5.6.7b2405

Use this forum if you want to discuss a problem or ask a question related to a hMailServer beta release.
Post Reply
User avatar
mattg
Moderator
Moderator
Posts: 22435
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

5.6.7b2405

Post by mattg » 2017-01-26 03:13

Change log affected ciphers >> https://www.hmailserver.com/changelog/?version=5.6.7

This post came up in a search for me yesterday, as I was getting the "Error code: 336151574, Message: sslv3 alert certificate unknown" in my logs.

I have two hmailservers, where one has a dummy domain & account and does an external POP3 download to my main hMailserver (then extracts .pdf attachments into a set directory at the remote end - I actually do this quite a bit)

Since I upgraded the main hMailserver to latest Beta 5.6.7b2405 (about the same time that I adopted this cipher suite >> viewtopic.php?f=7&t=30715&p=191932&hili ... rs#p191933), every time that the External account download would run on the remote machine I got the above error.
Remote machine was running 5.5.2b2129, and no ciphers in the list on the SSL/TLS page.

Upgrading the remote machine to same version as main machine stopped this error and allowed successful download of mail.
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

User avatar
martin
Developer
Developer
Posts: 6846
Joined: 2003-11-21 01:09
Location: Sweden
Contact:

Re: 5.6.7b2405

Post by martin » 2017-01-26 21:22

Hmm, a bit strange. But the latest version of OpenSSL has phased out a few obsolete ciphers since they are deemed insecure. I suspect that no compatible ciphers where found between the two hMailServer instances until you upgraded it.
Martin Knafve

User avatar
mattg
Moderator
Moderator
Posts: 22435
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: 5.6.7b2405

Post by mattg » 2017-01-28 03:03

I must apologise Martin, it was not hMailserver but another automated POP3 download software at the same location that was creating these errors.

I suspect that the other software uses an old version of OpenSSL or some other security product with outdated ciphers.
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

tohare
Normal user
Normal user
Posts: 186
Joined: 2014-12-07 13:35
Location: Florida!

Re: 5.6.7b2405

Post by tohare » 2017-01-30 10:52

While on the topic, HMS is once again copying default script files into the Scripts dir and over writting existing (older) files -- confirmed. Actually been doing it the last 2 versions I believe.
Thanks,
Thomas

User avatar
RvdH
Senior user
Senior user
Posts: 3231
Joined: 2008-06-27 14:42
Location: The Netherlands

Re: 5.6.7b2405

Post by RvdH » 2017-01-30 11:00

tohare wrote:While on the topic, HMS is once again copying default script files into the Scripts dir and over writting existing (older) files -- confirmed. Actually been doing it the last 2 versions I believe.
Not here
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup

User avatar
mattg
Moderator
Moderator
Posts: 22435
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: 5.6.7b2405

Post by mattg » 2017-01-30 11:18

nor me

(I backup events folder daily anyway - just in case)
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

tohare
Normal user
Normal user
Posts: 186
Joined: 2014-12-07 13:35
Location: Florida!

Re: 5.6.7b2405

Post by tohare » 2017-01-30 12:19

Tell me why I am so special? Win 2008 Data R2. Last 2 builds. The previous Official release (last public release) fixed the problem I reported before (same). The pee-releases are the problem.
Thanks,
Thomas

User avatar
RvdH
Senior user
Senior user
Posts: 3231
Joined: 2008-06-27 14:42
Location: The Netherlands

Re: 5.6.7b2405

Post by RvdH » 2017-01-30 12:29

Do you use default path?
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup

tohare
Normal user
Normal user
Posts: 186
Joined: 2014-12-07 13:35
Location: Florida!

Re: 5.6.7b2405

Post by tohare » 2017-01-30 12:34

All defaults, latest SP's, etc. All up to date, use Spam Assassin and MySQL, etc. Run Task Scheduler every hour on the Data dir for BU and that is all I can think of that is different. Only other oddity (?) is it is all running in a Citrix Zen Server VM 6.5.
Thanks,
Thomas

User avatar
RvdH
Senior user
Senior user
Posts: 3231
Joined: 2008-06-27 14:42
Location: The Netherlands

Re: 5.6.7b2405

Post by RvdH » 2017-01-30 12:37

I just upgraded mine using 5.6.7b2407 beta (not officially released on download page) and nothing got overwritten, weird!
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup

tohare
Normal user
Normal user
Posts: 186
Joined: 2014-12-07 13:35
Location: Florida!

Re: 5.6.7b2405

Post by tohare » 2017-01-30 12:39

What OS are you using? Anyone else using Win2008DataR2?

I attached a pic of HMS and runtime files.
Attachments
Clipboard01.jpg
Last edited by tohare on 2017-01-30 12:49, edited 1 time in total.
Thanks,
Thomas

User avatar
RvdH
Senior user
Senior user
Posts: 3231
Joined: 2008-06-27 14:42
Location: The Netherlands

Re: 5.6.7b2405

Post by RvdH » 2017-01-30 12:48

Mine running Windows Server 2016 Std (recent new install) but have been running Windows Server 2008 R2 Std en Windows Server 2012 (w/o R2) in the past as well
Last edited by RvdH on 2017-01-30 12:50, edited 1 time in total.
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup

tohare
Normal user
Normal user
Posts: 186
Joined: 2014-12-07 13:35
Location: Florida!

Re: 5.6.7b2405

Post by tohare » 2017-01-30 12:50

I just did an edit and posted pic of runtimes.
Thanks,
Thomas

User avatar
mattg
Moderator
Moderator
Posts: 22435
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: 5.6.7b2405

Post by mattg » 2017-01-31 00:07

Just so that I am clear on this, EXACTLY which files are being overwritten
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

tohare
Normal user
Normal user
Posts: 186
Joined: 2014-12-07 13:35
Location: Florida!

Re: 5.6.7b2405

Post by tohare » 2017-01-31 01:28

Matt,

The script files located in the C:\Program Files (x86)\hMailServer\Addons\Utilities\

The one I am most concerned about was the StartBackup.vbs script.
Thanks,
Thomas

User avatar
mattg
Moderator
Moderator
Posts: 22435
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: 5.6.7b2405

Post by mattg » 2017-01-31 01:42

Ahh, OK yes that one has been a problem, and I don't use it, so I don't notice that being changed


Already listed on Github. Add a comment there if you like >> https://github.com/hmailserver/hmailserver/issues/192
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

AndreL
Normal user
Normal user
Posts: 31
Joined: 2016-06-07 15:42

Re: 5.6.7b2405

Post by AndreL » 2017-02-13 10:21

Experience sharing:

I'm running 5.6.7 b2405 in a prod environment for more than two weeks now (>10.000 messages): quite stable, not a single issue.
(POP3 is not used)

5.6.7 b2407 is installed on my backup system and is also stable (keep in sync via imapsync)

User avatar
mattg
Moderator
Moderator
Posts: 22435
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: 5.6.7b2405

Post by mattg » 2017-02-13 15:12

Where did you get b2407?
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

User avatar
jimimaseye
Moderator
Moderator
Posts: 10053
Joined: 2011-09-08 17:48

Re: 5.6.7b2405

Post by jimimaseye » 2017-02-13 15:16

5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

User avatar
mattg
Moderator
Moderator
Posts: 22435
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: 5.6.7b2405

Post by mattg » 2017-02-14 01:08

Yeah I guessed that too.
My point is, unless it appears on >> https://www.hmailserver.com/download it should be considered ALPHA release, and not suitable for a production server
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

AndreL
Normal user
Normal user
Posts: 31
Joined: 2016-06-07 15:42

Re: 5.6.7b2405

Post by AndreL » 2017-02-14 10:41

You are fully rights and you are aligned.

I always run the latest version on a backup/test server: I always try to run tests with real live and random messages flows (including french caracters by example).
By the way, the risk in this case is very limited as no database change between the versions. If not as good as expected, a simple exe reinstall is enough.

Let me thanks you for your involment on this product support: quick and to the point reaction.

User avatar
mattg
Moderator
Moderator
Posts: 22435
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: 5.6.7b2405

Post by mattg » 2017-02-14 11:32

cheers :D
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

User avatar
mattg
Moderator
Moderator
Posts: 22435
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: 5.6.7b2405

Post by mattg » 2017-02-20 12:57

I've also noticed that my AntiVirus (only AV not AntiSPAM) get done twice for each received email...

That's OK, just a bit of extra work (and much better than not being checked)

Code: Select all

"DEBUG"	3368	"2017-02-20 13:16:43.319"	"Executing event OnDeliveryStart"
"DEBUG"	3368	"2017-02-20 13:16:43.319"	"Event completed"
"DEBUG"	3368	"2017-02-20 13:16:43.319"	"Running custom virus scanner..."
"DEBUG"	3368	"2017-02-20 13:16:46.588"	"Scanner: C:\Program Files\AVAST Software\Avast Business\ashcmd.exe c:\hMailServer\Data\{F1DAD7AD-2F26-403C-B899-202A695CACD4}.eml /t=A /s /p=2 /d. Return code: 0"
"DEBUG"	3368	"2017-02-20 13:16:46.588"	"Connecting to ClamAV virus scanner..."
"DEBUG"	3368	"2017-02-20 13:16:46.588"	"Connecting to ClamAV stream port..."
"DEBUG"	3368	"2017-02-20 13:16:46.600"	"No virus detected: stream: OK"
"DEBUG"	3368	"2017-02-20 13:16:46.600"	"Running custom virus scanner..."
"DEBUG"	3368	"2017-02-20 13:16:49.806"	"Scanner: C:\Program Files\AVAST Software\Avast Business\ashcmd.exe C:\hMailServer\Temp\{D5AC55B0-6B8A-459E-A8C2-A3FD56648179}.tmp /t=A /s /p=2 /d. Return code: 0"
"DEBUG"	3368	"2017-02-20 13:16:49.806"	"Connecting to ClamAV virus scanner..."
"DEBUG"	3368	"2017-02-20 13:16:49.806"	"Connecting to ClamAV stream port..."
"DEBUG"	3368	"2017-02-20 13:16:49.806"	"No virus detected: stream: OK"
"DEBUG"	3368	"2017-02-20 13:16:49.819"	"Applying rules"
"DEBUG"	3368	"2017-02-20 13:16:49.819"	"Applying rule SPAM"
"DEBUG"	3368	"2017-02-20 13:16:49.819"	"Applying rule Spam Senders"
This single message was scanned twice by BOTH of my AV scanners - that's four scans in all
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

User avatar
jimimaseye
Moderator
Moderator
Posts: 10053
Joined: 2011-09-08 17:48

Re: 5.6.7b2405

Post by jimimaseye » 2017-02-20 13:05

mattg wrote:I've also noticed that my AntiVirus (only AV not AntiSPAM) get done twice for each received email...

That's OK, just a bit of extra work (and much better than not being checked)

.
.
.


This single message was scanned twice by BOTH of my AV scanners - that's four scans in all
That a huge overhead in resources. Perfectly expected to be scanned once, understandable to be scanned once by both scanners (given that you have enabled 2x different scanners) but to be done twice for both just uses up time and resources (if it didnt find anything on the first scan it sure as hell isnt going to find anything 3 seconds later with the same scan).
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

AndreL
Normal user
Normal user
Posts: 31
Joined: 2016-06-07 15:42

Re: 5.6.7b2405

Post by AndreL » 2017-02-21 15:57

I only noticed that double scanning when the Mirror feature is activated.

I didn't find a way to disable this second AV scanning just before message is forwarded to the mirror address.

NB: only "Use ClamAV" is defined.

User avatar
jimimaseye
Moderator
Moderator
Posts: 10053
Joined: 2011-09-08 17:48

Re: 5.6.7b2405

Post by jimimaseye » 2017-02-21 16:09

mattg wrote:I've also noticed that my AntiVirus (only AV not AntiSPAM) get done twice for each received email...
...
I just did a test an my emails only get scanned once (note: I only have 1x AV implemented):
"APPLICATION" 4216 "2017-02-21 14:04:26.407" "SMTPDeliverer - Message 343513: Delivering message from mail-2012@yahoo.net to sylvester@mydomain.net. File: D:\Datastore\hMailData\{4B07A6DF-731F-4C70-ADE1-0FF9C8352FBB}.eml"
"DEBUG" 4216 "2017-02-21 14:04:26.407" "Executing event OnDeliveryStart"
"DEBUG" 4216 "2017-02-21 14:04:26.407" "Event completed"
"DEBUG" 4216 "2017-02-21 14:04:26.407" "Connecting to ClamAV virus scanner..."
"DEBUG" 4216 "2017-02-21 14:04:26.407" "Connecting to ClamAV stream port..."
"SMTPD" 2220 2446 "2017-02-21 14:04:26.516" "212.82.96.252" "RECEIVED: QUIT"
"SMTPD" 2220 2446 "2017-02-21 14:04:26.516" "212.82.96.252" "SENT: 221 goodbye"
"DEBUG" 4600 "2017-02-21 14:04:26.516" "Ending session 2446"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "No virus detected: stream: OK"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rules"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rule DeleteKnownSPAM"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rule External Spam Score 7"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rule DeleteAutoReplywithSpam"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rule ContactRequesttoAlan"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Performing local delivery"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rules"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rule fromCOM"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rule Alias forwarding"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Saving message: {4B07A6DF-731F-4C70-ADE1-0FF9C8352FBB}.eml"
"DEBUG" 4216 "2017-02-21 14:04:27.608" "Reading messages from database."
"DEBUG" 4216 "2017-02-21 14:04:27.608" "Local delivery completed"
"APPLICATION" 4216 "2017-02-21 14:04:27.608" "SMTPDeliverer - Message 343513: Message delivery thread completed."
Thats a similar result to yours for the CLAMAV scan (ie, just the once) but you also have the external scanner running and its this externa scanner that seems to get called upon twice (according to your log).

I wonder if there is an issue with HMS when calling an external scanner?
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

User avatar
mattg
Moderator
Moderator
Posts: 22435
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: 5.6.7b2405

Post by mattg » 2017-02-21 16:49

notice that mine picks up once from the data directory and once from the temp directory
Some messages are scanned once

This one looks like it was scanned three times!!!

This message is an automated message from the AVAST console on the client's server. It gives me a report on all computers in the client network.

Code: Select all

"DEBUG"	6232	"2017-02-22 00:00:01.467"	"Creating session 1733"
"TCPIP"	6232	"2017-02-22 00:00:01.467"	"TCP - xxx.xxx.xxx.xxx connected to 10.10.10.10:465."
"DEBUG"	6232	"2017-02-22 00:00:01.467"	"Executing event OnClientConnect"
"DEBUG"	6232	"2017-02-22 00:00:01.483"	"Event completed"
"DEBUG"	6232	"2017-02-22 00:00:01.483"	"TCP connection started for session 1724"
"DEBUG"	6232	"2017-02-22 00:00:01.483"	"Performing SSL/TLS handshake for session 1724. Verify certificate: False"
"TCPIP"	6176	"2017-02-22 00:00:02.042"	"TCPConnection - TLS/SSL handshake completed. Session Id: 1724, Remote IP: xxx.xxx.xxx.xxx, Version: TLSv1, Cipher: DHE-RSA-AES128-SHA, Bits: 128"
"SMTPD"	6176	1724	"2017-02-22 00:00:02.042"	"xxx.xxx.xxx.xxx"	"SENT: 220 **mydomain.com** ESMTP"
"SMTPD"	6232	1724	"2017-02-22 00:00:02.307"	"xxx.xxx.xxx.xxx"	"RECEIVED: EHLO server2012"
"SMTPD"	6232	1724	"2017-02-22 00:00:02.322"	"xxx.xxx.xxx.xxx"	"SENT: 250-**mydomain.com**[nl]250-SIZE[nl]250-AUTH LOGIN[nl]250 HELP"
"SMTPD"	6176	1724	"2017-02-22 00:00:02.354"	"xxx.xxx.xxx.xxx"	"RECEIVED: AUTH LOGIN"
"SMTPD"	6176	1724	"2017-02-22 00:00:02.354"	"xxx.xxx.xxx.xxx"	"SENT: 334 VXNlcm5hbWU6"
"SMTPD"	5908	1724	"2017-02-22 00:00:02.385"	"xxx.xxx.xxx.xxx"	"RECEIVED: ***redacted****"
"SMTPD"	5908	1724	"2017-02-22 00:00:02.385"	"xxx.xxx.xxx.xxx"	"SENT: 334 UGFzc3dvcmQ6"
"SMTPD"	6176	1724	"2017-02-22 00:00:02.416"	"xxx.xxx.xxx.xxx"	"RECEIVED: ***"
"SMTPD"	6176	1724	"2017-02-22 00:00:02.416"	"xxx.xxx.xxx.xxx"	"SENT: 235 authenticated."
"SMTPD"	6232	1724	"2017-02-22 00:00:02.520"	"xxx.xxx.xxx.xxx"	"RECEIVED: MAIL FROM:<**MyClient**@**mydomain.com**> SIZE=314288"
"SMTPD"	6232	1724	"2017-02-22 00:00:02.520"	"xxx.xxx.xxx.xxx"	"SENT: 250 OK"
"SMTPD"	6176	1724	"2017-02-22 00:00:02.551"	"xxx.xxx.xxx.xxx"	"RECEIVED: RCPT TO:<**MyClient**@**mydomain.com**>"
"SMTPD"	6176	1724	"2017-02-22 00:00:02.551"	"xxx.xxx.xxx.xxx"	"SENT: 250 OK"
"SMTPD"	5908	1724	"2017-02-22 00:00:02.582"	"xxx.xxx.xxx.xxx"	"RECEIVED: DATA"
"DEBUG"	5908	"2017-02-22 00:00:02.582"	"Executing event OnSMTPData"
"DEBUG"	5908	"2017-02-22 00:00:02.696"	"Event completed"
"SMTPD"	5908	1724	"2017-02-22 00:00:02.696"	"xxx.xxx.xxx.xxx"	"SENT: 354 OK, send."
"DEBUG"	6944	"2017-02-22 00:00:05.754"	"Adding task AsynchronousTask to work queue Asynchronous task queue"
"DEBUG"	6296	"2017-02-22 00:00:05.754"	"Executing task AsynchronousTask in work queue Asynchronous task queue"
"DEBUG"	6296	"2017-02-22 00:00:05.754"	"Executing event OnAcceptMessage"
"DEBUG"	6296	"2017-02-22 00:00:06.004"	"Event completed"
"DEBUG"	6296	"2017-02-22 00:00:06.004"	"Saving message: {2779B59A-36A2-438B-8013-2A5F943FCAA3}.eml"
"DEBUG"	6296	"2017-02-22 00:00:06.004"	"Requesting SMTPDeliveryManager to start message delivery"
"SMTPD"	6296	1724	"2017-02-22 00:00:06.004"	"xxx.xxx.xxx.xxx"	"SENT: 250 Queued (3.072 seconds)"
"DEBUG"	7040	"2017-02-22 00:00:06.020"	"Adding task DeliveryTask to work queue SMTP delivery queue"
"DEBUG"	3380	"2017-02-22 00:00:06.020"	"Executing task DeliveryTask in work queue SMTP delivery queue"
"DEBUG"	3380	"2017-02-22 00:00:06.020"	"Delivering message..."
"APPLICATION"	3380	"2017-02-22 00:00:06.020"	"SMTPDeliverer - Message 842205: Delivering message from **MyClient**@**mydomain.com** to **MyClient**@**mydomain.com**. File: c:\hMailServer\Data\{2779B59A-36A2-438B-8013-2A5F943FCAA3}.eml"
"DEBUG"	3380	"2017-02-22 00:00:06.020"	"Executing event OnDeliveryStart"
"DEBUG"	3380	"2017-02-22 00:00:06.035"	"Event completed"
"DEBUG"	3380	"2017-02-22 00:00:06.035"	"Running custom virus scanner..."
"SMTPD"	6944	1724	"2017-02-22 00:00:06.051"	"xxx.xxx.xxx.xxx"	"RECEIVED: QUIT"
"SMTPD"	6944	1724	"2017-02-22 00:00:06.051"	"xxx.xxx.xxx.xxx"	"SENT: 221 goodbye"
"DEBUG"	6176	"2017-02-22 00:00:06.051"	"Ending session 1724"
"DEBUG"	3380	"2017-02-22 00:00:12.801"	"Scanner: C:\Program Files\AVAST Software\Avast Business\ashcmd.exe c:\hMailServer\Data\{2779B59A-36A2-438B-8013-2A5F943FCAA3}.eml /t=A /s /p=2 /d. Return code: 0"
"DEBUG"	3380	"2017-02-22 00:00:12.801"	"Connecting to ClamAV virus scanner..."
"DEBUG"	3380	"2017-02-22 00:00:12.816"	"Connecting to ClamAV stream port..."
"DEBUG"	3380	"2017-02-22 00:00:12.973"	"No virus detected: stream: OK"
"DEBUG"	3380	"2017-02-22 00:00:12.988"	"Running custom virus scanner..."
"DEBUG"	3380	"2017-02-22 00:00:19.441"	"Scanner: C:\Program Files\AVAST Software\Avast Business\ashcmd.exe C:\hMailServer\Temp\{F58FC07E-67D0-475A-A1C0-6A3E21D1C0CB}.tmp /t=A /s /p=2 /d. Return code: 0"
"DEBUG"	3380	"2017-02-22 00:00:19.441"	"Connecting to ClamAV virus scanner..."
"DEBUG"	3380	"2017-02-22 00:00:19.441"	"Connecting to ClamAV stream port..."
"DEBUG"	3380	"2017-02-22 00:00:19.457"	"No virus detected: stream: OK"
"DEBUG"	3380	"2017-02-22 00:00:19.473"	"Running custom virus scanner..."
"DEBUG"	3380	"2017-02-22 00:00:26.645"	"Scanner: C:\Program Files\AVAST Software\Avast Business\ashcmd.exe C:\hMailServer\Temp\{F8D8207E-BF86-4227-B08B-BB487C2D9656}.tmp /t=A /s /p=2 /d. Return code: 0"
"DEBUG"	3380	"2017-02-22 00:00:26.645"	"Connecting to ClamAV virus scanner..."
"DEBUG"	3380	"2017-02-22 00:00:26.660"	"Connecting to ClamAV stream port..."
"DEBUG"	3380	"2017-02-22 00:00:26.660"	"No virus detected: stream: OK"
"DEBUG"	3380	"2017-02-22 00:00:26.660"	"Applying rules"
"DEBUG"	3380	"2017-02-22 00:00:26.660"	"Applying rule SPAM"
"DEBUG"	3380	"2017-02-22 00:00:26.660"	"Applying rule Spam Senders"
"DEBUG"	3380	"2017-02-22 00:00:26.660"	"Applying rule Delayed one hour"
"DEBUG"	3380	"2017-02-22 00:00:26.660"	"Applying rule Delayed one day"
"DEBUG"	3380	"2017-02-22 00:00:26.660"	"Applying rule Avast Virus"
"DEBUG"	3380	"2017-02-22 00:00:26.660"	"Applying rule vouchers"
"DEBUG"	3380	"2017-02-22 00:00:26.660"	"Applying rule Windows Insider"
"DEBUG"	3380	"2017-02-22 00:00:26.676"	"Applying rule Clam Virus"
"DEBUG"	3380	"2017-02-22 00:00:26.676"	"Applying rule Backups"
"DEBUG"	3380	"2017-02-22 00:00:26.676"	"Applying rule logs"
...
****some removed here***
...
"DEBUG"	3380	"2017-02-22 00:00:26.676"	"Applying rule Test header log"
"DEBUG"	3380	"2017-02-22 00:00:26.676"	"Performing rule action"
"DEBUG"	3380	"2017-02-22 00:00:26.676"	"Executing event Unknown"
"DEBUG"	3380	"2017-02-22 00:00:27.035"	"Event completed"
"DEBUG"	3380	"2017-02-22 00:00:27.035"	"Applying rule SSSSSSSS"
"DEBUG"	3380	"2017-02-22 00:00:27.035"	"Applying rule LLLLLLLLL"
"DEBUG"	3380	"2017-02-22 00:00:27.035"	"Executing event OnMessageDeliver"
"DEBUG"	3380	"2017-02-22 00:00:27.051"	"Event completed"
"DEBUG"	3380	"2017-02-22 00:00:27.051"	"Performing local delivery"
"DEBUG"	3380	"2017-02-22 00:00:27.051"	"Applying rules"
"DEBUG"	3380	"2017-02-22 00:00:27.051"	"Applying rule move"
"DEBUG"	3380	"2017-02-22 00:00:27.051"	"Performing rule action"
"DEBUG"	3380	"2017-02-22 00:00:27.051"	"Performing rule action"
"DEBUG"	3380	"2017-02-22 00:00:27.051"	"Executing event Unknown"
"DEBUG"	3380	"2017-02-22 00:00:27.066"	"Event completed"
"DEBUG"	3380	"2017-02-22 00:00:27.082"	"Performing rule action"
"DEBUG"	3380	"2017-02-22 00:00:27.082"	"Executing event Unknown"
"DEBUG"	3380	"2017-02-22 00:00:27.113"	"Event completed"
"DEBUG"	3380	"2017-02-22 00:00:27.129"	"Moving message to #shared.**domain**.server.**MyClient**"
"DEBUG"	3380	"2017-02-22 00:00:27.129"	"Message moved to folder 386"
"DEBUG"	3380	"2017-02-22 00:00:27.176"	"Saving message: {2779B59A-36A2-438B-8013-2A5F943FCAA3}.eml"
"DEBUG"	3380	"2017-02-22 00:00:27.207"	"AWStats::LogDeliverySuccess"
"DEBUG"	3380	"2017-02-22 00:00:27.207"	"Local delivery completed"
"APPLICATION"	3380	"2017-02-22 00:00:27.207"	"SMTPDeliverer - Message 842205: Message delivery thread completed."
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

User avatar
jimimaseye
Moderator
Moderator
Posts: 10053
Joined: 2011-09-08 17:48

Re: 5.6.7b2405

Post by jimimaseye » 2017-02-21 17:11

If you do a test and send in a message with just CLAMAV enabled (no external virus scanner) for the purpose of that single test, does the email get scanner multiple times?

Or even the opposite (no CLamav, and only Avast enabled)? What happens?
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

User avatar
mattg
Moderator
Moderator
Posts: 22435
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: 5.6.7b2405

Post by mattg » 2017-02-22 16:17

mattg wrote:This one looks like it was scanned three times!!!

This message is an automated message from the AVAST console on the client's server. It gives me a report on all computers in the client network.
Same Automated message tonight, also gives three AV scans....
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

User avatar
RvdH
Senior user
Senior user
Posts: 3231
Joined: 2008-06-27 14:42
Location: The Netherlands

Re: 5.6.7b2405

Post by RvdH » 2017-02-25 12:27

@mattg

Does the message contain images or such? I think the extra scans are related to files/images (both inline & attached)
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup

User avatar
mattg
Moderator
Moderator
Posts: 22435
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: 5.6.7b2405

Post by mattg » 2017-02-25 13:40

Ahhh

Yep that is what is happening. :D
Once for the message, once each for the attachments (attachments scanned from temp directory)

(btw the same thing was happening with only one AV enabled)
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

Post Reply