Another bug in XQM 1.38

I have this SLOG:
----------------
[PeekTime] 1066384512 : Fri, 17 Oct 2003 11:55:12 +0200
<<
ErrCode = -82
ErrString = [RCPT TO:] not permitted by remote SMTP server
ErrInfo = 552 5.2.2 Not enough space, only 0 bytes available for info@cinemalecabieu.com
SMAIL SMTP-Send MX = "pop2.allnet.fr." SMTP = "me.homelinux.net" From = "postmaster@stupar.homelinux.net" To = "info@cinemalecabieu.com" Failed !
SMTP-Error = "552 5.2.2 Not enough space, only 0 bytes available for info@cinemalecabieu.com"
SMTP-Server = "pop2.allnet.fr."
>>
----------------
Normaly this would be a QUOTA diagnosed but it is not:
--------------
RELAY_DENIED

Possible reasons:
- A general problem with the recipient's address
- You run XMail from an dynamic IP address range or
- there is no domain name assigned to your IP address or
- your relay is assumed as open or
- you or your ISP are blacklisted in some antispam or open relay database.
In that case search the SLOG for details about the blacklisting
service and see if it is possible to clear your entry from that list.
...
----------------

Any idea?

Thanks! That's why I made a public call to send me wrong or unparsed SLOGs. Only this way I can make the analyzer more accurate.

parse.lib update attached, pls test.



Attached File ( Number of downloads: 221 )
 parse.lib

No, still wrong diagnose.

Here is another one new:
-------------
[PeekTime] 1066523131 : Sun, 19 Oct 2003 02:25:31 +0200
<<
ErrCode = -82
ErrString = [RCPT TO:] not permitted by remote SMTP server
ErrInfo = 550 5.7.1 <dale@cubcodoors.com>... Cannot mail directly to files
SMAIL SMTP-Send MX = "mail.cubcodoors.com." SMTP = "me.homelinux.net" From = "postmaster@stupar.homelinux.net" To = "dale@cubcodoors.com" Failed !
SMTP-Error = "550 5.7.1 <dale@cubcodoors.com>... Cannot mail directly to files"
SMTP-Server = "mail.cubcodoors.com."
>>
-------------
Diagnosed RELAY_DENIED

And another wrong diagnose:
---------
[PeekTime] 1066522528 : Sun, 19 Oct 2003 02:15:28 +0200
<<
ErrCode = -82
ErrString = [RCPT TO:] not permitted by remote SMTP server
ErrInfo = 552 RCPT TO:<tore.johanesen@tiscali.no> Mailbox disk quota exceeded
SMAIL SMTP-Send MX = "cpmail.dk.tiscali.com." SMTP = "me.homelinux.net" From = "postmaster@stupar.homelinux.net" To = "tore.johanesen@tiscali.no" Failed !
SMTP-Error = "552 RCPT TO:<tore.johanesen@tiscali.no> Mailbox disk quota exceeded"
SMTP-Server = "cpmail.dk.tiscali.com."
>>
------------
Diagnosed as USER_UKNOWN

Another one:
--------
[PeekTime] 1066602148 : Mon, 20 Oct 2003 00:22:28 +0200
<<
ErrCode = -81
ErrString = [MAIL FROM:] not permitted by remote SMTP server
ErrInfo = 550 Access denied
SMAIL SMTP-Send FF = "online.no" SMTP = "me.homelinux.net" From = "postmaster@stupar.homelinux.net" To = "oddlas@online.no" Failed !
SMTP-Error = "550 Access denied"
SMTP-Server = "online.no"
>>
---------
diagnosed as RELAY_DENIED

According to your 1st mail:

>No, still wrong diagnose.

Are you sure you copied the parse.lib to the correct place? The diagnosis is QUOTA now, which is correct. Please verify parse.lib version in the Info dialog. Should be 1.14

This diag is OK.

The rest is fixed in parse.lib 1.15. Thanks again!

Attached File ( Number of downloads: 206 )
 parse.lib

kbase update attached. Unpack this to XQM's home folder.

Attached File ( Number of downloads: 277 )
 kbase.zip

I have updated to 1.15 parse lib and also kbase but here is a new one:
-----------
[PeekTime] 1066653710 : Mon, 20 Oct 2003 14:41:50 +0200
<<
ErrCode = -82
ErrString = [RCPT TO:] not permitted by remote SMTP server
ErrInfo = 552 RCPT TO:<tore.johanesen@tiscali.no> Mailbox disk quota exceeded
SMAIL SMTP-Send MX = "cpmail.dk.tiscali.com." SMTP = "me.homelinux.net" From = "postmaster@stupar.homelinux.net" To = "tore.johanesen@tiscali.no" Failed !
SMTP-Error = "552 RCPT TO:<tore.johanesen@tiscali.no> Mailbox disk quota exceeded"
SMTP-Server = "cpmail.dk.tiscali.com."
>>
-----------
Diagnosed as USER_UKNOWN

Hmmm .. this gives a QUOTA diagnosis on my machine. Is this the very last SLOG entry in the SLOG list ?
Pls mail the complete SLOG file.

Yep, this is the first and the last SLOG entry.

Can't track this .. :-/

Pls mail the original slog file, maybe there are some chars which influence parsing ...

Her is spool:
---------
127.0.0.1:42016;127.0.0.1:25;Mon, 20 Oct 2003 14:41:50 +0200
me.homelinux.net
SEAF7
MAIL FROM: <postmaster@stupar.homelinux.net>
RCPT TO:<tore.johanesen@tiscali.no>
<<MAIL-DATA>>
X-AV-Scanned: YES 2acb0ad5dda3ef3895e72565aec24828
Received: from mig29 (127.0.0.1:42016)
by me.homelinux.net (127.0.0.1:25) with [XMail 1.17 (Linux/Ix86) ESMTP Server]
id <SEAF7> for <tore.johanesen@tiscali.no> from <postmaster@stupar.homelinux.net>;
Mon, 20 Oct 2003 14:41:50 +0200
Subject: ! WARNING ! - Virus found in email
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
X-Mailer: AV-Filter 1.7
To: tore.johanesen@tiscali.no
Content-Transfer-Encoding: quoted-printable
Date: Mon, 20 Oct 2003 14:41:49 +0200
From: postmaster@stupar.homelinux.net

Hello,

Mail from your system (may be forged) to sasa@stupar.homelinux.net was dete=
cted
to contain one or more viruses. This mail has been deleted from our
server and was not sent to the recipient. You will find the message
headers below in this message.

Virus detected: W32/Swen.A@mm


Thanks,
Postmaster - postmaster@stupar.homelinux.net

---------------------------------------------------------------------

Here below you will find the headers of the message :

--- BEGIN MESSAGE HEADER ---

Received: from smtp210.tiscali.dk (62.79.79.113:62495)
by me.homelinux.net (192.168.10.111:25) with [XMail 1.17 (Linux/Ix86) ESMT=
P Server]
id <SEAF6> for <sasa@stupar.homelinux.net> from <tore.johanesen@tiscali.no=
>;
Mon, 20 Oct 2003 14:41:48 +0200
Received: from cpmail.dk.tiscali.com (mail.tiscali.dk [212.54.64.159])
by smtp210.tiscali.dk (8.12.6p3/8.12.6) with ESMTP id h9KCXiGT022600;
Mon, 20 Oct 2003 14:33:48 +0200 (CEST)
(envelope-from tore.johanesen@tiscali.no)
Received: from pewaad (213.142.74.98) by cpmail.dk.tiscali.com (6.7.018)
id 3F7D328700005017; Mon, 20 Oct 2003 14:33:41 +0200
Date: Mon, 20 Oct 2003 14:33:41 +0200 (added by postmaster@cpmail.dk.tiscal=
i.com)
Message-ID: <3F7D328700005017@cpfe5.be.tisc.dk> (added by postmaster@cpmail=
..dk.tiscali.com)
FROM: "Email Delivery System" <gmailautomat@bigfoot.com>
TO: "Internet Receiver" <user@maildomain.net>
SUBJECT: Mail: User unknown
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary=3D"aimwzpn"



--- END MESSAGE HEADER ---

--------------------------------------------------------------------

Here bellow you will find scanner report:

--- BEGIN SCANNER REPORT ---

Virus scanning report - 20 October 2003 @ 14:41

F-PROT ANTIVIRUS
Program version: 4.3.1
Engine version: 3.14.7

VIRUS SIGNATURE FILES
SIGN.DEF created 17 October 2003
SIGN2.DEF created 17 October 2003
MACRO.DEF created 13 October 2003

Search: /tmp/bb9ba2189d2d26f5.scan//1066653709.8141-0.mig29 /tmp/bb9ba2189d=
2d26f5.scan//ferglp.exe
Action: Report only
Files: Attempt to identify files
Switches: -ARCHIVE

/tmp/bb9ba2189d2d26f5.scan/ferglp.exe Infection: W32/Swen.A@mm

Results of virus scanning:

Files: 2
MBRs: 0
Boot sectors: 0
Objects scanned: 2
Infected: 1
Suspicious: 0
Disinfected: 0
Deleted: 0
Renamed: 0

Time: 0:00


--- END SCANNER REPORT ---

*********************************************************************

Pozdravljen(a),

Sporocilo iz vasega sistema za sasa@stupar.homelinux.net je vsebovalo enega=
ali vec
virusov in je bilo izbrisano iz nasega streznika. Spodaj si lahko ogledate
glavo sporocila.

Najden virus: W32/Swen.A@mm


Hvala,
Postmaster - postmaster@stupar.homelinux.net

---------------------------------------------------------------------

Tukaj je glava sporocila:

--- ZACETEK ---

Received: from smtp210.tiscali.dk (62.79.79.113:62495)
by me.homelinux.net (192.168.10.111:25) with [XMail 1.17 (Linux/Ix86) ESMT=
P Server]
id <SEAF6> for <sasa@stupar.homelinux.net> from <tore.johanesen@tiscali.no=
>;
Mon, 20 Oct 2003 14:41:48 +0200
Received: from cpmail.dk.tiscali.com (mail.tiscali.dk [212.54.64.159])
by smtp210.tiscali.dk (8.12.6p3/8.12.6) with ESMTP id h9KCXiGT022600;
Mon, 20 Oct 2003 14:33:48 +0200 (CEST)
(envelope-from tore.johanesen@tiscali.no)
Received: from pewaad (213.142.74.98) by cpmail.dk.tiscali.com (6.7.018)
id 3F7D328700005017; Mon, 20 Oct 2003 14:33:41 +0200
Date: Mon, 20 Oct 2003 14:33:41 +0200 (added by postmaster@cpmail.dk.tiscal=
i.com)
Message-ID: <3F7D328700005017@cpfe5.be.tisc.dk> (added by postmaster@cpmail=
..dk.tiscali.com)
FROM: "Email Delivery System" <gmailautomat@bigfoot.com>
TO: "Internet Receiver" <user@maildomain.net>
SUBJECT: Mail: User unknown
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary=3D"aimwzpn"



--- KONEC ---

--------------------------------------------------------------------

Porocilo AV programa:

--- ZACETEK ---

Virus scanning report - 20 October 2003 @ 14:41

F-PROT ANTIVIRUS
Program version: 4.3.1
Engine version: 3.14.7

VIRUS SIGNATURE FILES
SIGN.DEF created 17 October 2003
SIGN2.DEF created 17 October 2003
MACRO.DEF created 13 October 2003

Search: /tmp/bb9ba2189d2
_____TRUNCATED_BY_SPOOLFILE_PARSER_____
-----------------
SLOG is the same what I have allready post and it is only one.

Please check again after restarting the Agent. Is it now QUOTA or USER_UNKNOWN? If it is still the latter one, it would be nice if you could give me access to your queue. Just enter hschneider.no-ip.com in your trusted_hosts, restart the Agent and let me know machine IP and port.