On Tue, 2007-05-15 at 12:41 -0300, Wilson A. Galafassi Jr. wrote: > The problem is: the same email is processed 2 times 1Hnyt1-00086b-EV and
> 1Hnyt6-00086n-1F. this occour only for incoming messages. Only one message
> is delivered to mailbox user.
This is because MailScanner is not a truly "real time" scanning engine.
Exim accepts the message (the first line, protocol is esmtp) and submits
it to the MailScanner engine (the second line beginning cwd=).
Messages which are "clean" are then resubmitted to Exim by MailScanner,
generating the third line (protocol is local-bsmtp). They are then
delivered to the users.
In effect, Exim handles the message twice via different input methods so
your log is accurate.
If you want to do truly realtime scanning, use the built-in spam and
antivirus tools instead. That way you can reject at SMTP time instead of
doing accept-and-bounce or accept-and-drop
