Bluehost.com Web Hosting $6.95

Logging oddity: no "qmgr removed" issued on body/header rejections

This is a discussion on Logging oddity: no "qmgr removed" issued on body/header rejections within the mailing.postfix.users forums, part of the Mail Servers and Related category; Hello, I've been writing an object-oriented interface in Perl to handle Postfix logs. I know this is a ...


Go Back   Usenet Forums > Mail Servers and Related > mailing.postfix.users

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 10-06-2004
David Landgren
 
Posts: n/a
Default Logging oddity: no "qmgr removed" issued on body/header rejections

Hello,

I've been writing an object-oriented interface in Perl to handle Postfix
logs. I know this is a rather futile effort giving their wildly changing
nature from release to release, but hey, it was an itch I needed to scratch.

I'm not trying to deal with old-style logs, which is I believe anything
2.0-ish. I'm only aiming for new-style logs, the ones that have these
sorts of messages:

Oct 6 18:44:34 relay postfix/qmgr[44170]: 562862A511: removed

It's through this line that you're able to determine when an SMTP
transaction has been finished, which lets you get on with the job.
Without that it's just messy heuristics.

Anyway, I've just tracked down a bug in my code, based on the false
assumption that the above "qmgr removed" messages above always appear.
It turns out, at least for mail_version = 2.2-20040829 that this doesn't
always hold. If the case of rejecting messages based on header or body
checks, no qmgr removed message will be issued.

For instance:

Oct 1 00:54:19 relay postfix/cleanup[527]: 0A0782A496: reject: header
Content-Type: application/octet-stream;??name="id_yours.doc.com" from
ASt-Lambert-151-1-22-53.w82-120.abo.wanadoo.fr[82.120.235.53];
from=<31800173@mwinf0512.wanadoo.fr> to=<point@example.com> proto=ESMTP
helo=<example.com>: extension ".com" of attachement [id_yours.doc.com]
indicates Microsoft executable content (or similar) and is a security risk

If I grep for '0A0782A496' that's the last line I get.

Anyway, I have my work-around, but it might be worthwhile to issue a
removed message anyway, according to the Principle of Least Surprise.

Regards,
David
Reply With Quote
Reply
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On




All times are GMT +1. The time now is 09:17 AM.


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0