Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: Stuart on January 11, 2010, 07:14:43 AM

Title: Same legitimate mail every 15 minutes.
Post by: Stuart on January 11, 2010, 07:14:43 AM

I have one email hitting our server every 15 minutes.  It is accepted and delivered.  It is not spam although it is tagged as it scores 5.3/5.0

The current log does not show the following lines for this mail .

Code: [Select]

dispatching QUIT
221 domain.com closing connection. Have a wonderful day.
Any idea what's going on here?

Title: Re: Same legitimate mail every 15 minutes.
Post by: CharlieBrady on January 12, 2010, 04:53:22 AM

You haven't given us much to go on.

One possibility is that the sending server is disconnecting (or losing its connection) before it gets the "delivered OK" 2XX status back from SME server. Hence it resends later (as it should).

There's nothing you can do to stop it trying to send again (short of contacting the admin of the sending server, and asking for the message to be deleted from the remote queue).

Your log files probably tell you more than you are telling us.

Title: Re: Same legitimate mail every 15 minutes.
Post by: Stuart on January 12, 2010, 05:03:38 AM

Thanks, here is one instance from the current log.  Which other logs should I log at to help with this?  I have changed the spam tagging level to 6.0 to let this one go through as ham.  It still repeats.

Code: [Select]

@400000004b4abb32131110bc 21478 Accepted connection 0/40 from 127.0.0.200 / Unknown
@400000004b4abb32131ca1ac 21478 Connection from Unknown [127.0.0.200]
@400000004b4abb3315913f74 21478 check_earlytalker plugin: remote host said nothing spontaneous, proceeding
@400000004b4abb3315e41a64 21478 220 mail.mydomain.com ESMTP
@400000004b4abb3315ef1eb4 21478 dispatching EHLO localhost
@400000004b4abb33163db7cc 21478 250-mydomain.com Hi Unknown [127.0.0.200]
@400000004b4abb331644d034 21478 250-PIPELINING
@400000004b4abb33164bc574 21478 250-8BITMIME
@400000004b4abb33165293a4 21478 250 SIZE 15000000
@400000004b4abb33165f8424 21478 dispatching MAIL FROM:<xxxx@xxxx.xxx> SIZE=470100
@400000004b4abb33166d246c 21478 full from_parameter: FROM:<xxxx@xxxx.xxx> SIZE=470100
@400000004b4abb33167aefac 21478 from email address : [<xxxx@xxxx.xxx>]
@400000004b4abb3319e1e484 21478 getting mail from <xxxx@xxxx.xxx>
@400000004b4abb3319ea02a4 21478 250 <xxxx@xxxx.xxx>, sender OK - how exciting to get mail from you!
@400000004b4abb3319f758b4 21478 dispatching RCPT TO:<recipient@mydomain.com>
@400000004b4abb331a0579e4 21478 to email address : [<recipient@mydomain.com>]
@400000004b4abb331a63e5c4 21478 check_goodrcptto plugin: stripping '-' extensions
@400000004b4abb331ae9c734 21478 250 <recipient@mydomain.com>, recipient ok
@400000004b4abb331af6948c 21478 dispatching DATA
@400000004b4abb331b03a834 21478 354 go ahead
@400000004b4abb331c19a444 21478 spooling message to disk
@400000004b4abb7c25f093ec 21478 spamassassin plugin: check_spam: Yes, hits=5.3, required=5.0, tests=EXTRA_MPART_TYPE,HTML_IMAGE_RATIO_02,HTML_MESSAGE,MY_CID_AND_STYLE,RCVD_IN_PBL,RCVD_IN_SORBS_DUL,RDNS_NONE
@400000004b4abb7c2679ccd4 21478 virus::clamav plugin: Changing permissions on file to permit scanner access
@400000004b4abb7d0ba59334 21478 virus::clamav plugin: clamscan results: /var/spool/qpsmtpd/1263188777:21478:0: OK
@400000004b4abb7d0c3f8d2c 21478 logging::logterse plugin: ` 127.0.0.200 Unknown localhost <xxxx@xxxx.xxx> <recipient@mydomain.com> queued <4D9A7A8F0F0E454DA6A5F55E4773BCCF@MarlsLaptop> Yes, hits=5.3 required=5.0_
@400000004b4abb7d0c3fb054 21688 queue::qmail_2dqueue plugin: (for 21478 ) Queuing qp 21688 to /var/qmail/bin/qmail-queue
@400000004b4abb7d21475efc 21478 250 Queued! 1263188851 qp 21688 <4D9A7A8F0F0E454DA6A5F55E4773BCCF@MarlsLaptop>
@400000004b4abb7e1462f0d4 4544 cleaning up after 21478


Title: Re: Same legitimate mail every 15 minutes.
Post by: Stuart on January 12, 2010, 07:32:21 AM

O.K. so I disabled the antivirus and spam filtering, let the message through, enabled antivirus and spam filtering and the 2xx was sent and the message no longer haunts our server.  Weird.