This is a heck of a mystery for me -- I contacted a business that I made a purchase from, after having not heard from them; and they said they did in fact email me.
I didn't receive the email.
/var/log/mail/smtp logs show countless attempts of their mail server trying to send to me:
@40000000426c0f14280e2c5c.s:@40000000426bd1792d55f30c CHKUSER accepted rcpt: from <<a href="mailto:support@executiveasp.com" target="_blank">support@executiveasp.com</a>::> remote <easp-prov1:provisioning.executiveasp.com:204.10.176.52> rcpt <<a href="mailto:ANTISPAM_REDACTED" target="_blank">ANTISPAM_REDACTED</a>> : found existing recipient
/var/log/maillog shows:
Apr 24 14:04:12 coda spamd[15790]: connection from localhost [127.0.0.1] at port 52657
Apr 24 14:04:12 coda spamd[15790]: processing message <000001c548e8$6bb03610$<a href="mailto:34b00acc@easpprov1" target="_blank">34b00acc@easpprov1</a>> for clamav:0.
Apr 24 14:04:14 coda spamd[15790]: clean message (0.4/5.0) for clamav:0 in 2.6 seconds, 9216 bytes.
Apr 24 14:04:14 coda spamd[15790]: result: . 0 - MIME_MISSING_BOUNDARY,NO_REAL_NAME scantime=2.6,size=9216,mid=<000001c548e8$6bb03610$<a href="mailto:34b00acc@easpprov1" target="_blank">34b00acc@easpprov1</a>>,autolearn=no
note the 'for clamav:0' instead of saying my email address, as it normally would.
After that -- there's no record of the email, not in maildrop.log, nothing in /var/log/maillog about delivering it to me, etc. --
I've gotten numerous other emails in this time -- and I'm unable to find any other emails which were processed as 'for clamav:0'
I've enabled ALL clamav logging options, and eagerly await some clue; however unless I get an email from them again, I'm not convinced I'll learn of the problem.
I encourage others to search their logs for a 'for clamav', and see if they're loosing emails. google shows no results on 'for clamav'
This concerns me greatly; as the last thing I would ever want is my own email server I run to drop emails I desire. I'll probably start pouring through the source code next to discover what this means.
A clue to help you on your way. The logfile entry you cite is a SpamAssassin entry. It is most likely "for clamav" because your content scanner is running as the system username "clamav".
Now grasshopper, you must ask yourself a couple questions:
1. Why doesn't SpamAssassin know the proper username for the message?
2. What would your system would do with such a message destined to a local user?
Answer those questions and you'll find your answer.
I've the same problem.
I'm working on answering the questions but the first one seams to be too difficult for me.
LogicX, did you found a solution?
| cubera wrote on Fri, 20 May 2005 16:16 |
I've the same problem.
I'm working on answering the questions but the first one seams to be too difficult for me.
LogicX, did you found a solution?
|
It never happened again, so I've been unable to have a good, repeatable test.
I've gotten busy, and lost interest since the problem hasn't re-appeared.
| Matt |
1. Why doesn't SpamAssassin know the proper username for the message?
2. What would your system would do with such a message destined to a local user?
|
1. they didn't have a proper 'To:' field?
2. handled by /var/qmail/alias entries (I just added a .qmail-default there so I'll see if I catch such things in the future?)
using recordio I was able to snag the email as it comes into smtp --
Here's the convo with headers -- nothing seems to jump out at me.
I did however notice that the email did not end properly
A normal closure looks like this:
4000000043949529352f6cd4 3615 < .
400000004394952b399c7384 3615 > 250 ok 1133810977 qp 3618
400000004394952c30d5c32c 3615 < QUIT
400000004394952c30e1e0bc 3615 > 221 mail.logicx.net
@400000004394952c30f447ac 3615 > [EOF]
This instead ends:
@400000004394954420f1401c 3617 < Complaint Dept.
400000004394954420f147ec 3617 < Better Business Bureau of the Southland, Inc.</p>
@400000004394954420f14fbc 3617 < ------=_NextPart_000_0583_01C5F895.5152E5+
400000004394954420f1578c 3617 > 451 See
http://pobox.com/~djb/docs/smtplf.html.And there you have it I guess --
its a broken email message, sent from a broken mailer, and I suppose that such brokenness leads to more problems down the line -- spamd and clamav ...
@40000000439493b83b0c7674 3432 > 220 mail.logicx.net ESMTP^M
@40000000439493b903a0b40c 3432 < EHLO BBBEMAIL2.labbb.org^M
@40000000439493b903a1e0d4 3432 > 250-mail.logicx.net^M
@40000000439493b903a22b0c 3432 > 250-STARTTLS^M
@40000000439493b903a2698c 3432 > 250-PIPELINING^M
@40000000439493b903a2a03c 3432 > 250-8BITMIME^M
@40000000439493b903a2dad4 3432 > 250-SIZE 0^M
@40000000439493b903a31184 3432 > 250 AUTH LOGIN PLAIN CRAM-MD5^M
@40000000439493b9080955bc 3432 < MAIL FROM:<
cmpl@labbb.org>^M
@40000000439493b90faf4c04 3432 > 250 ok^M
@40000000439493b915dd2524 3432 < RCPT TO:<
bbb@logicx.us>^M
@40000000439493b915e31c7c CHKUSER accepted rcpt: from <
cmpl@labbb.org::> remote < BBBEMAIL2.labbb.org:65-60-97-140-cust.telepacific.net:65.60. 97.140 > rcpt <
bbb@logicx.us> : found existing recipient
@40000000439493b915e3d02c 3432 > 250 ok^M
@40000000439493b91b771ecc 3432 < DATA^M
@40000000439493b91b870cec 3432 > 354 go ahead^M
@40000000439493b92122141c 3432 < Received: from labbb.org ([209.85.136.240]) by BBBEMAIL2.labbb.org with Microsoft SMTPSVC(6.0.3790.1830);^M
@40000000439493b92122e70c 3432 < Sun, 4 Dec 2005 05:41:04 -0800^M
@40000000439493b921232974 3432 < Received: from bbbweb3 ([192.168.5.103]) by labbb.org with Microsoft SMTPSVC(5.0.2195.6713);^M
@40000000439493b9212367f4 3432 < Sun, 4 Dec 2005 05:+
@40000000439493b92123ecc4 3432 < 41:04 -0800^M
@40000000439493b92124e6c4 3432 < thread-index: AcX42F92vktNa9B5T1O3Q/mWIaA72g==^M
@40000000439493b92125292c 3432 < Thread-Topic: Your Complaint^M
@40000000439493b9212563c4 3432 < From: <
cmpl@labbb.org>^M
@40000000439493b921259e5c 3432 < To: <
bbb@logicx.us>^M
@40000000439493b92125d50c 3432 < Subject: Your Complaint^M
@40000000439493b921260fa4 3432 < Date: Sun, 4 Dec 2005 05:41:04 -0800^M
@40000000439493b92127443c 3432 < Message-ID: <058201c5f8d8$5f7625d0$
6705a8c0@labbb.org>^M
@40000000439493b9212782bc 3432 < M+
@40000000439493b92127e84c 3432 < IME-Version: 1.0^M
@40000000439493b921289814 3432 < Content-Type: multipart/alternative;^M
@40000000439493b92128d694 3432 < boundary="----=_NextPart_000_0583_01C5F895.5152E5D0"^M
@40000000439493b921291514 3432 < X-Mailer: Microsoft CDO for Exchange 2000^M
@40000000439493b921294fac 3432 < Content-Class: urn:content-classes:message^M
@40000000439493b921298a44 3432 < Importance: normal^M
@40000000439493b92129c0f4 3432 < Priority: normal^M
@40000000439493b92129fb8c 3432 < X-MimeOLE: Produced +
@40000000439493b9212a5d34 3432 < By Microsoft MimeOLE V6.00.2800.1506^M
@40000000439493b9212b052c 3432 < Return-Path:
cmpl@labbb.org^M
@40000000439493b9212b4794 3432 < X-OriginalArrivalTime: 04 Dec 2005 13:41:04.0813 (UTC) FILETIME=[5F7625D0:01C5F8D8]^M
@40000000439493b9212b8614 3432 < ^M
@40000000439493b9212bbcc4 3432 < This is a multi-part message in MIME format.^M
@40000000439493b9212bf75c 3432 < ^M
@40000000439493b9212c31f4 3432 < ------=_NextPart_000_0583_01C5F895.5152E5D0^M
@40000000439493b9212c6c8c 3432 < Content-T+
@40000000439493b9212cca4c 3432 < ype: text/plain;^M
@40000000439493b921301ddc 3432 < charset="iso-8859-1"^M
@40000000439493b9213050a4 3432 < Content-Transfer-Encoding: 7bit^M