I've been seeing many messages, perhaps 20 a day, that are truncated.
Essentially they contain no body.  One thing I have found in common is
a strange value for X-Message-Info:

The following is an example

Received: from mailgate-external1.sri.com (mailgate-external1.SRI.COM 
[128.18.85.101])
        by quarter.csl.sri.com (8.12.9/8.12.10) with SMTP id i4KJkpG4006035
        for <[EMAIL PROTECTED]>; Thu, 20 May 2004 12:46:51 -0700
Date: Thu, 20 May 2004 12:46:51 -0700
From: [EMAIL PROTECTED]
Message-Id: <[EMAIL PROTECTED]>
Received: (qmail 28701 invoked from network); 20 May 2004 19:46:50 -0000
Received: from localhost (HELO mailgate-external1.SRI.COM) (127.0.0.1)
  by mailgate-external1.sri.com with SMTP; 20 May 2004 19:46:50 -0000
Received: from ool-18b8e932.dyn.optonline.net ([24.184.233.50])
 by mailgate-external1.SRI.COM (SAVSMTP 3.1.2.35) with SMTP id 
M2004052012464925499
 for <[EMAIL PROTECTED]>; Thu, 20 May 2004 12:46:49 -0700
X-Message-Info: J[1


and another

Received: from mailgate-internal1.sri.com (mailgate-internal1.SRI.COM 
[128.18.84.103])
        by quarter.csl.sri.com (8.12.9/8.12.10) with SMTP id i4K6jtG4014532
        for <[EMAIL PROTECTED]>; Wed, 19 May 2004 23:45:55 -0700
Received: (qmail 10712 invoked from network); 20 May 2004 06:45:55 -0000
Received: from localhost (HELO mailgate-internal1.SRI.COM) (127.0.0.1)
  by mailgate-internal1.sri.com with SMTP; 20 May 2004 06:45:55 -0000
Received: from newmail.sri.com ([128.18.30.43])
 by mailgate-internal1.SRI.COM (SAVSMTP 3.1.2.35) with SMTP id 
M2004051923454924558
 for <[EMAIL PROTECTED]>; Wed, 19 May 2004 23:45:49 -0700
Received: from mailgate-external2.sri.com
 (mailgate-external2.SRI.COM [128.18.85.102])
 by newmail.sri.com (iPlanet Messaging Server 5.2 HotFix 1.25 (built Mar  3
 2004)) with SMTP id <[EMAIL PROTECTED]> for [EMAIL PROTECTED]
 (ORCPT [EMAIL PROTECTED]); Wed, 19 May 2004 23:45:49 -0700 (PDT)
Received: (qmail 9098 invoked from network); Thu, 20 May 2004 06:45:48 +0000
Received: from localhost (HELO mailgate-external2.SRI.COM) (127.0.0.1)
 by mailgate-external2.sri.com with SMTP; Thu, 20 May 2004 06:45:48 +0000
Received: from a124112.upc-a.chello.nl ([62.163.124.112])
 by mailgate-external2.SRI.COM (SAVSMTP 3.1.2.35)
 with SMTP id M2004051923445821905 ; Wed, 19 May 2004 23:45:36 -0700
Date: Wed, 19 May 2004 23:45:49 -0700 (PDT)
Date-warning: Date header was inserted by newmail.sri.com
From: [EMAIL PROTECTED]
Message-id: <[EMAIL PROTECTED]>
X-Message-Info: U953VP39QEF3onrGKBnkkHLP4[1


Here are the rules I wrote to catch these.  The value of X-Message-Info
so far always appears to end in '[1'

Perhaps these will be useful to someone.

header   __CSL_X_MESSAGE_INFO           X-Message-Info =~ /^[A-Z]\[1$/
header   __CSL_X_MESSAGE_INFO_2         X-Message-Info =~ /^[A-Z0-9]{2,25}\[1$/i
meta     CSL_X_MESSAGE_INFO                     (__CSL_X_MESSAGE_INFO || 
__CSL_X_MESSAGE_INFO_2)
describe CSL_X_MESSAGE_INFO                     X-Message-Info: strange value
score    CSL_X_MESSAGE_INFO             2.0

  - Mike Hogsett

Reply via email to