5.6.7b2405
5.6.7b2405
Change log affected ciphers >> https://www.hmailserver.com/changelog/?version=5.6.7
This post came up in a search for me yesterday, as I was getting the "Error code: 336151574, Message: sslv3 alert certificate unknown" in my logs.
I have two hmailservers, where one has a dummy domain & account and does an external POP3 download to my main hMailserver (then extracts .pdf attachments into a set directory at the remote end - I actually do this quite a bit)
Since I upgraded the main hMailserver to latest Beta 5.6.7b2405 (about the same time that I adopted this cipher suite >> viewtopic.php?f=7&t=30715&p=191932&hili ... rs#p191933), every time that the External account download would run on the remote machine I got the above error.
Remote machine was running 5.5.2b2129, and no ciphers in the list on the SSL/TLS page.
Upgrading the remote machine to same version as main machine stopped this error and allowed successful download of mail.
This post came up in a search for me yesterday, as I was getting the "Error code: 336151574, Message: sslv3 alert certificate unknown" in my logs.
I have two hmailservers, where one has a dummy domain & account and does an external POP3 download to my main hMailserver (then extracts .pdf attachments into a set directory at the remote end - I actually do this quite a bit)
Since I upgraded the main hMailserver to latest Beta 5.6.7b2405 (about the same time that I adopted this cipher suite >> viewtopic.php?f=7&t=30715&p=191932&hili ... rs#p191933), every time that the External account download would run on the remote machine I got the above error.
Remote machine was running 5.5.2b2129, and no ciphers in the list on the SSL/TLS page.
Upgrading the remote machine to same version as main machine stopped this error and allowed successful download of mail.
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation
Re: 5.6.7b2405
Hmm, a bit strange. But the latest version of OpenSSL has phased out a few obsolete ciphers since they are deemed insecure. I suspect that no compatible ciphers where found between the two hMailServer instances until you upgraded it.
Martin Knafve
Re: 5.6.7b2405
I must apologise Martin, it was not hMailserver but another automated POP3 download software at the same location that was creating these errors.
I suspect that the other software uses an old version of OpenSSL or some other security product with outdated ciphers.
I suspect that the other software uses an old version of OpenSSL or some other security product with outdated ciphers.
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation
Re: 5.6.7b2405
While on the topic, HMS is once again copying default script files into the Scripts dir and over writting existing (older) files -- confirmed. Actually been doing it the last 2 versions I believe.
Thanks,
Thomas
Thomas
Re: 5.6.7b2405
Not heretohare wrote:While on the topic, HMS is once again copying default script files into the Scripts dir and over writting existing (older) files -- confirmed. Actually been doing it the last 2 versions I believe.
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup
Re: 5.6.7b2405
nor me
(I backup events folder daily anyway - just in case)
(I backup events folder daily anyway - just in case)
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation
Re: 5.6.7b2405
Tell me why I am so special? Win 2008 Data R2. Last 2 builds. The previous Official release (last public release) fixed the problem I reported before (same). The pee-releases are the problem.
Thanks,
Thomas
Thomas
Re: 5.6.7b2405
Do you use default path?
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup
Re: 5.6.7b2405
All defaults, latest SP's, etc. All up to date, use Spam Assassin and MySQL, etc. Run Task Scheduler every hour on the Data dir for BU and that is all I can think of that is different. Only other oddity (?) is it is all running in a Citrix Zen Server VM 6.5.
Thanks,
Thomas
Thomas
Re: 5.6.7b2405
I just upgraded mine using 5.6.7b2407 beta (not officially released on download page) and nothing got overwritten, weird!
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup
Re: 5.6.7b2405
What OS are you using? Anyone else using Win2008DataR2?
I attached a pic of HMS and runtime files.
I attached a pic of HMS and runtime files.
Last edited by tohare on 2017-01-30 12:49, edited 1 time in total.
Thanks,
Thomas
Thomas
Re: 5.6.7b2405
Mine running Windows Server 2016 Std (recent new install) but have been running Windows Server 2008 R2 Std en Windows Server 2012 (w/o R2) in the past as well
Last edited by RvdH on 2017-01-30 12:50, edited 1 time in total.
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup
Re: 5.6.7b2405
Just so that I am clear on this, EXACTLY which files are being overwritten
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation
Re: 5.6.7b2405
Matt,
The script files located in the C:\Program Files (x86)\hMailServer\Addons\Utilities\
The one I am most concerned about was the StartBackup.vbs script.
The script files located in the C:\Program Files (x86)\hMailServer\Addons\Utilities\
The one I am most concerned about was the StartBackup.vbs script.
Thanks,
Thomas
Thomas
Re: 5.6.7b2405
Ahh, OK yes that one has been a problem, and I don't use it, so I don't notice that being changed
Already listed on Github. Add a comment there if you like >> https://github.com/hmailserver/hmailserver/issues/192
Already listed on Github. Add a comment there if you like >> https://github.com/hmailserver/hmailserver/issues/192
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation
Re: 5.6.7b2405
Experience sharing:
I'm running 5.6.7 b2405 in a prod environment for more than two weeks now (>10.000 messages): quite stable, not a single issue.
(POP3 is not used)
5.6.7 b2407 is installed on my backup system and is also stable (keep in sync via imapsync)
I'm running 5.6.7 b2405 in a prod environment for more than two weeks now (>10.000 messages): quite stable, not a single issue.
(POP3 is not used)
5.6.7 b2407 is installed on my backup system and is also stable (keep in sync via imapsync)
Re: 5.6.7b2405
Where did you get b2407?
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation
- jimimaseye
- Moderator
- Posts: 10053
- Joined: 2011-09-08 17:48
Re: 5.6.7b2405
(I see it available at https://build.hmailserver.com/viewType. ... ilServer56.)
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829
Re: 5.6.7b2405
Yeah I guessed that too.
My point is, unless it appears on >> https://www.hmailserver.com/download it should be considered ALPHA release, and not suitable for a production server
My point is, unless it appears on >> https://www.hmailserver.com/download it should be considered ALPHA release, and not suitable for a production server
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation
Re: 5.6.7b2405
You are fully rights and you are aligned.
I always run the latest version on a backup/test server: I always try to run tests with real live and random messages flows (including french caracters by example).
By the way, the risk in this case is very limited as no database change between the versions. If not as good as expected, a simple exe reinstall is enough.
Let me thanks you for your involment on this product support: quick and to the point reaction.
I always run the latest version on a backup/test server: I always try to run tests with real live and random messages flows (including french caracters by example).
By the way, the risk in this case is very limited as no database change between the versions. If not as good as expected, a simple exe reinstall is enough.
Let me thanks you for your involment on this product support: quick and to the point reaction.
Re: 5.6.7b2405
cheers
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation
Re: 5.6.7b2405
I've also noticed that my AntiVirus (only AV not AntiSPAM) get done twice for each received email...
That's OK, just a bit of extra work (and much better than not being checked)
This single message was scanned twice by BOTH of my AV scanners - that's four scans in all
That's OK, just a bit of extra work (and much better than not being checked)
Code: Select all
"DEBUG" 3368 "2017-02-20 13:16:43.319" "Executing event OnDeliveryStart"
"DEBUG" 3368 "2017-02-20 13:16:43.319" "Event completed"
"DEBUG" 3368 "2017-02-20 13:16:43.319" "Running custom virus scanner..."
"DEBUG" 3368 "2017-02-20 13:16:46.588" "Scanner: C:\Program Files\AVAST Software\Avast Business\ashcmd.exe c:\hMailServer\Data\{F1DAD7AD-2F26-403C-B899-202A695CACD4}.eml /t=A /s /p=2 /d. Return code: 0"
"DEBUG" 3368 "2017-02-20 13:16:46.588" "Connecting to ClamAV virus scanner..."
"DEBUG" 3368 "2017-02-20 13:16:46.588" "Connecting to ClamAV stream port..."
"DEBUG" 3368 "2017-02-20 13:16:46.600" "No virus detected: stream: OK"
"DEBUG" 3368 "2017-02-20 13:16:46.600" "Running custom virus scanner..."
"DEBUG" 3368 "2017-02-20 13:16:49.806" "Scanner: C:\Program Files\AVAST Software\Avast Business\ashcmd.exe C:\hMailServer\Temp\{D5AC55B0-6B8A-459E-A8C2-A3FD56648179}.tmp /t=A /s /p=2 /d. Return code: 0"
"DEBUG" 3368 "2017-02-20 13:16:49.806" "Connecting to ClamAV virus scanner..."
"DEBUG" 3368 "2017-02-20 13:16:49.806" "Connecting to ClamAV stream port..."
"DEBUG" 3368 "2017-02-20 13:16:49.806" "No virus detected: stream: OK"
"DEBUG" 3368 "2017-02-20 13:16:49.819" "Applying rules"
"DEBUG" 3368 "2017-02-20 13:16:49.819" "Applying rule SPAM"
"DEBUG" 3368 "2017-02-20 13:16:49.819" "Applying rule Spam Senders"
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation
- jimimaseye
- Moderator
- Posts: 10053
- Joined: 2011-09-08 17:48
Re: 5.6.7b2405
That a huge overhead in resources. Perfectly expected to be scanned once, understandable to be scanned once by both scanners (given that you have enabled 2x different scanners) but to be done twice for both just uses up time and resources (if it didnt find anything on the first scan it sure as hell isnt going to find anything 3 seconds later with the same scan).mattg wrote:I've also noticed that my AntiVirus (only AV not AntiSPAM) get done twice for each received email...
That's OK, just a bit of extra work (and much better than not being checked)
.
.
.
This single message was scanned twice by BOTH of my AV scanners - that's four scans in all
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829
Re: 5.6.7b2405
I only noticed that double scanning when the Mirror feature is activated.
I didn't find a way to disable this second AV scanning just before message is forwarded to the mirror address.
NB: only "Use ClamAV" is defined.
I didn't find a way to disable this second AV scanning just before message is forwarded to the mirror address.
NB: only "Use ClamAV" is defined.
- jimimaseye
- Moderator
- Posts: 10053
- Joined: 2011-09-08 17:48
Re: 5.6.7b2405
I just did a test an my emails only get scanned once (note: I only have 1x AV implemented):mattg wrote:I've also noticed that my AntiVirus (only AV not AntiSPAM) get done twice for each received email...
...
Thats a similar result to yours for the CLAMAV scan (ie, just the once) but you also have the external scanner running and its this externa scanner that seems to get called upon twice (according to your log)."APPLICATION" 4216 "2017-02-21 14:04:26.407" "SMTPDeliverer - Message 343513: Delivering message from mail-2012@yahoo.net to sylvester@mydomain.net. File: D:\Datastore\hMailData\{4B07A6DF-731F-4C70-ADE1-0FF9C8352FBB}.eml"
"DEBUG" 4216 "2017-02-21 14:04:26.407" "Executing event OnDeliveryStart"
"DEBUG" 4216 "2017-02-21 14:04:26.407" "Event completed"
"DEBUG" 4216 "2017-02-21 14:04:26.407" "Connecting to ClamAV virus scanner..."
"DEBUG" 4216 "2017-02-21 14:04:26.407" "Connecting to ClamAV stream port..."
"SMTPD" 2220 2446 "2017-02-21 14:04:26.516" "212.82.96.252" "RECEIVED: QUIT"
"SMTPD" 2220 2446 "2017-02-21 14:04:26.516" "212.82.96.252" "SENT: 221 goodbye"
"DEBUG" 4600 "2017-02-21 14:04:26.516" "Ending session 2446"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "No virus detected: stream: OK"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rules"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rule DeleteKnownSPAM"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rule External Spam Score 7"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rule DeleteAutoReplywithSpam"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rule ContactRequesttoAlan"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Performing local delivery"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rules"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rule fromCOM"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Applying rule Alias forwarding"
"DEBUG" 4216 "2017-02-21 14:04:27.514" "Saving message: {4B07A6DF-731F-4C70-ADE1-0FF9C8352FBB}.eml"
"DEBUG" 4216 "2017-02-21 14:04:27.608" "Reading messages from database."
"DEBUG" 4216 "2017-02-21 14:04:27.608" "Local delivery completed"
"APPLICATION" 4216 "2017-02-21 14:04:27.608" "SMTPDeliverer - Message 343513: Message delivery thread completed."
I wonder if there is an issue with HMS when calling an external scanner?
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829
Re: 5.6.7b2405
notice that mine picks up once from the data directory and once from the temp directory
Some messages are scanned once
This one looks like it was scanned three times!!!
This message is an automated message from the AVAST console on the client's server. It gives me a report on all computers in the client network.
Some messages are scanned once
This one looks like it was scanned three times!!!
This message is an automated message from the AVAST console on the client's server. It gives me a report on all computers in the client network.
Code: Select all
"DEBUG" 6232 "2017-02-22 00:00:01.467" "Creating session 1733"
"TCPIP" 6232 "2017-02-22 00:00:01.467" "TCP - xxx.xxx.xxx.xxx connected to 10.10.10.10:465."
"DEBUG" 6232 "2017-02-22 00:00:01.467" "Executing event OnClientConnect"
"DEBUG" 6232 "2017-02-22 00:00:01.483" "Event completed"
"DEBUG" 6232 "2017-02-22 00:00:01.483" "TCP connection started for session 1724"
"DEBUG" 6232 "2017-02-22 00:00:01.483" "Performing SSL/TLS handshake for session 1724. Verify certificate: False"
"TCPIP" 6176 "2017-02-22 00:00:02.042" "TCPConnection - TLS/SSL handshake completed. Session Id: 1724, Remote IP: xxx.xxx.xxx.xxx, Version: TLSv1, Cipher: DHE-RSA-AES128-SHA, Bits: 128"
"SMTPD" 6176 1724 "2017-02-22 00:00:02.042" "xxx.xxx.xxx.xxx" "SENT: 220 **mydomain.com** ESMTP"
"SMTPD" 6232 1724 "2017-02-22 00:00:02.307" "xxx.xxx.xxx.xxx" "RECEIVED: EHLO server2012"
"SMTPD" 6232 1724 "2017-02-22 00:00:02.322" "xxx.xxx.xxx.xxx" "SENT: 250-**mydomain.com**[nl]250-SIZE[nl]250-AUTH LOGIN[nl]250 HELP"
"SMTPD" 6176 1724 "2017-02-22 00:00:02.354" "xxx.xxx.xxx.xxx" "RECEIVED: AUTH LOGIN"
"SMTPD" 6176 1724 "2017-02-22 00:00:02.354" "xxx.xxx.xxx.xxx" "SENT: 334 VXNlcm5hbWU6"
"SMTPD" 5908 1724 "2017-02-22 00:00:02.385" "xxx.xxx.xxx.xxx" "RECEIVED: ***redacted****"
"SMTPD" 5908 1724 "2017-02-22 00:00:02.385" "xxx.xxx.xxx.xxx" "SENT: 334 UGFzc3dvcmQ6"
"SMTPD" 6176 1724 "2017-02-22 00:00:02.416" "xxx.xxx.xxx.xxx" "RECEIVED: ***"
"SMTPD" 6176 1724 "2017-02-22 00:00:02.416" "xxx.xxx.xxx.xxx" "SENT: 235 authenticated."
"SMTPD" 6232 1724 "2017-02-22 00:00:02.520" "xxx.xxx.xxx.xxx" "RECEIVED: MAIL FROM:<**MyClient**@**mydomain.com**> SIZE=314288"
"SMTPD" 6232 1724 "2017-02-22 00:00:02.520" "xxx.xxx.xxx.xxx" "SENT: 250 OK"
"SMTPD" 6176 1724 "2017-02-22 00:00:02.551" "xxx.xxx.xxx.xxx" "RECEIVED: RCPT TO:<**MyClient**@**mydomain.com**>"
"SMTPD" 6176 1724 "2017-02-22 00:00:02.551" "xxx.xxx.xxx.xxx" "SENT: 250 OK"
"SMTPD" 5908 1724 "2017-02-22 00:00:02.582" "xxx.xxx.xxx.xxx" "RECEIVED: DATA"
"DEBUG" 5908 "2017-02-22 00:00:02.582" "Executing event OnSMTPData"
"DEBUG" 5908 "2017-02-22 00:00:02.696" "Event completed"
"SMTPD" 5908 1724 "2017-02-22 00:00:02.696" "xxx.xxx.xxx.xxx" "SENT: 354 OK, send."
"DEBUG" 6944 "2017-02-22 00:00:05.754" "Adding task AsynchronousTask to work queue Asynchronous task queue"
"DEBUG" 6296 "2017-02-22 00:00:05.754" "Executing task AsynchronousTask in work queue Asynchronous task queue"
"DEBUG" 6296 "2017-02-22 00:00:05.754" "Executing event OnAcceptMessage"
"DEBUG" 6296 "2017-02-22 00:00:06.004" "Event completed"
"DEBUG" 6296 "2017-02-22 00:00:06.004" "Saving message: {2779B59A-36A2-438B-8013-2A5F943FCAA3}.eml"
"DEBUG" 6296 "2017-02-22 00:00:06.004" "Requesting SMTPDeliveryManager to start message delivery"
"SMTPD" 6296 1724 "2017-02-22 00:00:06.004" "xxx.xxx.xxx.xxx" "SENT: 250 Queued (3.072 seconds)"
"DEBUG" 7040 "2017-02-22 00:00:06.020" "Adding task DeliveryTask to work queue SMTP delivery queue"
"DEBUG" 3380 "2017-02-22 00:00:06.020" "Executing task DeliveryTask in work queue SMTP delivery queue"
"DEBUG" 3380 "2017-02-22 00:00:06.020" "Delivering message..."
"APPLICATION" 3380 "2017-02-22 00:00:06.020" "SMTPDeliverer - Message 842205: Delivering message from **MyClient**@**mydomain.com** to **MyClient**@**mydomain.com**. File: c:\hMailServer\Data\{2779B59A-36A2-438B-8013-2A5F943FCAA3}.eml"
"DEBUG" 3380 "2017-02-22 00:00:06.020" "Executing event OnDeliveryStart"
"DEBUG" 3380 "2017-02-22 00:00:06.035" "Event completed"
"DEBUG" 3380 "2017-02-22 00:00:06.035" "Running custom virus scanner..."
"SMTPD" 6944 1724 "2017-02-22 00:00:06.051" "xxx.xxx.xxx.xxx" "RECEIVED: QUIT"
"SMTPD" 6944 1724 "2017-02-22 00:00:06.051" "xxx.xxx.xxx.xxx" "SENT: 221 goodbye"
"DEBUG" 6176 "2017-02-22 00:00:06.051" "Ending session 1724"
"DEBUG" 3380 "2017-02-22 00:00:12.801" "Scanner: C:\Program Files\AVAST Software\Avast Business\ashcmd.exe c:\hMailServer\Data\{2779B59A-36A2-438B-8013-2A5F943FCAA3}.eml /t=A /s /p=2 /d. Return code: 0"
"DEBUG" 3380 "2017-02-22 00:00:12.801" "Connecting to ClamAV virus scanner..."
"DEBUG" 3380 "2017-02-22 00:00:12.816" "Connecting to ClamAV stream port..."
"DEBUG" 3380 "2017-02-22 00:00:12.973" "No virus detected: stream: OK"
"DEBUG" 3380 "2017-02-22 00:00:12.988" "Running custom virus scanner..."
"DEBUG" 3380 "2017-02-22 00:00:19.441" "Scanner: C:\Program Files\AVAST Software\Avast Business\ashcmd.exe C:\hMailServer\Temp\{F58FC07E-67D0-475A-A1C0-6A3E21D1C0CB}.tmp /t=A /s /p=2 /d. Return code: 0"
"DEBUG" 3380 "2017-02-22 00:00:19.441" "Connecting to ClamAV virus scanner..."
"DEBUG" 3380 "2017-02-22 00:00:19.441" "Connecting to ClamAV stream port..."
"DEBUG" 3380 "2017-02-22 00:00:19.457" "No virus detected: stream: OK"
"DEBUG" 3380 "2017-02-22 00:00:19.473" "Running custom virus scanner..."
"DEBUG" 3380 "2017-02-22 00:00:26.645" "Scanner: C:\Program Files\AVAST Software\Avast Business\ashcmd.exe C:\hMailServer\Temp\{F8D8207E-BF86-4227-B08B-BB487C2D9656}.tmp /t=A /s /p=2 /d. Return code: 0"
"DEBUG" 3380 "2017-02-22 00:00:26.645" "Connecting to ClamAV virus scanner..."
"DEBUG" 3380 "2017-02-22 00:00:26.660" "Connecting to ClamAV stream port..."
"DEBUG" 3380 "2017-02-22 00:00:26.660" "No virus detected: stream: OK"
"DEBUG" 3380 "2017-02-22 00:00:26.660" "Applying rules"
"DEBUG" 3380 "2017-02-22 00:00:26.660" "Applying rule SPAM"
"DEBUG" 3380 "2017-02-22 00:00:26.660" "Applying rule Spam Senders"
"DEBUG" 3380 "2017-02-22 00:00:26.660" "Applying rule Delayed one hour"
"DEBUG" 3380 "2017-02-22 00:00:26.660" "Applying rule Delayed one day"
"DEBUG" 3380 "2017-02-22 00:00:26.660" "Applying rule Avast Virus"
"DEBUG" 3380 "2017-02-22 00:00:26.660" "Applying rule vouchers"
"DEBUG" 3380 "2017-02-22 00:00:26.660" "Applying rule Windows Insider"
"DEBUG" 3380 "2017-02-22 00:00:26.676" "Applying rule Clam Virus"
"DEBUG" 3380 "2017-02-22 00:00:26.676" "Applying rule Backups"
"DEBUG" 3380 "2017-02-22 00:00:26.676" "Applying rule logs"
...
****some removed here***
...
"DEBUG" 3380 "2017-02-22 00:00:26.676" "Applying rule Test header log"
"DEBUG" 3380 "2017-02-22 00:00:26.676" "Performing rule action"
"DEBUG" 3380 "2017-02-22 00:00:26.676" "Executing event Unknown"
"DEBUG" 3380 "2017-02-22 00:00:27.035" "Event completed"
"DEBUG" 3380 "2017-02-22 00:00:27.035" "Applying rule SSSSSSSS"
"DEBUG" 3380 "2017-02-22 00:00:27.035" "Applying rule LLLLLLLLL"
"DEBUG" 3380 "2017-02-22 00:00:27.035" "Executing event OnMessageDeliver"
"DEBUG" 3380 "2017-02-22 00:00:27.051" "Event completed"
"DEBUG" 3380 "2017-02-22 00:00:27.051" "Performing local delivery"
"DEBUG" 3380 "2017-02-22 00:00:27.051" "Applying rules"
"DEBUG" 3380 "2017-02-22 00:00:27.051" "Applying rule move"
"DEBUG" 3380 "2017-02-22 00:00:27.051" "Performing rule action"
"DEBUG" 3380 "2017-02-22 00:00:27.051" "Performing rule action"
"DEBUG" 3380 "2017-02-22 00:00:27.051" "Executing event Unknown"
"DEBUG" 3380 "2017-02-22 00:00:27.066" "Event completed"
"DEBUG" 3380 "2017-02-22 00:00:27.082" "Performing rule action"
"DEBUG" 3380 "2017-02-22 00:00:27.082" "Executing event Unknown"
"DEBUG" 3380 "2017-02-22 00:00:27.113" "Event completed"
"DEBUG" 3380 "2017-02-22 00:00:27.129" "Moving message to #shared.**domain**.server.**MyClient**"
"DEBUG" 3380 "2017-02-22 00:00:27.129" "Message moved to folder 386"
"DEBUG" 3380 "2017-02-22 00:00:27.176" "Saving message: {2779B59A-36A2-438B-8013-2A5F943FCAA3}.eml"
"DEBUG" 3380 "2017-02-22 00:00:27.207" "AWStats::LogDeliverySuccess"
"DEBUG" 3380 "2017-02-22 00:00:27.207" "Local delivery completed"
"APPLICATION" 3380 "2017-02-22 00:00:27.207" "SMTPDeliverer - Message 842205: Message delivery thread completed."
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation
- jimimaseye
- Moderator
- Posts: 10053
- Joined: 2011-09-08 17:48
Re: 5.6.7b2405
If you do a test and send in a message with just CLAMAV enabled (no external virus scanner) for the purpose of that single test, does the email get scanner multiple times?
Or even the opposite (no CLamav, and only Avast enabled)? What happens?
Or even the opposite (no CLamav, and only Avast enabled)? What happens?
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829
Re: 5.6.7b2405
Same Automated message tonight, also gives three AV scans....mattg wrote:This one looks like it was scanned three times!!!
This message is an automated message from the AVAST console on the client's server. It gives me a report on all computers in the client network.
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation
Re: 5.6.7b2405
@mattg
Does the message contain images or such? I think the extra scans are related to files/images (both inline & attached)
Does the message contain images or such? I think the extra scans are related to files/images (both inline & attached)
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup
Re: 5.6.7b2405
Ahhh
Yep that is what is happening.
Once for the message, once each for the attachments (attachments scanned from temp directory)
(btw the same thing was happening with only one AV enabled)
Yep that is what is happening.
Once for the message, once each for the attachments (attachments scanned from temp directory)
(btw the same thing was happening with only one AV enabled)
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation
https://www.hmailserver.com/documentation