[exim] RE: spamd and exim

Top Page
Delete this message
Reply to this message
Author: Herb Martin
Date:  
To: users
CC: 'Mailinglist EXIM'
Subject: [exim] RE: spamd and exim
> -----Original Message-----
> From: Jonathan Guthrie [mailto:jono@xserve.co.nz]
> The message I am seeing in /var/log/exim_main.log is:
> spam acl condition: cannot parse spamd output
> H=(mailservername) [IP] F=<address> temporarily rejected after DATA


I am seeing a LOT of these but have been watching for them
in the Panic Log as they are more isolated there.

Mine are without the "rejection" since I use "defer_ok"
    # ACL modifier
    spam = username/defer_ok


Spam lookups (SpamAssassin) are supposedly cached and since
I have a LOT of "Spam check stanzas" in my Config so I am
pretty sure that every message gets checked, but sometimes
the unimportant check MIGHT get skipped.

FYI: I reordered the checks so that my first Spam check is
the one that "rewrites the subject line" meaning if it is skipped
only the visual marker is omitted -- and the later checks are
the ones for marking subjects with SEVERE spam and adding the
headers.

I have resisted posting since it was completely unclear to me
if this is a SpamD problem or an Exim problem -- or both.

But SpamD was occasionally having trouble in another email server
that only got "one look" at the email and used SpamC to do that.

My research through the syslog SpamD entries SEEMS to (loosely)
correctly with __ALARM__ entries for SpamD.

Best GUESS: It's a SpamD 'feature', but this is only an educated
guess based on chasing it for only one full day.

> It looks like the messages are those containing attachments,
> .zip from what I understand, but not all .zip are being
> blocked, and it's definitely not blocked via
> /usr/exim/rejected_file_type


Good pickup -- if it is related to .zip files, I can research
my logs further and maybe pinpoint the issue.

BTW, I only spam check files <200k in size.

And I am running a pre-release of SpamAssassin 3.10

--
Herb Martin, MCT, MCSD, MCSE, MVP
HerbM@??? http://LearnQuick.Com
512 388 7339 -or- 1 800 MCSE PRO
Accelerated MCSE in a Week Seminars