On Fri, 04 Nov 2011 12:51:35 +0100, Nicolas BOUSSIER wrote: > Le 04/11/2011 12:00, Stevan Bajić a écrit : > >> On Fri, 04 Nov 2011 11:29:40 +0100, Nicolas BOUSSIER wrote: >>> Le 03/11/2011 22:59, Stevan Bajić a écrit : >>> >>>> On 03.11.2011 17:04, Nicolas BOUSSIER wrote: >>>>> Le 03/11/2011 14:39, Stevan Bajić a écrit : >>>>> >>>>>> On Thu, 03 Nov 2011 12:21:58 +0100, Nicolas BOUSSIER wrote: >>>>>>> Le 03/11/2011 11:19, Stevan Bajić a écrit : >>>>>>> >>>>>>>> On Thu, 03 Nov 2011 11:07:37 +0100, Nicolas BOUSSIER >>>>>>>> wrote: >>>>>>>>> Hello, >>>>>>>>> >>>>>>>> Hello Nicolas, >>>>>>>> >>>>>>>>> I have several error in my syslog as in the following >>>>>>>>> example: >>>>>>>>> >>>>>>>>> Nov 3 09:55:48 srv02 dspam[5551]: Got error -5 in response >>>>>>>>> to >>>>>>>>> message >>>>>>>>> data: 354 Start mail input; end with<CRLF>.<CRLF>#015 >>>>>>>>> >>>>>>>>> What may be the cause ? >>>>>>>>> >>>>>>>> this looks like DSPAM is sending mail to another SMTP or >>>>>>>> LMTP and >>>>>>>> is >>>>>>>> getting an error during the data submission. >>>>>>>> - Could you post your dspam.conf? >>>>>>>> - What version of DSPAM is that? (post output of: dspam >>>>>>>> --version) >>>>>>>> >>>>>>>> >>>>>>>>> N. BOUSSIER >>>>>>>>> >>>>>>> Thank for you for your response. >>>>>>> >>>>>>> Here are the informations asked : >>>>>>> >>>>>>> >>>>>>> srv02:~# dspam --version >>>>>>> >>>>>>> DSPAM Anti-Spam Suite 3.10.1 (agent/library) >>>>>>> >>>>>>> Copyright (C) 2002-2011 DSPAM Project >>>>>>> http://dspam.sourceforge.net. >>>>>>> >>>>>>> DSPAM may be copied only under the terms of the GNU Affero >>>>>>> General >>>>>>> Public >>>>>>> License, a copy of which can be found with the DSPAM >>>>>>> distribution >>>>>>> kit. >>>>>>> >>>>>>> Configuration parameters: '--prefix=/usr' >>>>>>> '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' >>>>>>> '--infodir=${prefix}/share/info' '--sysconfdir=/etc' >>>>>>> '--localstatedir=/var' '--libexecdir=${prefix}/lib' >>>>>>> '--disable-maintainer-mode' '--build=i486-linux-gnu' >>>>>>> '--host=i486-linux-gnu' '--sysconfdir=/etc/dspam' >>>>>>> '--disable-dependency-tracking' '--enable-split-configuration' >>>>>>> '--enable-static' '--enable-external-lookup' '--enable-syslog' >>>>>>> '--with-logdir=/var/log/dspam/' >>>>>>> '--with-dspam-home=/var/spool/dspam' >>>>>>> '--enable-domain-scale' >>>>>>> '--with-delivery-agent=/usr/bin/procmail' >>>>>>> '--enable-daemon' '--with-mysql-includes=/usr/include/mysql' >>>>>>> '--with-pgsql-includes=/usr/include/postgresql' >>>>>>> >>>>>>> '--with-storage-driver=hash_drv,mysql_drv,pgsql_drv,sqlite3_drv' >>>>>>> '--enable-debug' '--enable-virtual-users' >>>>>>> '--enable-preferences-extension' '--enable-clamav' >>>>>>> 'build_alias=i486-linux-gnu' 'host_alias=i486-linux-gnu' >>>>>>> 'CFLAGS=-g >>>>>>> -O2' 'LDFLAGS= -Wl,-z,defs -Wl,--as-needed' 'CPPFLAGS=' >>>>>>> >>>>>> Okay. Can you write more about your setup? How does mail >>>>>> arrive at >>>>>> DSPAM and how does DSPAM inject mail back into your >>>>>> mailflow? >>>>>> What MTA >>>>>> are you using? Do you run DSPAM in daemon mode? >>>>>> >>>>> My MTA is Postfix >>>>> >>>>> Emails are transfered from Postfix to DSPAM via Unix socket and >>>>> then >>>>> from DSPAM to DBMAIl via LMTP. >>>>> >>>>> Dspam is running as deamon >>>> Can you compile DSPAM in debug mode and post the debug log part >>>> where >>>> the error is happening? Alternatively you could use something like >>>> tcpdump to capture the communication between DSPAM and DBMAIL? >>> I think that the --enable-debug is already set, I'll try to get >>> debug >>> informations. But this error doesn't occur on each message. >>> I feel that >>> >> No. You don't need to do anything. I looked this morning quickly >> into >> the DSPAM code and it is DSPAM that has the problem. That 354 is >> coming >> directly after the DATA command and according to the RFC's it is >> considered as OK, but in DSPAM we only consider 250 codes to be >> okay. So >> definitely a bug in DSPAM. >> >> >>>> Does every mail from DSPAM to DBMAIL generate that kind of error >>>> or >>>> is >>>> it only under certain conditions? Could it be that you get the >>>> error >>>> when user do retraining? Or could it be something else? Could you >>>> try >>>> the following and post the whole output DBMAIL is producing? >>>> >>>> telnet 127.0.0.1 24 >>>> LHLO localhost >>>> MAIL FROM:<n.bouss...@network.fr> >>>> RCPT TO:<n.bouss...@network.fr> >>>> DATA >>>> To:<n.bouss...@network.fr> >>>> From:<n.bouss...@network.fr> >>>> Subject: This is just a test >>>> >>>> A simple test with DSPAM >>>> . >>>> RSET >>>> QUIT >>> This test pass without problem >>> >>> I have catch a mail that is producing the error. >>> >>> The header contain the folowing lines : >>> X-ME-engine: default >>> X-me-spamrating: 40.00 >>> X-me-spamcause: >>> >>> >>> (0)(0000)gggruggvucftvghtrhhoucdtuddrfeeffedrvdefgddtgecuteggodetufcurfhrohhfihhlvgemucfogfenuceurghilhhouhhtmecugedttdenucenucfjughrpefhvffufffkgggtofhtsehrtderpedvtdejnecuhfhrohhmpefurohvvghrihhnvggpjfgvrhgrnhcuoehsrdhhvghrrghnsehlohhgihgtohhmqdgvuhhrohhpvgdrtghomheqnecuffhomhgrihhnpehlohhgihgtohhmqdgvuhhrohhpvgdrtghomhdphhgvnhgrughighhithgrlhdrtghomhen >>> X-me-spamlevel: not-spam >>> X-ME-Entity: ofr >>> >>> If I remove the long X-me-spamcause line, then the message is >>> correctly >>> delivered >>> >>> I don't know what is that X-ME engine but it looks like dspam is >>> not >>> compatible with long header lines. >>> >> Aha. Okay. So I have to check that as well. But that 354 after >> DATA >> should show up regardless of the long line. Right? The long line >> is >> later submitted as part of the headers. >> Anyway.... that x-me-spamcause looks strange to me. Is that one >> single >> line or is this header a multiple line header? What is in front of >> "(0)(0000)"? Is there a space or an tab or is it directly at the >> beginning of the new line? If it is directly at the beginning of >> the new >> line then this header is definitely wrong and it is okay that >> DSPAM is >> barking. >> > > The line has been spliut by my mailer > > The header lineX-me-spamcause is on a single line > > X-me-spamcause: > (0)(0000)gggruggvucftvghtrhhoucdtuddrfeeffedrvdefgddtgecu... > > In another message, it's > > X-me-spamcause: > (0)(0000)gggruggvucftvghtrhhoucdtuddrfeeffedrvdegucetggdo... > The format of that line is valid. How many characters do you have in that line? Do you get any error if you transmit that whole message to DSPAM? I don't mean just transmitting it with the client or over a pipe. I mean bare communication where you open an SMTP connection with telnet to DSPAM and paste line by line the content to DSPAM. What happens after you paste that long line?
Could you send me one of those mails in raw format so that I can play around with it on my end? > Best regards > > N. BOUSSIER > -- Kind Regards from Switzerland, Stevan Bajić ------------------------------------------------------------------------------ RSA(R) Conference 2012 Save $700 by Nov 18 Register now http://p.sf.net/sfu/rsa-sfdev2dev1 _______________________________________________ Dspam-user mailing list Dspam-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/dspam-user
