At 7:39 PM -0700 4/22/01, Brian Findlay wrote:
>First question - Why does the log repeatedly declare the date - as in the
>first line?
No idea. My guess would be that it helps to identify log files which have
been renamed, and saves room (rather than putting the date on every line).
>Second question - What does the second column represent? Status code?
>Error
>code? Is there a list that 'decodes the codes'?
Message level; it's a message that shows up only if you have logging set
to this level or higher.
>Third question - I am assuming that this log entry is telling me that this
>message was received from the server 'relay1.bt.net'. If so, then how can
>I
>configure SIMS to reject known SPAM relay servers?. Why on earth would
>anyone set up a spam relay? Why would they NAME it 'relay1'!!???
Some large networks set up "relay" servers to handle e-mail that's going
outside their network; I can only assume that this is what BT is doing.
>Fourth question - What does the log code <00004f946ea8$00007480$000069d3@>
>0+1 on the third line indicate? This is pretty indecipherable stuff.
That's what the sender declared the message-ID to be. It's fairly obviously
bogus.
>Fifth question - How can a message be to 'undisclosed recipients' yet still
>be delivered to my account? It wasn't spammed around to all accounts on my
>server, just one. If the message is TO an address, how can the TO bit be
>blocked, and yet the message still be deliverable???
Because (and this is a FAQ) what's in the message header really doesn't
matter; what's in the envelope (meaning the argument of the SMTP "RCPT TO"
command) is what controls where the message really goes. They don't have
to have anything whatsoever to do with each other.
>Have been running SIMS for four years now, and it does it's job very well.
>However, I am beginning to take a more active interest in what the logs are
>actually telling me, and frankly - they are not telling me much!! I have
>perused the 'logs' area on the stalker/sims site, but it doesn't shed much
>light for me either. Any insights would be appreciated.
It would probably be more helpful to examine the headers on this one; with
any luck, BT send along the trace information so that you can send this
one back to them and have them stomp on the individual in question. In
this case, however, the logs aren't going to tell you much more.
(BTW: what level logging do you have set?)
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
