XMailforum is a readonly knowledge archive now.

Registering as a new user or answering posts is not possible anymore.

Might the force be with you, to find here what you are looking for.

2019-09-20 - hschneider, Admin

Cookie Disclaimer: This forum uses only essential, anonymous session cookies (xmailforum*), nothing to be scared of.

XMail Forum [Powered by Invision Power Board]
Printable Version of Topic
Click here to view this topic in its original format
XMail Forum > XMail Queue Manager > Xqm Diagnosis Extention


Posted by: sergioperr Jan 20 2005, 01:33 PM

Hi, Harald !

I couldnīt live without XQM: itīs my primary tools each day to control my Xmail 1.21īs servers.
I use the filtering feature, and usually a message is freezed by them.
But the 'Diagnosis' column from XQM say "User unknown" as the cause of rejection by Xmail. I know the rejection is due to filters, of course, but it would be very handy to get a message like "Rejected by server filters" or something else.

Can I configure something to do that?

Thanks.


Sergio Perrone

master.gif

Posted by: hschneider Jan 20 2005, 05:46 PM
You can and it's simple ;-)

Just open "Xmail Queue Manager\parse.lib" with your favourite ASCII editor and read the instructions there:

QUOTE

# This is the Message Analyzer's brainfile.
# It defines a set of pattern matching filters, which are used to classify
# (or to tag) the analyzed messages.
#
# If you want to use your own definitions, create a file named
# parse_usr.lib in XQM's home directory.
# Your own defs will overload the defs in this file.
# User defs won't be overwritten by XQM updates.
#
# Structure:
# Variable (case sensitive) : Regular Expression : Result Code (NEWLINE)
#
# A variable can be any SLOG file variable like ErrString, SMTP-Error etc.
# SLOG variables are always built from the latest SLOG entry. Additional
# variables are:
#
# Spoolfile.slog      = The complete SLOG file
# Spoolfile.lastslog  = The latest SLOG entry
# Spoolfile.content  = The complete spoolfile
# Spoolfile.envelope  = Its envelope only
# Spoolfile.header    = Its header only
# Spoolfile.body      = Its message content only
#
# The RegEx are compared to the variable's content. If they match,
# the result code is returned. Each filter is applied after each other.
# Filtering stops on the 1st match.
#
# For more infos about RegEx syntax see
# http://python.org/doc/current/lib/re-syntax.html
#
# When you use remote queue management, the parselib files are beamed to the
# Agent during XMail's first contact. Analyzing requires an Agent >= 1.12.
# You can verify the Agent's version in XQM's about dialog.
#
__VERSION:parse.lib:1.22
Spoolfile.header:X-Spam-Flag.*?YES:SPAMASSASSIN
Spoolfile.envelope:mail from.*?<CronDaemon>.*?rcpt to.*?<root>:NODOMAIN_CRON
ErrInfo:RTR.?DU:ANTISPAM_DYNIP
ErrInfo:!(mailbox).*?try.*?later|busy|service not available:SERVER_OVERLOAD
...
...


Posted by: sergioperr Jan 21 2005, 12:26 AM
Excellent !!!

Thanks a lot, Harald.

Sergio

image008.gif

Posted by: hschneider Jan 21 2005, 10:25 AM
You can also customize its diagnosis text. If your custom tag is e.g. FILTERED, then place an ASCII file named FILTERED.txt in the "XMail Queue Manager\kbase" folder.

If you have any improvements for existing rules or some new rules which are of public interest, please let me know.

Posted by: sergioperr Jan 24 2005, 01:00 AM
OK:

Iīm doing some definitions to explain Filter Rejects, and AV filter rejects.
Where can I find information about SLOG entries and logic?

Sergio

read.gif

Posted by: hschneider Jan 24 2005, 07:47 AM
Examine existing SLOG files of frozen messages.
All which XQM does, is to read these entries into variables, which can be checked against the patterns from its parse.lib.

If a pattern matches, the message is classifed (tagged).

There is a chapter ("Inspector") in XQM's helpfile, which explains like SLOG entries are built up and how to interprete them.

Posted by: sergioperr Feb 2 2005, 02:24 PM
Harald:

After many days working with 'parse.lib' and 'parse.usr.lib', I have my XQM diagnosing correctly the messages frozen due to content filters and AV filters.
BUT (always thereīs a 'but'), I had to modify the 'parse.lib' file.

nono.gif I know, I know: the user shouldnīt modify that file.

The problem is the definition of the 'ANTISPAM' rule. It includes strings like 'reject' and 'message' BEFORE 'parse.usr.lib' reach them. Then, XQM applies the 'ANTISPAM' rule instead of the new ones.

blink.gif Solution?

I think thereīs two possible:
1. The 'parse.usr.lib' should be the first aplied (before 'parse.libī)
2. Modify 'parse.lib' (You should): but this will be a temporal solution, since with another change in Xmail, the file will need another update.

Sergio

Posted by: hschneider Feb 2 2005, 03:51 PM
The file has to be named parse_usr.lib, not parse.usr.lib. The mechanism still gives priority to the userlib. Can you test again, please ?

Posted by: hschneider Feb 2 2005, 04:02 PM
I'll add a hint if parse_user.lib is loaded or not in XQM's info dialog. Will be useful in such situation.

Posted by: sergioperr Feb 2 2005, 04:10 PM
Ok:
Iīll try.
Sorry for my mistake. Iīll let you know when finish (soon) and Iīll send you the new definitions.

Sergio
blush.gif

Posted by: sergioperr Feb 4 2005, 07:34 PM
Harald:

Now I have another problem.
As a filter (eg: xscanner) or avfilter stops a message, Xmail frozes it (if you setup this) but does not write any cue in SLOG file.
I canīt find a way to scan something to evaluate a expression and make XQM diagnose this kind of events.
I know Xmail does a filter.log writing but I canīt scan it from XQM.

Another question:
Actually, XQM shows the diagnosis for my frozen messages as "DNS": this is the default behaviour? Why XQM chooses DNS without any information in SLOG files?

Thank you

unsure.gif
Sergio


Posted by: hschneider Feb 5 2005, 08:03 AM
To examine the messagefile itself, you have:
# Spoolfile.slog = The complete SLOG file
# Spoolfile.lastslog = The latest SLOG entry
# Spoolfile.content = The complete spoolfile
# Spoolfile.envelope = Its envelope only
# Spoolfile.header = Its header only
# Spoolfile.body = Its message content only

If your filter writes an X-Header, then it should be no problem to identify.

Messages without slog should be tagged as unknown.
Could you send me your zipped spool folder, please ?


Powered by Invision Power Board (http://www.invisionboard.com)
© Invision Power Services (http://www.invisionpower.com)