OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
"message too large" not logged in syslog

From: Ralf Hildebrandt (Ralf.Hildebrandtcharite.de)
Date: Tue Aug 22 2006 - 08:34:27 CDT


A former collegue of mine complained that a message is not being sent
out. I had a look around.

The log read like this:

Aug 22 15:29:29 outpost postfix/smtpd[10757]: connect from isnb212.stahl.bau.tu-bs.de[134.169.66.212]
Aug 22 15:29:29 outpost postfix/smtpd[10757]: 3F10BCF152: client=isnb212.stahl.bau.tu-bs.de[134.169.66.212]
Aug 22 15:29:44 outpost postfix/cleanup[10760]: 3F10BCF152: message-id=<20060822132929.3F10BCF152outpost.stahl.bau.tu-bs.de>
Aug 22 15:30:02 outpost postfix/smtpd[10757]: disconnect from isnb212.stahl.bau.tu-bs.de[134.169.66.212]

# grep 3F10BCF152 /var/log/mail.log
Aug 22 15:29:29 outpost postfix/smtpd[10757]: 3F10BCF152: client=isnb212.stahl.bau.tu-bs.de[134.169.66.212]
Aug 22 15:29:44 outpost postfix/cleanup[10760]: 3F10BCF152: message-id=<20060822132929.3F10BCF152outpost.stahl.bau.tu-bs.de>

By using "debug_peer_list = 134.169.66.186" is found out this (it's
another machine that's sending the same, big file)

Aug 22 15:23:52 outpost postfix/smtpd[10366]: < ispc186.stahl.bau.tu-bs.de[134.169.66.186]: DATA
Aug 22 15:23:52 outpost postfix/smtpd[10366]: > ispc186.stahl.bau.tu-bs.de[134.169.66.186]: 354 End data with <CR><LF>.<CR><LF>
Aug 22 15:24:14 outpost postfix/smtpd[10366]: > ispc186.stahl.bau.tu-bs.de[134.169.66.186]: 552 Error: message too large
Aug 22 15:24:17 outpost postfix/smtpd[10366]: < ispc186.stahl.bau.tu-bs.de[134.169.66.186]: QUIT
Aug 22 15:24:17 outpost postfix/smtpd[10366]: > ispc186.stahl.bau.tu-bs.de[134.169.66.186]: 221 Bye

So, Postfix complains that the message is too large, but this is never
logged -- unless I go for the debug_peer_list option.

mail_version = 2.3.2

--
Ralf Hildebrandt (Ralf.Hildebrandtcharite.de) spamtrapcharite.de
Postfix - Einrichtung, Betrieb und Wartung Tel. +49 (0)30-450 570-155
http://www.postfix-buch.com
"f u cn rd ths, u cn gt a gd jb n cmptr prgmmng." -Anon.