On 11/8/2013 6:59 AM, emailitis.com wrote:
Thank you and Benny for your help.
I put those in place and all looks well. We had one captured this
morning but wondered if you can explain in the log below which seems
as if it has been deleted, yet then allowed:
Nov 8 10:05:04 plesk3 spamd[11926]: spamd: result: Y 9 -
*AEXP_ALL*,DCC_CHECK,RCVD_IN_HOSTKARMA_BL,UNPARSEABLE_RELAY
scantime=0.7,size=18986,user=qscand,uid=10002,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=47
653,mid=<shov1hc5576j48ym3pyut8fb2ak1d...@gateway.gov.local>,autolearn=disabled
Nov 8 10:05:04 plesk3 qmail-scanner-queue.pl: qmail-scanner[18522]:
SA:*SPAM-DELETED*:RC:0(41.215.42.242):SA:1(9.1/5.0): 0.874234 18933
gateway.confirmat...@gateway.gov.uk u...@domain.com
Could_not_process_Online_Submission_for_Reference_475/RA1997980
<shov1hc5576j48ym3pyut8fb2ak1d...@gateway.gov.local>
Submission_RA1997980.zip:10086
Nov 8 10:05:04 plesk3 spamdyke[18489]: *ALLOWED*from:
gateway.confirmat...@gateway.gov.uk to: u...@domain.com origin_ip:
41.215.42.242 origin_rdns: mail.domain.com auth: (unknown) encryption:
(none) reason: 250_ok_1383905104_qp_18522
Can't really help you with that one. Spamd marked it as spam. Then it
looks like qmail-scanner-queue.pl deleted it. And then spamdyke allowed it.
I'm not familiar with either qmail-scanner-queue.pl or spamdyke, so I
don't know how they work or exactly how to interpret their log entries.
I'm assuming the spamdyke entry is referring to the same message, but
I'm not sure since that log line doesn't give the message id.
There is something in the qmail-scanner-queue.pl line that says
"Could_not_process_Online_Submission_for_Reference_475/RA1997980". That
might be relevant.
--
Bowie
