> I am now written a amavisd-new log analysis program by PHP
> and found the following log entries:
> 1. Duplicate Message-ID (Message-ID: Message-ID:)
> Oct 24 07:45:13 mta amavis: (01766-03) Passed SPAM, [188.8.131.52]
> <ixnqnspbqsv@...> -> <hidden destination email>, quarantine:
> spam-44a7831b6ce6ca9c009ac4589c1fea5f-20041024-074506-01766-03, Message-ID:
> Message-ID: <KTYOMMO$oxjW$O4S6@>, Hits: 23.884, 6314 ms
As Clifton wrote, it is most likely this was in the actual mail.
It is an illegal Message-ID alright. I'll think of some solution
for the 2.2.0 release to get whitespace and newlines in such illegal
Message-ID protected in the log (e.g. space turned into \040 or
something), to facilitate log parsing.
> 2. Space after Message-ID and before comma (com> , Hits:)
This must have come from the original mail as well.
The whitespace quoting will help here too.
> 3. No ">" for Message-ID (Message-ID: <K[20,)
> Oct 25 13:40:33 mta amavis: (13975-09) Passed SPAM, [184.108.40.206]
> <dvwvbkitoo@...> -> <hidden destination email>, quarantine:
> spam-d41d8cd98f00b204e9800998ecf8427e-20041025-134031-13975-09, Message-ID:
> <K[20, Hits: 24.301, 2862 ms
> Is it normal?
If such junk was actually in the mail, this is normal.
When parsing, look for the /, / to terminate the Message-ID:,
and I'll see that no blank is present withing the string.