Re: Double sa-exim check?

On Tue, Oct 09, 2007 at 01:21:46PM +0200, Riccardo Raffaelli wrote:
> Hi to all.
> I'm new in sa-exim intergration, and I googled to find a response to my
> question without success.
> 
> Let me explain:
> 
> I have an exim4 server with sa-exim configured that is checking well emails,
> but in some case i look in the log this:
> 
> 2007-10-09 13:00:34 no IP address found for host
> 137-96-177-194.serverdedicati.yyy.xxx (during SMTP connection from
> [194.177.yyy.xxx])
> 2007-10-09 13:00:36 1IfEhO-0008Fb-Ql SA: Action: scanned but message isn't
> spam: score=-2.6 required=5.0 (scanned in 2/2 secs | Message-Id:
> !_!AAAAAAAAAAAYAAAAAAAAAE2ruGaQ4cJKsoWp4t1zhHnCgAAAEAAAALpi6O5k3UFPv2xPYJM3h
> [email protected]). From <[email protected]>
> (host=NULL [194.177.96.137]) for [email protected]
> 2007-10-09 13:00:36 1IfEhO-0008Fb-Ql <= [email protected]
> H=(vps.adaconsulting.xxx) [194.177.96.xxx] P=esmtp S=2810
> id=!&!AAAAAAAAAAAYAAAAAAAAAE2ruGaQ4cJKsoWp4t1zhHnCgAAAEAAAALpi6O5k3UFPv2xPYJ
> [email protected]
> 2007-10-09 13:00:38 1IfEhR-0008Fp-7m SA: Action: scanned but message isn't
> spam: score=-2.6 required=5.0 (scanned in 1/1 secs | Message-Id:
> !_!AAAAAAAAAAAYAAAAAAAAAE2ruGaQ4cJKsoWp4t1zhHnCgAAAEAAAALpi6O5k3UFPv2xPYJM3h
> [email protected]). From <[email protected]>
> (host=localhost [127.0.0.1]) for [email protected]
> 2007-10-09 13:00:38 1IfEhR-0008Fp-7m <= [email protected]
> H=localhost [127.0.0.1] P=esmtp S=3307
> id=!&!AAAAAAAAAAAYAAAAAAAAAE2ruGaQ4cJKsoWp4t1zhHnCgAAAEAAAALpi6O5k3UFPv2xPYJ
> [email protected]
> 2007-10-09 13:00:38 1IfEhO-0008Fb-Ql => [email protected] R=amavis_router
> T=amavis_smtp H=localhost [127.0.0.1]
> 2007-10-09 13:00:38 1IfEhO-0008Fb-Ql Completed
> 2007-10-09 13:00:39 1IfEhR-0008Fp-7m => [email protected] R=hubbed_hosts
> T=remote_smtp H=10.4.2.9 [10.0.0.1]
> 2007-10-09 13:00:39 1IfEhR-0008Fp-7m Completed
> 
> It's normal that I get 2 time the " SA: Action: scanned but message isn't
> spam" message?

Well, it looks like the message comes in twice in your exim config, with two
different message-Ids.

> On the second connection (the one from itself) the server shouldn't pass
> without scan the same email?

Without seeing your exim.conf, it's hard to say (and quite frankly, I'm hazy
on them anyway now that mine has been working and left untouched for years),
but my guess is that your amavis config is what splits the mail and refeeds
it to you, not sa-exim:
> 2007-10-09 13:00:38 1IfEhO-0008Fb-Ql => [email protected] R=amavis_router
> T=amavis_smtp H=localhost [127.0.0.1]
> 2007-10-09 13:00:39 1IfEhR-0008Fp-7m => [email protected] R=hubbed_hosts
> T=remote_smtp H=10.4.2.9 [10.0.0.1]

amavis seems to accept the mail and then send it to exim local. sa-exim in
its default config will run in both cases.
If your config is meant to run exim twice per Email, you could configure
sa-exim to recognize the second call and not re-scan stuff that's already
been scanned when it came from the outside the first time.

If you can't figure it out, you could disable sa-exim for now, see that
your mails still get processed twice, and ask for further help on the
exim-users list to sort it out.
Once you have what you need, you can turn sa-exim back on (just so that you
get to deal with one thing at a time)

Marc
-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems & security ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/