The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Exim filter issue since CP 11

Discussion in 'General Discussion' started by Angel78, May 21, 2007.

  1. Angel78

    Angel78 Well-Known Member

    Joined:
    May 9, 2002
    Messages:
    413
    Likes Received:
    1
    Trophy Points:
    16
    When I try to deliver email sitting in the queue
    I get this error:

    In thea header of the mail there is this : "0.4 (/)" but it is beeing set by the MS Outlook:

    Is this a Exim issue or has nothing to to with server setup (didnt have these issues before the CP 11 upgrade)


    thank you.
     
  2. thedavid

    thedavid Well-Known Member

    Joined:
    Nov 22, 2002
    Messages:
    124
    Likes Received:
    0
    Trophy Points:
    16
    Check for this, or something similar to it in the users spamassassin configuration file (inside their home directory, in .spamassassin/user_prefs ):

    add_header all Score _SCORE(00)_

    This option will 'pad' the score, so a score of 12.4 will end up looking like .124 or something similar. It's not from microsoft outlook at all.
     
  3. visiox

    visiox Well-Known Member

    Joined:
    Jan 19, 2004
    Messages:
    49
    Likes Received:
    0
    Trophy Points:
    6
    Had the same problem!
    It came from a "faked" email header. Spammers hope that this header will make spamassassin believe that it's already checked and will be delivered without scanning.

    I changed the mailheader within the file (spool directory) and it ended as SPAM after processing ;)
     
  4. WindyT

    WindyT Active Member

    Joined:
    Nov 30, 2004
    Messages:
    39
    Likes Received:
    0
    Trophy Points:
    6
    I also had this issue, but it affected legitimate emails. Three emails that I could tell, over the span of two days. I'm not sure why, and it bugs me, but since there's no obvious continuing problem, I'll just keep an eye out.

    --CentOS4.5 around the time I upgraded the kernel and I think before I upgraded to CP11 --
     
  5. WindyT

    WindyT Active Member

    Joined:
    Nov 30, 2004
    Messages:
    39
    Likes Received:
    0
    Trophy Points:
    6
    Update: A quick look at the tail of my exim_paniclog provides scores of examples:
    Code:
    2007-05-26 18:41:55 1Hr8pI-00080X-95 Error in system filter: malformed numerical string "(-2.971) BAYES_00"
    2007-05-26 18:42:54 1HrRZw-00038R-Ty Error in system filter: malformed numerical string "0.00 () [Tag at 10.00]"
    2007-05-26 19:20:03 1Hp3e9-0004AY-GG Error in system filter: malformed numerical string "0.60 () [Tag at 10.00] J_CHICKENPOX_73"
    2007-05-26 19:20:10 1Hr8pI-00080X-95 Error in system filter: malformed numerical string "(-2.971) BAYES_00"
    2007-05-26 19:20:32 1HqcZC-0008CQ-3v Error in system filter: malformed numerical string "12.116"
    2007-05-26 19:23:21 1Hpmmx-0001M6-DL Error in system filter: malformed numerical string "0.648 (NO_REAL_NAME,SPF_HELO_PASS,SPF_PASS)"
    2007-05-26 19:23:59 1HrENg-0006S9-FA Error in system filter: malformed numerical string "1.728"
    2007-05-26 19:24:19 1Hp4DU-0001tw-Sv Error in system filter: malformed numerical string "0.00%"
    2007-05-26 19:24:19 1HqAQU-0006rz-SF Error in system filter: malformed numerical string "2.705"
    2007-05-26 19:24:48 1HrRZw-00038R-Ty Error in system filter: malformed numerical string "0.00 () [Tag at 10.00]"
    I saw a CHICKENPOX error yesterday, so I pulled that filter out and restarted exim then. I'm not sure why I'm getting that now, too. Earlier today, I dumped my Bayes filter database.

    I think I need help on this one. Do I need to force reinstall SpamAssassin?
     
  6. WindyT

    WindyT Active Member

    Joined:
    Nov 30, 2004
    Messages:
    39
    Likes Received:
    0
    Trophy Points:
    6
    UPDATE: After a closer look at my issue above, it was only a handful that were the problem, and after deleting them from the spool, it looks like whatever caused them has gone.
     
  7. d_t

    d_t Well-Known Member

    Joined:
    Sep 20, 2003
    Messages:
    243
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    Bucharest
  8. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider
    Its not a bug, what you are seeing is a lame attempt by spammers to forge an X-Spam-Score header.
     
  9. d_t

    d_t Well-Known Member

    Joined:
    Sep 20, 2003
    Messages:
    243
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    Bucharest
    No, it's a bug, please read the bug report.

    I agree that those headers with X-Spam-Score might be added by spammers, but exim system filter should be able to process those mails too, no matter of headers. Right now, they are kept in mail queue (because of the error in system filter).
     
  10. Angel78

    Angel78 Well-Known Member

    Joined:
    May 9, 2002
    Messages:
    413
    Likes Received:
    1
    Trophy Points:
    16
    hi, sorry but mails sitting in the queue are by custores of one of the websites (happens to few domains) and NO they are not spammers.
     
  11. karl.frank

    karl.frank Registered

    Joined:
    Feb 23, 2006
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    It's anoying. Our mailspooler gets filled with hundreds of regular emails (definetely NOT spam) and when I try to deliver them through WHM mail queue I get messages like

    Message 1HrdJE-0001lk-4L is not frozen
    delivering 1HrdJE-0001lk-4L
    LOG: MAIN PANIC
    Error in system filter: malformed numerical string "1.6 (+)\n6"

    and the /var/log/exim_paniclog contains thousands of lines like

    2007-05-30 14:42:43 1HrYR9-0003Y2-NC Error in system filter: malformed numerical string "0.1 (/)\n-23"
    2007-05-30 14:49:43 1HsdD3-0005mi-4H Error in system filter: malformed numerical string "4.05\n1"
    2007-05-30 14:51:37 1HrYR9-0003Y2-NC Error in system filter: malformed numerical string "0.1 (/)\n-23"
    2007-05-30 14:51:41 1HrdJE-0001lk-4L Error in system filter: malformed numerical string "1.6 (+)\n6"
    2007-05-30 14:54:32 1HrdJE-0001lk-4L Error in system filter: malformed numerical string "1.6 (+)\n6"

    When will this problem be solved, because there are some very important emails for our customers in that stupid mail queue which can't be delivered!!!!

    Karl-Uwe
     
  12. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider
    Or just disable it in the exim config editor in whm as your change will be overwritten.
     
  13. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider
    Better yet

    replace /usr/local/cpanel/etc/exim/sysfilter/options/fail_spam_score_over_200

    with the attached one

    run

    /scripts/buildeximconf
    /scripts/restartsrv exim



    (this will get overwritten on upcp, but it should be in the next version anyways as long as qa approves)
     

    Attached Files:

  14. Angel78

    Angel78 Well-Known Member

    Joined:
    May 9, 2002
    Messages:
    413
    Likes Received:
    1
    Trophy Points:
    16


    So for those that cant wait next Current will solve this issue?

    :)
     
    #14 Angel78, May 30, 2007
    Last edited: May 30, 2007
  15. Rodney-E2

    Rodney-E2 Member
    PartnerNOC

    Joined:
    Jun 25, 2005
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Houston, TX
    This is working perfectly for us now.
     
  16. Angel78

    Angel78 Well-Known Member

    Joined:
    May 9, 2002
    Messages:
    413
    Likes Received:
    1
    Trophy Points:
    16

    you applied nick's workaround or is the fix in new current ?
     
  17. Angel78

    Angel78 Well-Known Member

    Joined:
    May 9, 2002
    Messages:
    413
    Likes Received:
    1
    Trophy Points:
    16
    upgrade to :

    WHM 11.1.0 cPanel 11.2.19-C12737

    sollved this problem (or removed emails from the MQ :D )
     
Loading...

Share This Page