XMailforum is a readonly knowledge archive now.

Registering as a new user or answering posts is not possible anymore.

Might the force be with you, to find here what you are looking for.

2019-09-20 - hschneider, Admin

Cookie Disclaimer: This forum uses only essential, anonymous session cookies (xmailforum*), nothing to be scared of.

XMail Forum [Powered by Invision Power Board]
Printable Version of Topic
Click here to view this topic in its original format
XMail Forum > XMail Queue Manager > Another bug in XQM 1.38


Posted by: atomant Oct 18 2003, 10:32 AM
I have this SLOG:
----------------
[PeekTime] 1066384512 : Fri, 17 Oct 2003 11:55:12 +0200
<<
ErrCode = -82
ErrString = [RCPT TO:] not permitted by remote SMTP server
ErrInfo = 552 5.2.2 Not enough space, only 0 bytes available for info@cinemalecabieu.com
SMAIL SMTP-Send MX = "pop2.allnet.fr." SMTP = "me.homelinux.net" From = "postmaster@stupar.homelinux.net" To = "info@cinemalecabieu.com" Failed !
SMTP-Error = "552 5.2.2 Not enough space, only 0 bytes available for info@cinemalecabieu.com"
SMTP-Server = "pop2.allnet.fr."
>>
----------------
Normaly this would be a QUOTA diagnosed but it is not:
--------------
RELAY_DENIED

Possible reasons:
- A general problem with the recipient's address
- You run XMail from an dynamic IP address range or
- there is no domain name assigned to your IP address or
- your relay is assumed as open or
- you or your ISP are blacklisted in some antispam or open relay database.
In that case search the SLOG for details about the blacklisting
service and see if it is possible to clear your entry from that list.
...
----------------

Any idea?

Posted by: hschneider Oct 18 2003, 10:58 AM
Thanks! That's why I made a public call to send me wrong or unparsed SLOGs. Only this way I can make the analyzer more accurate.

parse.lib update attached, pls test.


Posted by: atomant Oct 19 2003, 11:50 AM
No, still wrong diagnose.

Here is another one new:
-------------
[PeekTime] 1066523131 : Sun, 19 Oct 2003 02:25:31 +0200
<<
ErrCode = -82
ErrString = [RCPT TO:] not permitted by remote SMTP server
ErrInfo = 550 5.7.1 <dale@cubcodoors.com>... Cannot mail directly to files
SMAIL SMTP-Send MX = "mail.cubcodoors.com." SMTP = "me.homelinux.net" From = "postmaster@stupar.homelinux.net" To = "dale@cubcodoors.com" Failed !
SMTP-Error = "550 5.7.1 <dale@cubcodoors.com>... Cannot mail directly to files"
SMTP-Server = "mail.cubcodoors.com."
>>
-------------
Diagnosed RELAY_DENIED

Posted by: atomant Oct 19 2003, 11:52 AM
And another wrong diagnose:
---------
[PeekTime] 1066522528 : Sun, 19 Oct 2003 02:15:28 +0200
<<
ErrCode = -82
ErrString = [RCPT TO:] not permitted by remote SMTP server
ErrInfo = 552 RCPT TO:<tore.johanesen@tiscali.no> Mailbox disk quota exceeded
SMAIL SMTP-Send MX = "cpmail.dk.tiscali.com." SMTP = "me.homelinux.net" From = "postmaster@stupar.homelinux.net" To = "tore.johanesen@tiscali.no" Failed !
SMTP-Error = "552 RCPT TO:<tore.johanesen@tiscali.no> Mailbox disk quota exceeded"
SMTP-Server = "cpmail.dk.tiscali.com."
>>
------------
Diagnosed as USER_UKNOWN

Posted by: atomant Oct 20 2003, 08:51 AM
Another one:
--------
[PeekTime] 1066602148 : Mon, 20 Oct 2003 00:22:28 +0200
<<
ErrCode = -81
ErrString = [MAIL FROM:] not permitted by remote SMTP server
ErrInfo = 550 Access denied
SMAIL SMTP-Send FF = "online.no" SMTP = "me.homelinux.net" From = "postmaster@stupar.homelinux.net" To = "oddlas@online.no" Failed !
SMTP-Error = "550 Access denied"
SMTP-Server = "online.no"
>>
---------
diagnosed as RELAY_DENIED

Posted by: hschneider Oct 20 2003, 12:07 PM
According to your 1st mail:

>No, still wrong diagnose.

Are you sure you copied the parse.lib to the correct place? The diagnosis is QUOTA now, which is correct. Please verify parse.lib version in the Info dialog. Should be 1.14

Posted by: hschneider Oct 20 2003, 12:20 PM
QUOTE

SMTP-Error = "550 Access denied"
SMTP-Server = "online.no"
>>
---------
diagnosed as RELAY_DENIED


This diag is OK.

Posted by: hschneider Oct 20 2003, 12:22 PM
The rest is fixed in parse.lib 1.15. Thanks again!

Posted by: hschneider Oct 20 2003, 12:25 PM
kbase update attached. Unpack this to XQM's home folder.

Posted by: atomant Oct 20 2003, 02:03 PM
I have updated to 1.15 parse lib and also kbase but here is a new one:
-----------
[PeekTime] 1066653710 : Mon, 20 Oct 2003 14:41:50 +0200
<<
ErrCode = -82
ErrString = [RCPT TO:] not permitted by remote SMTP server
ErrInfo = 552 RCPT TO:<tore.johanesen@tiscali.no> Mailbox disk quota exceeded
SMAIL SMTP-Send MX = "cpmail.dk.tiscali.com." SMTP = "me.homelinux.net" From = "postmaster@stupar.homelinux.net" To = "tore.johanesen@tiscali.no" Failed !
SMTP-Error = "552 RCPT TO:<tore.johanesen@tiscali.no> Mailbox disk quota exceeded"
SMTP-Server = "cpmail.dk.tiscali.com."
>>
-----------
Diagnosed as USER_UKNOWN

Posted by: hschneider Oct 20 2003, 02:17 PM
Hmmm .. this gives a QUOTA diagnosis on my machine. Is this the very last SLOG entry in the SLOG list ?
Pls mail the complete SLOG file.

Posted by: atomant Oct 20 2003, 02:18 PM
Yep, this is the first and the last SLOG entry.

Posted by: hschneider Oct 20 2003, 03:04 PM
Can't track this .. :-/

Pls mail the original slog file, maybe there are some chars which influence parsing ...

Posted by: atomant Oct 20 2003, 03:28 PM
Her is spool:
---------
127.0.0.1:42016;127.0.0.1:25;Mon, 20 Oct 2003 14:41:50 +0200
me.homelinux.net
SEAF7
MAIL FROM: <postmaster@stupar.homelinux.net>
RCPT TO:<tore.johanesen@tiscali.no>
<<MAIL-DATA>>
X-AV-Scanned: YES 2acb0ad5dda3ef3895e72565aec24828
Received: from mig29 (127.0.0.1:42016)
by me.homelinux.net (127.0.0.1:25) with [XMail 1.17 (Linux/Ix86) ESMTP Server]
id <SEAF7> for <tore.johanesen@tiscali.no> from <postmaster@stupar.homelinux.net>;
Mon, 20 Oct 2003 14:41:50 +0200
Subject: ! WARNING ! - Virus found in email
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
X-Mailer: AV-Filter 1.7
To: tore.johanesen@tiscali.no
Content-Transfer-Encoding: quoted-printable
Date: Mon, 20 Oct 2003 14:41:49 +0200
From: postmaster@stupar.homelinux.net

Hello,

Mail from your system (may be forged) to sasa@stupar.homelinux.net was dete=
cted
to contain one or more viruses. This mail has been deleted from our
server and was not sent to the recipient. You will find the message
headers below in this message.

Virus detected: W32/Swen.A@mm


Thanks,
Postmaster - postmaster@stupar.homelinux.net

---------------------------------------------------------------------

Here below you will find the headers of the message :

--- BEGIN MESSAGE HEADER ---

Received: from smtp210.tiscali.dk (62.79.79.113:62495)
by me.homelinux.net (192.168.10.111:25) with [XMail 1.17 (Linux/Ix86) ESMT=
P Server]
id <SEAF6> for <sasa@stupar.homelinux.net> from <tore.johanesen@tiscali.no=
>;
Mon, 20 Oct 2003 14:41:48 +0200
Received: from cpmail.dk.tiscali.com (mail.tiscali.dk [212.54.64.159])
by smtp210.tiscali.dk (8.12.6p3/8.12.6) with ESMTP id h9KCXiGT022600;
Mon, 20 Oct 2003 14:33:48 +0200 (CEST)
(envelope-from tore.johanesen@tiscali.no)
Received: from pewaad (213.142.74.98) by cpmail.dk.tiscali.com (6.7.018)
id 3F7D328700005017; Mon, 20 Oct 2003 14:33:41 +0200
Date: Mon, 20 Oct 2003 14:33:41 +0200 (added by postmaster@cpmail.dk.tiscal=
i.com)
Message-ID: <3F7D328700005017@cpfe5.be.tisc.dk> (added by postmaster@cpmail=
..dk.tiscali.com)
FROM: "Email Delivery System" <gmailautomat@bigfoot.com>
TO: "Internet Receiver" <user@maildomain.net>
SUBJECT: Mail: User unknown
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary=3D"aimwzpn"



--- END MESSAGE HEADER ---

--------------------------------------------------------------------

Here bellow you will find scanner report:

--- BEGIN SCANNER REPORT ---

Virus scanning report - 20 October 2003 @ 14:41

F-PROT ANTIVIRUS
Program version: 4.3.1
Engine version: 3.14.7

VIRUS SIGNATURE FILES
SIGN.DEF created 17 October 2003
SIGN2.DEF created 17 October 2003
MACRO.DEF created 13 October 2003

Search: /tmp/bb9ba2189d2d26f5.scan//1066653709.8141-0.mig29 /tmp/bb9ba2189d=
2d26f5.scan//ferglp.exe
Action: Report only
Files: Attempt to identify files
Switches: -ARCHIVE

/tmp/bb9ba2189d2d26f5.scan/ferglp.exe Infection: W32/Swen.A@mm

Results of virus scanning:

Files: 2
MBRs: 0
Boot sectors: 0
Objects scanned: 2
Infected: 1
Suspicious: 0
Disinfected: 0
Deleted: 0
Renamed: 0

Time: 0:00


--- END SCANNER REPORT ---

*********************************************************************

Pozdravljen(a),

Sporocilo iz vasega sistema za sasa@stupar.homelinux.net je vsebovalo enega=
ali vec
virusov in je bilo izbrisano iz nasega streznika. Spodaj si lahko ogledate
glavo sporocila.

Najden virus: W32/Swen.A@mm


Hvala,
Postmaster - postmaster@stupar.homelinux.net

---------------------------------------------------------------------

Tukaj je glava sporocila:

--- ZACETEK ---

Received: from smtp210.tiscali.dk (62.79.79.113:62495)
by me.homelinux.net (192.168.10.111:25) with [XMail 1.17 (Linux/Ix86) ESMT=
P Server]
id <SEAF6> for <sasa@stupar.homelinux.net> from <tore.johanesen@tiscali.no=
>;
Mon, 20 Oct 2003 14:41:48 +0200
Received: from cpmail.dk.tiscali.com (mail.tiscali.dk [212.54.64.159])
by smtp210.tiscali.dk (8.12.6p3/8.12.6) with ESMTP id h9KCXiGT022600;
Mon, 20 Oct 2003 14:33:48 +0200 (CEST)
(envelope-from tore.johanesen@tiscali.no)
Received: from pewaad (213.142.74.98) by cpmail.dk.tiscali.com (6.7.018)
id 3F7D328700005017; Mon, 20 Oct 2003 14:33:41 +0200
Date: Mon, 20 Oct 2003 14:33:41 +0200 (added by postmaster@cpmail.dk.tiscal=
i.com)
Message-ID: <3F7D328700005017@cpfe5.be.tisc.dk> (added by postmaster@cpmail=
..dk.tiscali.com)
FROM: "Email Delivery System" <gmailautomat@bigfoot.com>
TO: "Internet Receiver" <user@maildomain.net>
SUBJECT: Mail: User unknown
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary=3D"aimwzpn"



--- KONEC ---

--------------------------------------------------------------------

Porocilo AV programa:

--- ZACETEK ---

Virus scanning report - 20 October 2003 @ 14:41

F-PROT ANTIVIRUS
Program version: 4.3.1
Engine version: 3.14.7

VIRUS SIGNATURE FILES
SIGN.DEF created 17 October 2003
SIGN2.DEF created 17 October 2003
MACRO.DEF created 13 October 2003

Search: /tmp/bb9ba2189d2
_____TRUNCATED_BY_SPOOLFILE_PARSER_____
-----------------
SLOG is the same what I have allready post and it is only one.

Posted by: hschneider Oct 22 2003, 11:20 AM
Please check again after restarting the Agent. Is it now QUOTA or USER_UNKNOWN? If it is still the latter one, it would be nice if you could give me access to your queue. Just enter hschneider.no-ip.com in your trusted_hosts, restart the Agent and let me know machine IP and port.

Posted by: atomant Oct 22 2003, 12:51 PM
Now it is OK, it shows QUOTA like it should. Looks like after restarting xmail and running again xqm it recognized good.

Posted by: hschneider Oct 22 2003, 02:01 PM
OK .. then there is a library cleanup issue with the Agent. Will be fixed in the next release. Thanks!

Powered by Invision Power Board (http://www.invisionboard.com)
© Invision Power Services (http://www.invisionpower.com)