Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: chris burnat on October 18, 2010, 08:45:27 AM

Title: Unknown qmail logs entries - anyone seen this before?
Post by: chris burnat on October 18, 2010, 08:45:27 AM
I am getting many such entries over past few days, not sure what it is all about. 

2010-10-18 17:25:26.697797500 delivery 5: success: Invalid_regular_expression,_offset_7_of:_^From.**.ft.com:_nothing_to_repeat/.mailfilter(33):_Syntax_error_in_/pattern/.//Invalid_regular_expression,_offset_7_of:_^From.**@uk.update.ft.com:_nothing_to_repeat/.mailfilter(58):_Syntax_error_in_/pattern/.//did_0+0+2/
2010-10-18 17:25:26.697804500 status: local 0/10 remote 0/20
2010-10-18 17:25:26.697808500 end msg 6029324

Thanks for any pointer.
Title: Re: Unknown qmail logs entries - anyone seen this before?
Post by: cactus on October 18, 2010, 01:18:52 PM
I am guessing that is the qmail log file, right? Is this the unmodified log entry?

Are you using local e-mail filtering? Did you modify anything recently?
Title: Re: Unknown qmail logs entries - anyone seen this before?
Post by: chris burnat on October 18, 2010, 01:52:05 PM
I am guessing that is the qmail log file, right? Is this the unmodified log entry?

Are you using local e-mail filtering? Did you modify anything recently?

- Yes, it is qmail.
Now the penny drops...
I am using local filtering (maildrop) and have a rule like this:

if ( /^From.**@uk.update.ft.com/ )
{
log "--------- match user rule -- "
log "--------- From *@uk.update.ft.com -- "
log " --deleted --"
log ""
exit

This mob s just hammering me.  LOL.  At least 20 mails a day.  I blocked them months ago and forgot.

Thanks Cactus.
Title: Re: Unknown qmail logs entries - anyone seen this before?
Post by: CharlieBrady on October 18, 2010, 02:00:35 PM
You are seeing error messages from your local delivery mail filtering application. Presumably there is an invalid regular expression in one of its patterns (since that is what it is telling you).
Title: Re: Unknown qmail logs entries - anyone seen this before?
Post by: cactus on October 18, 2010, 02:02:27 PM
- Yes, it is qmail.
- I do not understnd what you mean by unmodified log entry
Did you obfuscate the entry (I see some *-es) or is this the entry verbatim as it is displayed in your logfile?

- I do not understand local e-mail filtering
Are you using a contrib or a script to filter your messages on your server?

- no changes as far as I know for months
Strange... to me this indicates something local. Do you have SSH enabled and are you using simple password perhaps? It seems to me something might have changed, if you did not do it, it might perhaps be some unwanted external factor.
Title: Re: Unknown qmail logs entries - anyone seen this before?
Post by: cactus on October 18, 2010, 02:05:29 PM
if ( /^From.**@uk.update.ft.com/ )
If this is line 18 from the mailfilter file, the error is at column 7 of your regexp, which is the second *. If you try to match everything between From (starting at the beginning of the line) and @ it should read like this IMHO:
Code: [Select]
if ( /^From.*@uk.update.ft.com/ )
N.B. Nice to see I can jog your memory!
Title: Re: Unknown qmail logs entries - anyone seen this before?
Post by: chris burnat on October 18, 2010, 02:45:34 PM
Charlie and Cactus, thanks for your time.  I use a contrib to filter, and this contrib was updated a month or so ago AFAI can recall. I will flag some possible minor error to the author.  At leadst now I know what is happening, just got jolted when I seen this in my logs, did not ring a bell. Thanks again. All good.
Title: Re: Unknown qmail logs entries - anyone seen this before?
Post by: CharlieBrady on October 18, 2010, 05:06:30 PM
If this is line 18 from the mailfilter file, the error is at column 7 of your regexp, which is the second *. If you try to match everything between From (starting at the beginning of the line) and @ it should read like this IMHO:
Code: [Select]
if ( /^From.*@uk.update.ft.com/ )

No, you want \@ where @ appears. Hence:

Code: [Select]
if ( /^From.*\@uk.update.ft.com/ )
Title: Re: Unknown qmail logs entries - anyone seen this before?
Post by: cactus on October 18, 2010, 07:02:30 PM
No, you want \@ where @ appears. Hence:

Code: [Select]
if ( /^From.*\@uk.update.ft.com/ )
Yes, you're right, thanks for drawing our attention.On second thought I think you might be wrong. I have seen a lot of regexp's but AFAICT the @ sign has no special meaning and does not need to be escaped. I also do not see them in the examples in this cheatsheet: http://www.addedbytes.com/cheat-sheets/regular-expressions-cheat-sheet/
Title: Re: Unknown qmail logs entries - anyone seen this before?
Post by: CharlieBrady on October 18, 2010, 07:32:20 PM
I stand corrected. It's in perl variable assignments that @ should be escapted, e.g.:

my $re = "From.*\@uk.update.ft.com";
Title: Re: Unknown qmail logs entries - anyone seen this before?
Post by: janet on October 18, 2010, 11:42:07 PM
CharlieBrady

Quote
I stand corrected....

Sorry couldn't resist this. Charlie is usually right, most of the time, although moreso than some others on this forum ! giggle :-)