One of my systems is receiving duplicates of the same message from
certain remote servers.
It does both spam and AV scanning in the DATA acl. According to the
exim log id field, it's the same message:
2006-07-28 07:23:11 1G6SGG-0007wS-Bh <= someaddress@???
H=(bay0-omc3-s30.bay0.hotmail.com) [65.54.246.230] P=esmtp S=4680
id=BAY108-DAV907EFA5F3132A3C77EC92DF590@???
2006-07-28 07:25:08 1G6SJY-0007ya-N0 <= someaddress@???
H=(bay0-omc3-s30.bay0.hotmail.com) [65.54.246.230] P=esmtp S=4680
id=BAY108-DAV907EFA5F3132A3C77EC92DF590@???
2006-07-28 07:25:57 1G6SL5-0007yo-1m <= someaddress@???
H=(bay0-omc3-s30.bay0.hotmail.com) [65.54.246.230] P=esmtp S=4680
id=BAY108-DAV907EFA5F3132A3C77EC92DF590@???
Despite these times appearing to be close together (and within RFC
2821 limits), the sessions are actually starting sooner. For example, the
first entry appears in the SpamAssassin log at:
2006 Jul 28 07:20:22 instagate spamd[18470]: spamd: checking message
<BAY108-DAV907EFA5F3132A3C77EC92DF590@???> for nobody:8
2006 Jul 28 07:20:25 instagate spamd[18470]: received-header: parsed as [
ip=65.54.246.230 rdns= helo=bay0-omc3-s30.bay0.hotmail.com by=the-finns.com
ident= env from=someuser@??? intl=0 id=1G6SGG-0007wS-Bh auth= ]
The full exim entry for entry 1 is:
2006-07-28 07:23:11 1G6SGG-0007wS-Bh <= someaddress@???
H=(bay0-omc3-s30.bay0.hotmail.com) [65.54.246.230] P=esmtp S=4680
id=BAY108-DAV907EFA5F3132A3C77EC92DF590@???
2006-07-28 07:23:14 1G6SGG-0007wS-Bh => user <user@???> R=localuser
T=local_delivery
2006-07-28 07:23:14 1G6SGG-0007wS-Bh Completed
My guess is that msn is quitting before waiting the full RFC timeout
(by a lot in the DATA section!) and hanging up the connection. It thinks
the message wasn't sent, exim thinks it was, and the message thus gets
duplicated.
Is there a way to detect if this is happening via log options?
And/or is there a built-in way deal with this situation?
Thanks,
Chris
