On Fri, 04 Nov 2011 11:29:40 +0100, Nicolas BOUSSIER wrote: > Le 03/11/2011 22:59, Stevan Bajić a écrit : > >> On 03.11.2011 17:04, Nicolas BOUSSIER wrote: >>> Le 03/11/2011 14:39, Stevan Bajić a écrit : >>> >>>> On Thu, 03 Nov 2011 12:21:58 +0100, Nicolas BOUSSIER wrote: >>>>> Le 03/11/2011 11:19, Stevan Bajić a écrit : >>>>> >>>>>> On Thu, 03 Nov 2011 11:07:37 +0100, Nicolas BOUSSIER wrote: >>>>>>> Hello, >>>>>>> >>>>>> Hello Nicolas, >>>>>> >>>>>>> I have several error in my syslog as in the following example: >>>>>>> >>>>>>> Nov 3 09:55:48 srv02 dspam[5551]: Got error -5 in response to >>>>>>> message >>>>>>> data: 354 Start mail input; end with<CRLF>.<CRLF>#015 >>>>>>> >>>>>>> What may be the cause ? >>>>>>> >>>>>> this looks like DSPAM is sending mail to another SMTP or >>>>>> LMTP and >>>>>> is >>>>>> getting an error during the data submission. >>>>>> - Could you post your dspam.conf? >>>>>> - What version of DSPAM is that? (post output of: dspam >>>>>> --version) >>>>>> >>>>>> >>>>>>> N. BOUSSIER >>>>>>> >>>>> Thank for you for your response. >>>>> >>>>> Here are the informations asked : >>>>> >>>>> >>>>> srv02:~# dspam --version >>>>> >>>>> DSPAM Anti-Spam Suite 3.10.1 (agent/library) >>>>> >>>>> Copyright (C) 2002-2011 DSPAM Project >>>>> http://dspam.sourceforge.net. >>>>> >>>>> DSPAM may be copied only under the terms of the GNU Affero >>>>> General >>>>> Public >>>>> License, a copy of which can be found with the DSPAM distribution >>>>> kit. >>>>> >>>>> Configuration parameters: '--prefix=/usr' >>>>> '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' >>>>> '--infodir=${prefix}/share/info' '--sysconfdir=/etc' >>>>> '--localstatedir=/var' '--libexecdir=${prefix}/lib' >>>>> '--disable-maintainer-mode' '--build=i486-linux-gnu' >>>>> '--host=i486-linux-gnu' '--sysconfdir=/etc/dspam' >>>>> '--disable-dependency-tracking' '--enable-split-configuration' >>>>> '--enable-static' '--enable-external-lookup' '--enable-syslog' >>>>> '--with-logdir=/var/log/dspam/' >>>>> '--with-dspam-home=/var/spool/dspam' >>>>> '--enable-domain-scale' '--with-delivery-agent=/usr/bin/procmail' >>>>> '--enable-daemon' '--with-mysql-includes=/usr/include/mysql' >>>>> '--with-pgsql-includes=/usr/include/postgresql' >>>>> '--with-storage-driver=hash_drv,mysql_drv,pgsql_drv,sqlite3_drv' >>>>> '--enable-debug' '--enable-virtual-users' >>>>> '--enable-preferences-extension' '--enable-clamav' >>>>> 'build_alias=i486-linux-gnu' 'host_alias=i486-linux-gnu' >>>>> 'CFLAGS=-g >>>>> -O2' 'LDFLAGS= -Wl,-z,defs -Wl,--as-needed' 'CPPFLAGS=' >>>>> >>>> Okay. Can you write more about your setup? How does mail >>>> arrive at >>>> DSPAM and how does DSPAM inject mail back into your mailflow? >>>> What MTA >>>> are you using? Do you run DSPAM in daemon mode? >>>> >>> My MTA is Postfix >>> >>> Emails are transfered from Postfix to DSPAM via Unix socket and >>> then >>> from DSPAM to DBMAIl via LMTP. >>> >>> Dspam is running as deamon >> Can you compile DSPAM in debug mode and post the debug log part >> where >> the error is happening? Alternatively you could use something like >> tcpdump to capture the communication between DSPAM and DBMAIL? > I think that the --enable-debug is already set, I'll try to get debug > informations. But this error doesn't occur on each message. > I feel that > No. You don't need to do anything. I looked this morning quickly into the DSPAM code and it is DSPAM that has the problem. That 354 is coming directly after the DATA command and according to the RFC's it is considered as OK, but in DSPAM we only consider 250 codes to be okay. So definitely a bug in DSPAM.
>> >> Does every mail from DSPAM to DBMAIL generate that kind of error or >> is >> it only under certain conditions? Could it be that you get the error >> when user do retraining? Or could it be something else? Could you >> try >> the following and post the whole output DBMAIL is producing? >> >> telnet 127.0.0.1 24 >> LHLO localhost >> MAIL FROM:<n.bouss...@network.fr> >> RCPT TO:<n.bouss...@network.fr> >> DATA >> To:<n.bouss...@network.fr> >> From:<n.bouss...@network.fr> >> Subject: This is just a test >> >> A simple test with DSPAM >> . >> RSET >> QUIT > > This test pass without problem > > I have catch a mail that is producing the error. > > The header contain the folowing lines : > X-ME-engine: default > X-me-spamrating: 40.00 > X-me-spamcause: > > (0)(0000)gggruggvucftvghtrhhoucdtuddrfeeffedrvdefgddtgecuteggodetufcurfhrohhfihhlvgemucfogfenuceurghilhhouhhtmecugedttdenucenucfjughrpefhvffufffkgggtofhtsehrtderpedvtdejnecuhfhrohhmpefurohvvghrihhnvggpjfgvrhgrnhcuoehsrdhhvghrrghnsehlohhgihgtohhmqdgvuhhrohhpvgdrtghomheqnecuffhomhgrihhnpehlohhgihgtohhmqdgvuhhrohhpvgdrtghomhdphhgvnhgrughighhithgrlhdrtghomhen > X-me-spamlevel: not-spam > X-ME-Entity: ofr > > If I remove the long X-me-spamcause line, then the message is > correctly > delivered > > I don't know what is that X-ME engine but it looks like dspam is not > compatible with long header lines. > Aha. Okay. So I have to check that as well. But that 354 after DATA should show up regardless of the long line. Right? The long line is later submitted as part of the headers. Anyway.... that x-me-spamcause looks strange to me. Is that one single line or is this header a multiple line header? What is in front of "(0)(0000)"? Is there a space or an tab or is it directly at the beginning of the new line? If it is directly at the beginning of the new line then this header is definitely wrong and it is okay that DSPAM is barking. > Best regards > > N. BOUSSIER > > > >> >>> N. BOUSSIER >>> > > -- Kind Regards from Switzerland, Stevan Bajić ------------------------------------------------------------------------------ RSA(R) Conference 2012 Save $700 by Nov 18 Register now http://p.sf.net/sfu/rsa-sfdev2dev1 _______________________________________________ Dspam-user mailing list Dspam-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/dspam-user
