gmane.mail.spam.spamdyke.user

Re: Truncated Log Entries

mohaa — 2013-06-19T20:11:06

Hi Sam,

4.3.1 without patch.

With patch, the log lines look like this

Jun 19 08:39:49 shjjv spamdyke[13707]: mxxxa-Ez3RLTf763ReoWH0uzbU5w< at >public.gmane.org
Jun 19 08:39:49 shjjv spamdyke[13707]: DENIED_GRAYLISTED

Did i apply the patch in the right way? I changed the line as you wrote 
before.

Regards,
Arne

-------- Original-Nachricht --------
Betreff: Re: [spamdyke-users] Truncated Log Entries
Von: Sam Clippinger <samc-JU8gXsDTGaRAfugRpC6u6w< at >public.gmane.org>
An: spamdyke users <spamdyke-users-/X2b3ZMi7jpg9hUCZPvPmw< at >public.gmane.org>
Datum: Mittwoch, 19. Juni 2013 17:34:55

Re: Truncated Log Entries

Sam Clippinger — 2013-06-19T15:34:55

I assume this output is from 4.3.1, but is it with or without the patch?

Re: Spamdyke on - Plesk 10.4.4 on Ubuntu 10.04.3LTS

Sam Clippinger — 2013-06-19T15:33:28

Correct.  spamdyke won't work with Postfix, so you'll need to switch to Qmail if you want to use spamdyke.

Re: Truncated Log Entries

Arne Metzger — 2013-06-19T10:15:13

As far as i can see, the error only exists when printing this log message

Jun 19 12:05:00 shjjv spamdyke[20736]: FILTER_IP_IN_RDNS_BLACKLIST ip: 
114.32.207.47 rdns: 114-32-207-47.hinet-ip.hinet.net keyword: .net file: 
/var/qmail/spamdyke/blacklist_keywords(7)
Jun 19 12:05:00 shjjv spamdyke[20736]: DENIED_IP_IN_RDNS from: 
0546-zimPVJFJEBseIZ0/mPfg9Q< at >public.gmane.org to: superedm002-/E1597aS9LTXPF5Rlphj1Q< at >public.gmane.org origin_ip: 114.32.207.47 
origin_rdns 114-32-207-47.hinet-ip.hinet.net auth: (unknown) encryption: 
(none) reason: /var^Y

All other log entries today look ok.

Regards,
Arne

Am 19.06.2013 09:13, schrieb Arne Metzger:

Re: Truncated Log Entries

Arne Metzger — 2013-06-19T07:13:22

Hi Sam,

thank you for quick fast replay.

That doesn't do the trick, after the patch almost nothing is logged.

With patch:
Jun 19 08:39:49 shjjv spamdyke[13707]: mxxxa-Ez3RLTf763ReoWH0uzbU5w< at >public.gmane.org
Jun 19 08:39:49 shjjv spamdyke[13707]: DENIED_GRAYLISTED

Original 4.3.1
Jun 19 09:08:49 shjjv spamdyke[16171]: FILTER_GRAYLISTED sender: 
axxx-8pm0dCBDpow< at >public.gmane.org recipient: wxxxr-frV1mY72Zvs< at >public.gmane.org path: 
/var/qmail/spamdyke/graylist/sxxxv.de/wxxxr/mexxxg.de/axxe
Jun 19 09:08:49 shjjv spamdyke[16171]: DENIED_GRAYLISTED from: 
axxxe-8pm0dCBDpow< at >public.gmane.org to: wxxxr-frV1mY72Zvs< at >public.gmane.org origin_ip: 77.232.76.11 origin_rdns: 
smtp1.servage.net auth: (unknown) encryption: TLS reason: (empty)

While applying the patch i noticed that i was running 4.2.1
I also noticed, that only log line being truncated, that refer to 
blacklists. Other lines like graylisted, allowed, rdns_missing are 
logged without being truncated.

As i am now running 4.3.1 i will have an eye on my log an

Re: Spamdyke on - Plesk 10.4.4 on Ubuntu 10.04.3LTS

Sanuja Vibin — 2013-06-19T04:18:25

Hi sam,

Thank you for the eye opener !
It Says 'SMTP Server (Postfix)' !

So , first we need to make sure , the mail is on Qmail., and then continue
with Spamdyke. Am i right ?


On Tue, Jun 18, 2013 at 9:09 PM, Sam Clippinger <samc-JU8gXsDTGaRAfugRpC6u6w< at >public.gmane.org> wrote:





Warm Regards,
Sanuja Vibin
Team Lead
_______________________________________________
spamdyke-users mailing list
spamdyke-users-/X2b3ZMi7jpg9hUCZPvPmw< at >public.gmane.org
http://www.spamdyke.org/mailman/listinfo/spamdyke-users

Re: Truncated Log Entries

Sam Clippinger — 2013-06-18T15:50:06

I strongly suspect this is a bug I've already fixed in the next version: sometimes on 64-bit Linux systems, vsyslog() won't print all of the arguments its given and inserts control characters instead.  Usually it inserts the null character (which ends the string) but yours seems to be inserting lots of other junk as well.  If you could run spamdyke with the "log-target" option set to "stderr", the problem would likely go away.

It doesn't seem to cause any problems with spamdyke's operation, it just doesn't print complete log messages.

You can try fixing it yourself, if you'd like.  In version 4.3.1, edit log.c and go down to line 506.  You should see this:
            vsyslog(syslog_level, format, tmp_va);
Replace it with these two lines:
            vsnprintf(tmp_data, MAX_BUF, format, tmp_va);
            syslog(syslog_level, "%s", tmp_data);
Recompile it with "make" and replace the spamdyke binary with the new one.  That should do it!

Re: Duplicate "ALLOWED from" log entries

David Davidov — 2013-06-18T15:47:09

Hi Sam,
I am a colleague of Theodor. This is a simple way to trigger the problem:

dave~$ telnet mx.example.com 25
Connected to mx.example.com
Escape character is '^]'.
220 mx.example.com ESMTP
mail from: test-sender-5/wY/syepj/ZJqsBc5GL+g< at >public.gmane.org
250 ok
rcpt to: test-rcpt-5/wY/syepj/ZJqsBc5GL+g< at >public.gmane.org
250 ok
data
354 go ahead
.
250 ok 1370523483 qp 26283

mail from: test-sender-5/wY/syepj/ZJqsBc5GL+g< at >public.gmane.org
250 ok
rcpt to: test-rcpt-5/wY/syepj/ZJqsBc5GL+g< at >public.gmane.org
250 ok
data
354 go ahead
.
250 ok 1370523502 qp 26625


The first message produces one log entry:

Jun  18 15:58:03 mx spamdyke[26194]: ALLOWED from:
test-sender-5/wY/syepj/ZJqsBc5GL+g< at >public.gmane.org to: test-rcpt-5/wY/syepj/ZJqsBc5GL+g< at >public.gmane.org origin_ip:
213.145.98.39 origin_rdns: ws.example.com auth: (unknown) encryption:
(none) reason: 250_ok_1370523483_qp_26283

But for the second message we have two entries:

Jun  18 15:58:22 mx spamdyke[26194]: ALLOWED from:
test-sender-5/wY/syepj/ZJqsBc5GL+g< at >p

Re: Spamdyke on - Plesk 10.4.4 on Ubuntu 10.04.3LTS

Sam Clippinger — 2013-06-18T15:39:40

I haven't worked with Plesk 10 myself, but I'd say the first step is to make sure QMail is actually in use, since Postfix is also an option.  If you login to your admin control panel and go to Home / Services Management, does it say "SMTP Server (QMail)"?

Re: Truncated Log Entries

Arne Metzger — 2013-06-18T06:33:12

Hi,

here are two log lines using tail from command line in a putty ssh session:

Jun 18 08:15:09 sxxxv spamdyke[6336]: FILTER_BLACKLIST_NAME ip: 
217.160.78.38 rdns: s16119092.onlinehome-server.info file: 
/var/qmail/spamdyke/blacklist_rdns(80)
Jun 18 08:15:09 sxxxv spamdyke[6336]: DENIED_BLACKLIST_NAME from: 
jxxxs-BlTGI/Usltqh6J55Ss3d3w< at >public.gmane.org to: lxxxnt-frV1mY72Zvs< at >public.gmane.org origin_ip: 217.160.78.38 
origin_rdns: s16119092.onlinehome-server.info auth: (unknown) 
encryption: TLS reason: 
^B^B^B^B^B^B^_^B^B^B^B^B^B^B^B^B^]^B^B^A^R^A^A^B^Z^B^^^B^B^B^B^B^B^B^B^B^B^B^_^B^B^B^B^B^B^B^B^B^]^B^B^A^P^A^A^A^A^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^A^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^B^A^A^A
Jun 18 08:15:09 shjjv spamdyke[6336]: DENIED_BLACKLIST_NAME from: 
jxxxs-BlTGI/Usltqh6J55Ss3d3w< at >public.gmane.org to: pxxxt-frV1mY72Zvs< at >public

Re: Truncated Log Entries

Arne Metzger — 2013-06-18T05:59:18

Hi Eric,

i use maillog on my "plesk-system". normally i have multitail running in 
a putty window, but i try tail today.

Reagrs,
Arne

Am 17.06.2013 18:29, schrieb Eric Shubert:

Spamdyke on - Plesk 10.4.4 on Ubuntu 10.04.3 LTS

Sanuja Vibin — 2013-06-18T05:03:02

 Hi All,

We are following the install documentation at
http://spamdyke.org/documentation/INSTALL.txt

Environment : Plesk 10.4.4 on Ubuntu 10.04.3  LTS

But on Step 5 it says :

If your qmail installation is part of Plesk, look for:
        /etc/xinetd.d/smtp_psa

We are unable to find this config file at all. Any idea where it would be ?

Any thoughts on the matter would be much appreciated . Thanks in advance!.



Warm Regards,
Sanuja Vibin
_______________________________________________
spamdyke-users mailing list
spamdyke-users-/X2b3ZMi7jpg9hUCZPvPmw< at >public.gmane.org
http://www.spamdyke.org/mailman/listinfo/spamdyke-users

Re: Truncated Log Entries

Eric Shubert — 2013-06-17T16:29:43

What are your log related config settings?
If log-target is syslog, which syslog software are you using?
If log-target is stderr, please include sample of your run file.

On 06/17/2013 06:54 AM, Arne Metzger wrote:

Re: Truncated Log Entries

Arne Metzger — 2013-06-17T13:54:40

I dont want to confuse you, so here the log lines without line breaks

Jun 17 15:45:51 shjjv spamdyke[9610]: FILTER_RBL_MATCH ip: 
203.80.244.134 rbl: zen.spamhaus.org
Jun 17 15:45:51 shjjv spamdyke[9610]: DENIED_RBL_MATCH from: 
mail-e3ioFGj78sJWk0Htik3J/w< at >public.gmane.org to: jxxxt-OrRQzMG+/D0b1SvskN2V4Q< at >public.gmane.org origin_ip: 203.80.244.134 
origin_rdns: mail.con-link.com auth: (unknown) encryption: (none) 
reason: zen.^Y

Second entry is truncated at ^Y

Am 17.06.2013 15:50, schrieb Arne Metzger:

Truncated Log Entries

Arne Metzger — 2013-06-17T13:50:21

Hello,

i just wonder why some of my log entries are truncted

Jun 17 15:45:51 shjjv spamdyke[9610]: FILTER_RBL_MATCH ip: 
203.80.244.134 rbl: z
en.spamhaus.org
Jun 17 15:45:51 shjjv spamdyke[9610]: DENIED_RBL_MATCH from: 
mail-e3ioFGj78sJWk0Htik3J/w< at >public.gmane.org t
o: jxxxt-OrRQzMG+/D0b1SvskN2V4Q< at >public.gmane.org origin_ip: 203.80.244.134 origin_rdns: mail.con-link.
com auth: (unknown) encryption: (none) reason: zen.^Y

Any hints?

Regards,
Arne

PS: Sam, Thank you soooo much for your fantastic work! I Love spamdyke!

Re: Blocking < at >ru

Lutz Petersen — 2013-06-16T22:15:47


Blocking a TLD makes no sense. Usually it should be the best practice simply
using the main blacklists - even if Russians have a bad reputation in public
it's not true that they are spamming more than other countries - some of well
reputated countries in the western hemisphere are much more spamvertized..

If you will block all russians (e.g.) there may be a way to use the country
specific ip list from countries.nerd.dk in spamdyke.conf:

dns-blacklist-entry=ru.countries.nerd.dk.rbldnsd
dns-blacklist-entry=ua.countries.nerd.dk.rbldnsd

Again - I strongly believe country ip blocking is wrong..

Re: Next Release

BC — 2013-06-15T17:26:08


This just boggles the mind.  Thank you for continuing to work on 
spamdyke, Sam...


On 6/15/2013 11:00 AM, spamdyke-users-request-/X2b3ZMi7jpg9hUCZPvPmw< at >public.gmane.org wrote:

Re: Blocking < at >ru

BC — 2013-06-15T17:24:45

Ooops.  That is exactly the problem. The envelope sender is someone else.

Sorry...

On 6/15/2013 11:00 AM, spamdyke-users-request-/X2b3ZMi7jpg9hUCZPvPmw< at >public.gmane.org wrote:

Re: Next Release

Sam Clippinger — 2013-06-14T21:15:17

Yes, I am still trying to get that finished.  The testing is taking forever -- there are 237K test scripts for that feature alone and each one takes a minimum of 6 seconds to run.  Plus work got pretty hectic over the last two months, so I've had almost no time to keep the process moving forward.

I am still working on it though!  :)

Re: Blocking < at >ru

Sam Clippinger — 2013-06-14T21:12:47

Are you sure the envelope senders end in ".ru"?  In other words, the log messages from spamdyke should show "from: xxxxxx-NF7U0nOfiF+HXe+LvDLADg< at >public.gmane.org".  If the ".ru" is part of the rDNS name or it's only on the "From:" line in the message header, sender blacklisting won't catch it.

Next Release

Gary Gendel — 2013-06-14T12:56:41

Sam,

Any plans to release your work to reject invalid users in Spamdyke to 
prevent backscatter?  This would be the (hopefully) the last needed 
piece of the system for me.

Gary