The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

central_filter defer

Discussion in 'E-mail Discussions' started by headout, Sep 25, 2007.

  1. headout

    headout Well-Known Member

    Joined:
    Aug 20, 2003
    Messages:
    78
    Likes Received:
    0
    Trophy Points:
    6
    Hi all,

    exim is giving me an error at just one domain:
    Code:
    2007-09-24 21:40:58 [52907] 1IYjDc-000Ji6-K9 == email@domain.ext R=central_filter defer (-17): error in filter file: malformed numerical string ""
    /etc/vfilter/domain.ext:
    Code:
    # Exim filter
    
    if not first_delivery and error_message then finish endif
    
    if
     $h_X-Spam-Score: is above "33"
    then
     deliver "spambox@domain.ext"
    endif
    
    /usr/home/user/.filter:
    Code:
    $h_X-Spam-Score: is above "33"+++++++spambox@domain.ext
    Looking to topics @ this forum, i found out the error had something to do with these filters. When i replace the filter in his cPanel account, the errors disappear. But then his filtering doesn't work the way this customer wants.
     
  2. sehh

    sehh Well-Known Member

    Joined:
    Feb 11, 2006
    Messages:
    579
    Likes Received:
    5
    Trophy Points:
    18
    Location:
    Europe
    I'm confused, which filter of the two is used by cPanel v11? the /home/user/.filter or the /etc/vfilter/user ?
     
  3. headout

    headout Well-Known Member

    Joined:
    Aug 20, 2003
    Messages:
    78
    Likes Received:
    0
    Trophy Points:
    6
    Well, that's something i'm trying to find out, also. The search at this forum does not give a 100% answer.
     
  4. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,383
    Likes Received:
    23
    Trophy Points:
    38
    cPanel Access Level:
    Root Administrator
    I'm not sure in regards to this either, but I was kind of under the impression that /home/user/.filter was read by the control panel when reading what filters you have set up. Another words, when you log into your control panel and list the filters you have set up, it reads this file.

    /etc/vfilter/domain.ext is the filter that is actually used by exim when delivering mail.

    So it is possible to manually remove a rule in /etc/vfilter/domain.ext and it would still be displayed in the user's control panel.

    You could also remove a rule from /home/user/.filter but the rule would still be applied so long as it is still in /etc/vfilter/domain.ext.

    I don't know if this is the case. I seem to recall doing a bit of testing regarding this a few years ago and this is what I found.

    I'm not sure why cPanel does this and I really thought that this wasn't always the case. The /home/user/.filter is something that is relatively new I thought. I thought cPanel used to read /home/user/.filter both from the control panel and with mail delivery.

    But again, I'm not even sure if I'm right with this.
     
  5. headout

    headout Well-Known Member

    Joined:
    Aug 20, 2003
    Messages:
    78
    Likes Received:
    0
    Trophy Points:
    6
    Sparek-3, thanks for explaining.

    When removing the filter, /var/log/exim/mainlog (freeBSD) doesn't show the error no longer. But removing the filter is not wanted.
     
  6. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,383
    Likes Received:
    23
    Trophy Points:
    38
    cPanel Access Level:
    Root Administrator
    The only thing I can think of is perhaps its the quotation marks around 33.

    Instead of:

    $h_X-Spam-Score: is above "33"

    Try:

    $h_X-Spam-Score: is above 33

    in the /etc/vfilter/domain.ext file.

    You may have to manually edit the file. If you entered this via the cPanel interface and it added the quotation marks itself and the quotation marks is what is causing your problem, then this would appear to be a bug in cPanel.
     
  7. sehh

    sehh Well-Known Member

    Joined:
    Feb 11, 2006
    Messages:
    579
    Likes Received:
    5
    Trophy Points:
    18
    Location:
    Europe
    You should probably avoid using X-Spam-Score because due to a bug the decimal character is lost:

    From score 33.3 you get:

    X-Spam-Score: 333
     
  8. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,383
    Likes Received:
    23
    Trophy Points:
    38
    cPanel Access Level:
    Root Administrator
    Is it a bug that the decimal is missing?

    I thought X-Spam-Score just referred to the actual spam score multiplied by 10, in an intentional manner to avoid the decimal point.

    This way an X-Spam-Score of 33 is actually referring to a message that has a spam score of 3.3. As long as everyone goes into this knowing the multiplication (or dividing, depending on which way you are going) then its all the same.
     
  9. sehh

    sehh Well-Known Member

    Joined:
    Feb 11, 2006
    Messages:
    579
    Likes Received:
    5
    Trophy Points:
    18
    Location:
    Europe
    oh? i was told that its a bug and that the decimal place was missing...

    which one is true then?!
     
  10. cPanelDavidG

    cPanelDavidG Technical Product Specialist

    Joined:
    Nov 29, 2006
    Messages:
    11,279
    Likes Received:
    8
    Trophy Points:
    38
    Location:
    Houston, TX
    cPanel Access Level:
    Root Administrator
    Sparek-3 is correct. The reason for removing the decimal was to remove all the weird problems that could arise from generating filters that make use of a decimal point.
     
  11. headout

    headout Well-Known Member

    Joined:
    Aug 20, 2003
    Messages:
    78
    Likes Received:
    0
    Trophy Points:
    6
    Okee, we did yesterday.
    Code:
    # Exim filter
    
    if not first_delivery and error_message then finish endif
    
    if
     $h_X-Spam-Status: is above 33
    then
     deliver "spambox@domain.ext
    endif
    
    The follow up is now, that we say all of this kind messages in our exim mainlog:
    Code:
    2007-09-27 00:32:24 [20278] 1IafQZ-0005H1-78 == redactie@devoko.nl R=central_filter defer (-17): error in filter file: malformed numerical string "Yes, score=15.9"
    
     
  12. mctDarren

    mctDarren Well-Known Member

    Joined:
    Jan 6, 2004
    Messages:
    664
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    New Jersey
    cPanel Access Level:
    Root Administrator
    [ Edit: Whoops, I missed the tail end of the thread. Sorry. ]

    You're getting that message because the status block has text in it and you are trying to do a math operation on it. Plus you're missing your closing quote on your deliver line (typo?).
     
    #12 mctDarren, Sep 27, 2007
    Last edited: Sep 27, 2007
  13. mctDarren

    mctDarren Well-Known Member

    Joined:
    Jan 6, 2004
    Messages:
    664
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    New Jersey
    cPanel Access Level:
    Root Administrator
    The only thing I can think of is to use the X-Spam-Bar instead:

    Code:
    if
     $h_X-Spam-Bar =~ /+{33,}/
    then
     deliver spambox@domain.ext
    endif
    
    Above is untested, but if you want to block at filter where spam score is 33 or greater this might do it...? Not much sleep last night, so apologies if I'm way off. :D
     
  14. sparek-3

    sparek-3 Well-Known Member

    Joined:
    Aug 10, 2002
    Messages:
    1,383
    Likes Received:
    23
    Trophy Points:
    38
    cPanel Access Level:
    Root Administrator
    You changed variables.

    In your original post you are referencing:

    $h_X-Spam-Score

    Now in a later post you are referencing:

    $h_X-Spam-Status

    These are completely different and cannot be treated the same.

    You want to use $h_X-Spam-Score as it only contains a number. The value stored here will be the spam score multiplied by 10 so as to remove the decimal.

    A spam message that scores 5.6 will have a $h_X-Spam-Score value of 56.
     
  15. mctDarren

    mctDarren Well-Known Member

    Joined:
    Jan 6, 2004
    Messages:
    664
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    New Jersey
    cPanel Access Level:
    Root Administrator
    That's the reason for my edited post, and my alternative method that I posted - score changed to status. I am assuming, headout, that you did this because someone advised you not to use score? If you do want to use score, follow sparek-3. He's spot on. :)
     
  16. headout

    headout Well-Known Member

    Joined:
    Aug 20, 2003
    Messages:
    78
    Likes Received:
    0
    Trophy Points:
    6
    No, it's my mistake to use $h_X-Spam-Status instead of $h_X-Spam-Score. I corrected it, and am now tailing my exim logfiles.
     
Loading...

Share This Page