of an exact match as soon as I see the next one come through (should be tomorrow). Here is an example of what I am talking about in the mean-time: SMTP: 04-19 15:03:46 simscan:[19032]:CLEAN (2.10/8.00):5.7230s:Re_ #3:216.157.241.82:bounce-339075-137...@listserv.ncm20.com:joey@renshawauto.c om SPAMD: 2011-04-19 08:57:11.159507500 Apr 19 08:57:11.159 [6740] info: spamd: result: . -98 - HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST scantime=6.0,size=4024,user=clamav,uid=89,required_score=3.5,rhost=localhost .localdomain,raddr=127.0.0.1,rport=50816,mid=,autolearn=no I had to use another method of pulling the SPAMD log. The qmlog kept telling me there were no logs with 'ncm20' in them, but I knew there was. I used the -g and then the -lm switches on qmlog. Just for everyones knowledge, if you pipe a grep command through 'tai64nlocal' it will give you normal time and dates. Such as: "grep ncm20.com /var/log/qmail/spamd/@40004dadbc3029c1626c.s | tai64nlocal". As you see above, the SMTP log shows a score of 2.10 and the SPAMD log shows a score of .-98 Thanks, Scott - What you're seeing in the spamd log is not the score. I'm not sure what the -98 is. The score is listed on the previous line, in parenthesis, like such: (score/threshold), which follows either "clean message" or "identified spam" text, depending on if the score is greater than the threshold or not. -- -Eric 'shubes' Eric, The .98 is the message score after it is run through Spaamssassin. The fact that it has a matching whitelist entry sets the score at -99. Then the scrore is adjusted upwards as it hits more rules for a final score of -98. So again I don't understand why the two scores are different. Scott - Can you post *all* of the spamd log messages for a given email please? Common, Scott. Give me a break. This is the output from a grep, which will not necessarily show what I'm looking for. I said all messages *for a given email*. Find one, or two. And please use qmlog to format a little nicer. Thanks. -- -Eric 'shubes' - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] Re; simscan, clamd, spamassassin related issue
Just an FYi for anyone else that has no output in the clamd mrtg graphs. After seeing Eric had some issue with simsscan headers or some thing like that I went and re installed simscan with the new model script. After that clamd mrtg started working. It did however hork my simscontrol file. It also added a tcp.smpt.new file. When I compared it to the old one It had added the RBLSMTPD line and a few other things. So I copied the new file over the tcp.smtp file. Now spamassassin is marking spam that it wasn't before. Clamd is now graphing as well. So in short I suspect something either in one up the updates to qmailtoaster Or maybe upgradeing to CentOS 5.6 altered something along the way. But as of now all is working. Joel - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
RE: [qmailtoaster] Re: Spamdyke Question
-Original Message- From: Eric Shubert [mailto:e...@shubes.net] Sent: Wednesday, April 20, 2011 8:46 AM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] Re: Spamdyke Question On 04/20/2011 04:21 AM, Scott Hughes wrote: > On Apr 20, 2011, at 12:07 AM, Eric Shubert wrote: > >> On 04/19/2011 06:20 PM, Scott Hughes wrote: >>> On 4/19/11 6:17 PM, Eric Shubert wrote: They're the same value in a QMT I just checked. Please post the log lines you're talking about (using qmlog formatting if you don't mind). >>> >>> I will post an example of an exact match as soon as I see the next one >>> come through (should be tomorrow). Here is an example of what I am >>> talking about in the mean-time: >>> >>> SMTP: >>> >>> 04-19 15:03:46 simscan:[19032]:CLEAN (2.10/8.00):5.7230s:Re_ >>> #3:216.157.241.82:bounce-339075-137...@listserv.ncm20.com:joey@renshawauto.c om >>> >>> >>> SPAMD: >>> >>> 2011-04-19 08:57:11.159507500 Apr 19 08:57:11.159 [6740] info: spamd: >>> result: . -98 - HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST >>> scantime=6.0,size=4024,user=clamav,uid=89,required_score=3.5,rhost=localhost .localdomain,raddr=127.0.0.1,rport=50816,mid=,autolearn=no >>> >>> >>> I had to use another method of pulling the SPAMD log. The qmlog kept >>> telling me there were no logs with 'ncm20' in them, but I knew there >>> was. I used the -g and then the -lm switches on qmlog. Just for >>> everyones knowledge, if you pipe a grep command through 'tai64nlocal' it >>> will give you normal time and dates. Such as: "grep ncm20.com >>> /var/log/qmail/spamd/@40004dadbc3029c1626c.s | tai64nlocal". >>> >>> As you see above, the SMTP log shows a score of 2.10 and the SPAMD log >>> shows a score of .-98 >>> >>> Thanks, >>> Scott >>> >>> >>> - >> >> What you're seeing in the spamd log is not the score. I'm not sure what the -98 is. The score is listed on the previous line, in parenthesis, like such: (score/threshold), which follows either "clean message" or "identified spam" text, depending on if the score is greater than the threshold or not. >> >> -- >> -Eric 'shubes' >> > Eric, > > The .98 is the message score after it is run through Spaamssassin. The fact that it has a matching whitelist entry sets the score at -99. Then the scrore is adjusted upwards as it hits more rules for a final score of -98. > > So again I don't understand why the two scores are different. > > Scott > > - Can you post *all* of the spamd log messages for a given email please? -- -Eric 'shubes' - Also in addition to the SPAMD logs I just sent to the list, here is 50 lines from my SMTP log: /var/log/qmail/smtp/@40004daddfa41f406b6c.s:@40004dadbd930c029b9c spamdyke[22610]: ALLOWED from: bounce-339026-137...@listserv.ncm20.com to: us...@renshawauto.com origin_ip: 216.157.241.82 origin_rdns: lomwsm03.mwlo.mailwatch.com auth: (unknown) /var/log/qmail/smtp/@40004daddfa41f406b6c.s:@40004dadbd971a789e74 simscan:[22618]:CLEAN (2.10/8.00):4.2421s:Test:216.157.241.82:bounce-339026-137369@listserv.ncm20. com:us...@renshawauto.com /var/log/qmail/smtp/@40004daddfa41f406b6c.s:@40004dadbdf815b7d65c CHKUSER accepted rcpt: from remote rcpt : found existing recipient /var/log/qmail/smtp/@40004daddfa41f406b6c.s:@40004dadbdf815b7e5fc policy_check: remote bounce-339028-137...@listserv.ncm20.com -> local us...@renshawauto.com (UNAUTHENTICATED SENDER) /var/log/qmail/smtp/@40004daddfa41f406b6c.s:@40004dadbdf815b7f1b4 spamdyke[23022]: ALLOWED from: bounce-339028-137...@listserv.ncm20.com to: us...@renshawauto.com origin_ip: 216.157.241.10 origin_rdns: lomwsm04.mwlo.mailwatch.com auth: (unknown) /var/log/qmail/smtp/@40004daddfa41f406b6c.s:@40004dadbdf9124b4fbc simscan:[23036]:CLEAN (2.10/8.00):0.9395s:RE_ Test:216.157.241.10:bounce-339028-137...@listserv.ncm20.com:user3@renshawaut o.com /var/log/qmail/smtp/@40004daddfa41f406b6c.s:@40004dadc2891cd510bc CHKUSER accepted rcpt: from remote rcpt : found existing recipient /var/log/qmail/smtp/@40004daddfa41f406b6c.s:@40004dadc2891cd5a914 policy_check: remote bounce-339033-137...@listserv.ncm20.com -> local us...@renshawauto.com (UNAUTHENTICATED SENDER) /var/log/qmail/smtp/@40004daddfa41f406b6c.s:@40004dadc2891cd7b86c spamdyke[27035]: ALLOWED from: bounce-339033-137...@listserv.ncm20.com to: us...@renshawauto.com origin_ip: 216.157.241.10 origin_rdns: lomwsm04.mwlo.mailwatch.com auth: (unknown) /var/log/qmail/smtp/@40004daddfa41f406b6c.s:@40004dadc28d36088ec4 simscan:[27049]:CLEAN (2.10/8.00):4.4221s:Re_ Test:216.157.241.10:bounce-339033-137...@listserv.ncm20.com:user3@renshawaut o.com /var/log/qmail/smtp/@40004daddfa41f406b6c.s:@40004dadd81e19115db4 CHKUSER accepted
RE: [qmailtoaster] RE: tcp.smtp Question
Thanks Scott _ From: Scott Hughes [mailto:sc...@renshawauto.net] Sent: Wednesday, April 20, 2011 10:39 AM To: qmailtoaster-list@qmailtoaster.com Subject: RE: [qmailtoaster] RE: tcp.smtp Question -Original Message- From: Joel Eddy [mailto:rje...@iowaconnect.com] Sent: Wednesday, April 20, 2011 10:34 AM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] RE: tcp.smtp Question If CHKUSER_RCPTLIMIT="50" controls the number of address in To: & CC: What does CHKUSER_WRONGRCPTLIMIT="10" do? Joel - My understanding is that the WRONGTCPTLIMIT only allows (in your case) 10 wrong email addresses before it rejects the email. Scott - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com _ No virus found in this message. Checked by AVG - www.avg.com Version: 10.0.1209 / Virus Database: 1500/3583 - Release Date: 04/19/11
RE: [qmailtoaster] RE: tcp.smtp Question
-Original Message- From: Joel Eddy [mailto:rje...@iowaconnect.com] Sent: Wednesday, April 20, 2011 10:34 AM To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] RE: tcp.smtp Question If CHKUSER_RCPTLIMIT="50" controls the number of address in To: & CC: What does CHKUSER_WRONGRCPTLIMIT="10" do? Joel - My understanding is that the WRONGTCPTLIMIT only allows (in your case) 10 wrong email addresses before it rejects the email. Scott - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] RE: tcp.smtp Question
If CHKUSER_RCPTLIMIT="50" controls the number of address in To: & CC: What does CHKUSER_WRONGRCPTLIMIT="10" do? Joel - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
Re: [qmailtoaster] Re: Bounce Back Email being Received
I didn't see they had 2 servers. I think you're right Eric rDNS is likely the cause. On 04/20/2011 07:03 AM, Eric Shubert wrote: > a61.com.sg is the recipient domain. It has 2 mx servers: > > # host a61.com.sg > a61.com.sg has address 202.166.88.42 > a61.com.sg mail is handled by 20 mx1.picomail.net. > a61.com.sg mail is handled by 10 smtp.a61.com.sg. > # host mx1.picomail.net > mx1.picomail.net has address 202.166.88.42 > # host smtp.a61.com.sg > smtp.a61.com.sg has address 203.125.98.162 > # > > Looks ok to me. > -- Cecil Yother, Jr. "cj" cj's 2318 Clement Ave Alameda, CA 94501 tel 510.865.2787 http://yother.com Check out the new Volvo classified resource http://www.volvoclassified.com - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] Re: Bounce Back Email being Received
a61.com.sg is the recipient domain. It has 2 mx servers: # host a61.com.sg a61.com.sg has address 202.166.88.42 a61.com.sg mail is handled by 20 mx1.picomail.net. a61.com.sg mail is handled by 10 smtp.a61.com.sg. # host mx1.picomail.net mx1.picomail.net has address 202.166.88.42 # host smtp.a61.com.sg smtp.a61.com.sg has address 203.125.98.162 # Looks ok to me. -- -Eric 'shubes' On 04/20/2011 06:49 AM, Maxwell Smart wrote: You appear to have a DNS error. a61.com.sg resolves to 202.166.88.42 and not 203.125.98.162 Did you recently change your DNS? On 04/20/2011 01:44 AM, mr...@cladding.com wrote: Hi All, We keep on receiving bounce back email when sending to specific client. Can someone help us identify what is causing the problem. Please see below sample bounce back email: - Original Message - From: To: Sent: Thursday, April 14, 2011 4:02 PM Subject: failure notice Hi. This is the qmail-send program at mail.altcladding.com.ph. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. : User and password not set, continuing without authentication. 203.125.98.162 does not like recipient. Remote host said: 450 Client host rejected: cannot find your hostname, [122.3.237.69] Giving up on 203.125.98.162. I'm not going to try again; this message has been in the queue too long. : User and password not set, continuing without authentication. 203.125.98.162 does not like recipient. Remote host said: 450 Client host rejected: cannot find your hostname, [122.3.237.69] Giving up on 203.125.98.162. I'm not going to try again; this message has been in the queue too long. Regards, Malvin - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail:qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail:qmailtoaster-list-h...@qmailtoaster.com -- Cecil Yother, Jr. "cj" cj's 2318 Clement Ave Alameda, CA 94501 tel 510.865.2787 http://yother.com Check out the new Volvo classified resourcehttp://www.volvoclassified.com - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] Re: Spamdyke Question
On 04/20/2011 04:21 AM, Scott Hughes wrote: On Apr 20, 2011, at 12:07 AM, Eric Shubert wrote: On 04/19/2011 06:20 PM, Scott Hughes wrote: On 4/19/11 6:17 PM, Eric Shubert wrote: They're the same value in a QMT I just checked. Please post the log lines you're talking about (using qmlog formatting if you don't mind). I will post an example of an exact match as soon as I see the next one come through (should be tomorrow). Here is an example of what I am talking about in the mean-time: SMTP: 04-19 15:03:46 simscan:[19032]:CLEAN (2.10/8.00):5.7230s:Re_ #3:216.157.241.82:bounce-339075-137...@listserv.ncm20.com:j...@renshawauto.com SPAMD: 2011-04-19 08:57:11.159507500 Apr 19 08:57:11.159 [6740] info: spamd: result: . -98 - HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST scantime=6.0,size=4024,user=clamav,uid=89,required_score=3.5,rhost=localhost.localdomain,raddr=127.0.0.1,rport=50816,mid=,autolearn=no I had to use another method of pulling the SPAMD log. The qmlog kept telling me there were no logs with 'ncm20' in them, but I knew there was. I used the -g and then the -lm switches on qmlog. Just for everyones knowledge, if you pipe a grep command through 'tai64nlocal' it will give you normal time and dates. Such as: "grep ncm20.com /var/log/qmail/spamd/@40004dadbc3029c1626c.s | tai64nlocal". As you see above, the SMTP log shows a score of 2.10 and the SPAMD log shows a score of .-98 Thanks, Scott - What you're seeing in the spamd log is not the score. I'm not sure what the -98 is. The score is listed on the previous line, in parenthesis, like such: (score/threshold), which follows either "clean message" or "identified spam" text, depending on if the score is greater than the threshold or not. -- -Eric 'shubes' Eric, The .98 is the message score after it is run through Spaamssassin. The fact that it has a matching whitelist entry sets the score at -99. Then the scrore is adjusted upwards as it hits more rules for a final score of -98. So again I don't understand why the two scores are different. Scott - Can you post *all* of the spamd log messages for a given email please? -- -Eric 'shubes' - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
Re: [qmailtoaster] Bounce Back Email being Received
You appear to have a DNS error. a61.com.sg resolves to 202.166.88.42 and not 203.125.98.162 Did you recently change your DNS? On 04/20/2011 01:44 AM, mr...@cladding.com wrote: Hi All, We keep on receiving bounce back email when sending to specific client. Can someone help us identify what is causing the problem. Please see below sample bounce back email: - Original Message - From: To: Sent: Thursday, April 14, 2011 4:02 PM Subject: failure notice Hi. This is the qmail-send program at mail.altcladding.com.ph. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. : User and password not set, continuing without authentication. 203.125.98.162 does not like recipient. Remote host said: 450 Client host rejected: cannot find your hostname, [122.3.237.69] Giving up on 203.125.98.162. I'm not going to try again; this message has been in the queue too long. : User and password not set, continuing without authentication. 203.125.98.162 does not like recipient. Remote host said: 450 Client host rejected: cannot find your hostname, [122.3.237.69] Giving up on 203.125.98.162. I'm not going to try again; this message has been in the queue too long. Regards, Malvin - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com -- Cecil Yother, Jr. "cj" cj's 2318 Clement Ave Alameda, CA 94501 tel 510.865.2787 http://yother.com Check out the new Volvo classified resource http://www.volvoclassified.com - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] Re: Bounce Back Email being Received
On 04/20/2011 01:44 AM, mr...@cladding.com wrote: Hi All, We keep on receiving bounce back email when sending to specific client. Can someone help us identify what is causing the problem. Please see below sample bounce back email: - Original Message - From: To: Sent: Thursday, April 14, 2011 4:02 PM Subject: failure notice Hi. This is the qmail-send program at mail.altcladding.com.ph. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. : User and password not set, continuing without authentication. 203.125.98.162 does not like recipient. Remote host said: 450 Client host rejected: cannot find your hostname, [122.3.237.69] Giving up on 203.125.98.162. I'm not going to try again; this message has been in the queue too long. : User and password not set, continuing without authentication. 203.125.98.162 does not like recipient. Remote host said: 450 Client host rejected: cannot find your hostname, [122.3.237.69] Giving up on 203.125.98.162. I'm not going to try again; this message has been in the queue too long. Regards, Malvin - $ host 122.3.237.69 69.237.3.122.in-addr.arpa domain name pointer 122.3.237.69.pldt.net. $ host 122.3.237.69.pldt.net Host 122.3.237.69.pldt.net not found: 3(NXDOMAIN) I expect it's because the rDNS record for your IP address does not resolve. The ISP who provides the IP address should have a way to get that corrected for you. -- -Eric 'shubes' - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
Re: [qmailtoaster] Re: Spamdyke Question
On Apr 20, 2011, at 12:07 AM, Eric Shubert wrote: > On 04/19/2011 06:20 PM, Scott Hughes wrote: >> On 4/19/11 6:17 PM, Eric Shubert wrote: >>> They're the same value in a QMT I just checked. >>> >>> Please post the log lines you're talking about (using qmlog formatting >>> if you don't mind). >>> >> >> I will post an example of an exact match as soon as I see the next one >> come through (should be tomorrow). Here is an example of what I am >> talking about in the mean-time: >> >> SMTP: >> >> 04-19 15:03:46 simscan:[19032]:CLEAN (2.10/8.00):5.7230s:Re_ >> #3:216.157.241.82:bounce-339075-137...@listserv.ncm20.com:j...@renshawauto.com >> >> >> SPAMD: >> >> 2011-04-19 08:57:11.159507500 Apr 19 08:57:11.159 [6740] info: spamd: >> result: . -98 - HTML_MESSAGE,RDNS_NONE,USER_IN_WHITELIST >> scantime=6.0,size=4024,user=clamav,uid=89,required_score=3.5,rhost=localhost.localdomain,raddr=127.0.0.1,rport=50816,mid=,autolearn=no >> >> >> I had to use another method of pulling the SPAMD log. The qmlog kept >> telling me there were no logs with 'ncm20' in them, but I knew there >> was. I used the -g and then the -lm switches on qmlog. Just for >> everyones knowledge, if you pipe a grep command through 'tai64nlocal' it >> will give you normal time and dates. Such as: "grep ncm20.com >> /var/log/qmail/spamd/@40004dadbc3029c1626c.s | tai64nlocal". >> >> As you see above, the SMTP log shows a score of 2.10 and the SPAMD log >> shows a score of .-98 >> >> Thanks, >> Scott >> >> >> - > > What you're seeing in the spamd log is not the score. I'm not sure what the > -98 is. The score is listed on the previous line, in parenthesis, like such: > (score/threshold), which follows either "clean message" or "identified spam" > text, depending on if the score is greater than the threshold or not. > > -- > -Eric 'shubes' > Eric, The .98 is the message score after it is run through Spaamssassin. The fact that it has a matching whitelist entry sets the score at -99. Then the scrore is adjusted upwards as it hits more rules for a final score of -98. So again I don't understand why the two scores are different. Scott - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] Bounce Back Email being Received
Hi All, We keep on receiving bounce back email when sending to specific client. Can someone help us identify what is causing the problem. Please see below sample bounce back email: - Original Message - From: To: Sent: Thursday, April 14, 2011 4:02 PM Subject: failure notice > Hi. This is the qmail-send program at mail.altcladding.com.ph. > I'm afraid I wasn't able to deliver your message to the following addresses. > This is a permanent error; I've given up. Sorry it didn't work out. > > : > User and password not set, continuing without authentication. > 203.125.98.162 does not like recipient. > Remote host said: 450 Client host rejected: cannot find your hostname, > [122.3.237.69] > Giving up on 203.125.98.162. > I'm not going to try again; this message has been in the queue too long. > > : > User and password not set, continuing without authentication. > 203.125.98.162 does not like recipient. > Remote host said: 450 Client host rejected: cannot find your hostname, > [122.3.237.69] > Giving up on 203.125.98.162. > I'm not going to try again; this message has been in the queue too long. Regards, Malvin - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
RE: [qmailtoaster] Server Downtime Question
Hi Malvin, It depends on the senders system delivery queue settings. If the senders queue has a retry limit of 24 hours and your system is down 48 hours, the mail will bounce obviously. Regards, Jens -Original Message- From: mr...@cladding.com [mailto:mr...@cladding.com] Sent: 20. april 2011 09:37 To: qmailtoaster-list@qmailtoaster.com Subject: [qmailtoaster] Server Downtime Question Hello All, We will be shutting down our QmailToaster Server for about 2 days, my question is if ever someone send email during those period do the will bounced back? Thanks & regards, Malvin - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
[qmailtoaster] Server Downtime Question
Hello All, We will be shutting down our QmailToaster Server for about 2 days, my question is if ever someone send email during those period do the will bounced back? Thanks & regards, Malvin - Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! - Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
