[EXIM] Logwatch: BAD FORMAT (Possible data corruption or Exim bug)

IPaddress · Oct 1, 2009

Hi!
Im running Directadmin 1.33.7 on a CentOS release 5 (Final) with Logwatch 5.2.2-0.1.2.el5.rf (last version).

Logwatch is reporting me these:

Code:

  --------------------- EXIM Begin ------------------------ 
 ***** BAD FORMAT (Possible data corruption or Exim bug) *****
 --- Queue Runners ---
 
 --- Refused Relays 45713 times
 
 --- Bad Hosts ---
 Didn't Summarize: 2009-09-30 07:05:42 SMTP command timeout on TLS connection from some.server.com [www.xxx.yyy.zzz]
 Didn't Summarize: 2009-09-30 20:05:15 SMTP command timeout on TLS connection from someother.server.com [aaa.bbb.ccc.ddd]
   Rejected HELO/EHLO: syntactically invalid argument(s) 138 times
   SMTP Syntax errors 42 times
   SMTP Timeout errors 288 times
   Sudden disconnect while expecting remote input 15868 times
 
 --- SMTP Connection Issues 
   SMTP connection lost while reading message data: 51 Time(s)

 **Unmatched Entries**
... Nothing important ... (Bounces)

  ---------------------- EXIM End -------------------------

My exim.conf looks like this: (I've eliminated all the coments to make it readable)

Code:

 perl_startup = do '/etc/exim.pl'


system_filter = /etc/system_filter.exim


daemon_smtp_ports = 25 : 587

message_size_limit = 20M
smtp_receive_timeout = 5m
smtp_accept_max = 100
message_body_visible = 3000
print_topbitchars = true


helo_allow_chars = _


log_selector = \
  -delivery_size \
  -sender_on_delivery \
  -received_recipients \
  -received_sender \
  -smtp_confirmation \
  -subject \
  -smtp_incomplete_transaction \
  -dnslist_defer \
  -host_lookup_failed \
  -queue_run \
  -rejected_header \
  -retry_defer \
  -skip_delivery

syslog_duplication = false


acl_smtp_rcpt = check_recipient
acl_smtp_data = check_message


addresslist whitelist_senders = lsearch;/etc/virtual/whitelist_senders
addresslist blacklist_senders = lsearch;/etc/virtual/blacklist_senders
domainlist blacklist_domains = lsearch;/etc/virtual/blacklist_domains
domainlist whitelist_domains = lsearch;/etc/virtual/whitelist_domains
domainlist local_domains = lsearch;/etc/virtual/domains
domainlist relay_domains = lsearch;/etc/virtual/domains : localhost
domainlist use_rbl_domains = lsearch;/etc/virtual/use_rbl_domains
hostlist auth_relay_hosts = *
hostlist bad_sender_hosts = lsearch;/etc/virtual/bad_sender_hosts
hostlist bad_sender_hosts_ip = net-lsearch;/etc/virtual/bad_sender_hosts
hostlist relay_hosts = net-lsearch;/etc/virtual/pophosts : 127.0.0.1
hostlist whitelist_hosts = lsearch;/etc/virtual/whitelist_hosts
hostlist whitelist_hosts_ip = net-lsearch;/etc/virtual/whitelist_hosts





allow_domain_literals = false


never_users = root


host_lookup = *


rfc1413_hosts = *
rfc1413_query_timeout = 0s



ignore_bounce_errors_after = 2d


timeout_frozen_after = 5d


trusted_users = mail:majordomo:apache:diradmin

tls_certificate = /etc/exim.cert
tls_privatekey = /etc/exim.key

tls_advertise_hosts = *


begin acl

check_recipient:

  deny  domains       = +local_domains
        local_parts   = ^[.] : ^.*[@%!/|]

accept  hosts = +auth_relay_hosts
        condition = ${if eq {$interface_port}{587} {yes}{no}}
        endpass
        message = relay not permitted, authentication required
        authenticated = *

  deny  domains       = !+local_domains
        local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./

  accept  hosts = :

  accept  sender_domains = +whitelist_domains

  accept  hosts = +whitelist_hosts
  accept  hosts = +whitelist_hosts_ip

  accept  senders = +whitelist_senders

  accept  local_parts = postmaster
          domains     = +local_domains

  accept  local_parts = abuse
          domains     = +local_domains

  accept  local_parts = hostmaster
          domains     =+local_domains



  deny message = Email blocked by LBL - to unblock see http://www.example.com/
       domains = +use_rbl_domains
       sender_domains = +blacklist_domains

  deny message = Email blocked by BSHL - to unblock see http://www.example.com/
       domains = +use_rbl_domains
       hosts = +bad_sender_hosts

  deny message = Email blocked by BSHL - to unblock see http://www.example.com/
       domains = +use_rbl_domains
       hosts = +bad_sender_hosts_ip

  deny message = Email blocked by BSAL - to unblock see http://www.example.com/
  domains = use_rbl_domains
  deny senders = +blacklist_senders



  deny message = Email blocked by SPAMHAUS - to unblock see http://www.example.com/
       domains = +use_rbl_domains
       dnslists = sbl.spamhaus.org


  deny message = Email blocked by SORBS - to unblock see http://www.example.com/
       domains = +use_rbl_domains
       dnslists = dnsbl.sorbs.net=127.0.0.5


  deny message = Email blocked by SPAMCOP - to unblock see http://www.example.com/
       hosts = !+relay_hosts
       domains = +use_rbl_domains
       !authenticated = *
       dnslists = bl.spamcop.net

  deny message = Email blocked by NJABL - to unblock see http://www.example.com/
       hosts = !+relay_hosts
       domains = +use_rbl_domains
       !authenticated = *
       dnslists = dnsbl.njabl.org

  deny message = Email blocked by CBL - to unblock see http://www.example.com/
       hosts = !+relay_hosts
       domains = +use_rbl_domains
       !authenticated = *
       dnslists = cbl.abuseat.org

  deny message = Email blocked by SORBS - to unblock see http://www.example.com/
       hosts = !+relay_hosts
       domains = +use_rbl_domains
       !authenticated = *
       dnslists = dnsbl.sorbs.net!=127.0.0.6

  deny message = Email blocked by SORBS - to unblock see http://www.example.com/
       domains =+use_rbl_domains
       dnslists = rhsbl.sorbs.net/$sender_address_domain

  accept  domains = +local_domains
          endpass
          message = "Unknown User"
          verify = recipient

  accept  domains = +relay_domains
          endpass
          verify=recipient


  accept  hosts = +relay_hosts
  accept  hosts = +auth_relay_hosts
          endpass
          message = authentication required
          authenticated = *
  deny    message = relay not permitted

  deny    message = relay not permitted

check_message:
  accept



begin authenticators

plain:
    driver = plaintext
    public_name = PLAIN
    server_condition = "${perl{smtpauth}}"
    server_set_id = $2

login:
    driver = plaintext
    public_name = LOGIN
    server_prompts = "Username:: : Password::"
    server_condition = "${perl{smtpauth}}"
    server_set_id = $1





begin routers



lookuphost:
  driver = dnslookup
  domains = ! +local_domains
  ignore_target_hosts = 127.0.0.0/8
  condition = "${perl{check_limits}}"
  transport = remote_smtp
  no_more





spamcheck_director:
  driver = accept
  condition = "${if and { \
                        {!def:h_X-Spam-Flag:} \
                        {!eq {$received_protocol}{spam-scanned}} \
                        {!eq {$received_protocol}{local}} \
                        {exists{/home/${lookup{$domain}lsearch{/etc/virtual/domainowners}{$value}}/.spamassassin/user_prefs}} \
                        {exists{/etc/virtual/${domain}/passwd}} \
                        {<{$message_size}{200k}} \
                            { \
                              or \
                                { \
                                  {!eq {}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/passwd}}}} \
                                  {!eq {}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/aliases}}}} \
                                  {eq {$local_part} {${lookup{$domain}lsearch{/etc/virtual/domainowners}}}} \
                                } \
                              } \
                        } {1}{0}}"
  retry_use_local_part
  transport = spamcheck
  no_verify

majordomo_aliases:
  driver = redirect
  allow_defer
  allow_fail
  data = ${if exists{/etc/virtual/${domain}/majordomo/list.aliases}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/majordomo/list.aliases}}}}
  domains = lsearch;/etc/virtual/domainowners
  file_transport = address_file
  group = daemon
  pipe_transport = majordomo_pipe
  retry_use_local_part
  no_rewrite
  user = majordomo

majordomo_private:
  driver = redirect
  allow_defer
  allow_fail
  condition = "${if or { {eq {$received_protocol} {local}} \
                         {eq {$received_protocol} {spam-scanned}} } {true} {false} }"
  data = ${if exists{/etc/virtual/${domain}/majordomo/private.aliases}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/majordomo/private.aliases}}}}
  domains = lsearch;/etc/virtual/domainowners
  file_transport = address_file
  group = daemon
  pipe_transport = majordomo_pipe
  retry_use_local_part
  user = majordomo

domain_filter:
  driver = redirect
  allow_filter
  no_check_local_user
  condition = "${if exists{/etc/virtual/${domain}/filter}{yes}{no}}"
  user = "mail"
  file = /etc/virtual/${domain}/filter
  file_transport = address_file
  pipe_transport = virtual_address_pipe
  retry_use_local_part
  no_verify

uservacation:
   driver = accept
   condition = ${lookup{$local_part} lsearch {/etc/virtual/${domain}/vacation.conf}{yes}{no}}
   require_files = /etc/virtual/${domain}/reply/${local_part}.msg
   transport = uservacation
   unseen

userautoreply:
   driver = accept
   condition = ${lookup{$local_part} lsearch {/etc/virtual/${domain}/autoresponder.conf}{yes}{no}}
   require_files = /etc/virtual/${domain}/reply/${local_part}.msg
   transport = userautoreply
   unseen

virtual_aliases_nostar:
  driver = redirect
  allow_defer
  allow_fail
  data = ${if exists{/etc/virtual/${domain}/aliases}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/aliases}}}}
  file_transport = address_file
  group = mail
  pipe_transport = virtual_address_pipe
  retry_use_local_part
  unseen

virtual_user:
  driver = accept
  condition = ${if eq {}{${if exists{/etc/virtual/${domain}/passwd}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/passwd}}}}}{no}{yes}}
  domains = lsearch;/etc/virtual/domainowners
  group = mail
  retry_use_local_part
  transport = virtual_localdelivery

virtual_aliases:
  driver = redirect
  allow_defer
  allow_fail
  data = ${if exists{/etc/virtual/$domain/aliases}{${lookup{$local_part}lsearch*{/etc/virtual/$domain/aliases}}}}
  file_transport = address_file
  group = mail
  pipe_transport = virtual_address_pipe
  retry_use_local_part


userforward:
  driver = redirect
  allow_filter
  check_ancestor
  check_local_user
  no_expn
  file = $home/.forward
  file_transport = address_file
  pipe_transport = address_pipe
  reply_transport = address_reply
  no_verify

system_aliases:
  driver = redirect
  allow_defer
  allow_fail
  data = ${lookup{$local_part}lsearch{/etc/aliases}}
  file_transport = address_file
  pipe_transport = address_pipe
  retry_use_local_part

localuser:
  driver = accept
  check_local_user
  condition = "${if eq {$domain} {$primary_hostname} {yes} {no}}"
  transport = local_delivery





begin transports

spamcheck:
  driver = pipe
  batch_max = 100
  command = /usr/sbin/exim -oMr spam-scanned -bS
  current_directory = "/tmp"
  group = mail
  home_directory = "/tmp"
  log_output
  message_prefix =
  message_suffix =
  return_fail_output
  no_return_path_add
  transport_filter = /usr/bin/spamc -u ${lookup{$domain}lsearch*{/etc/virtual/domainowners}{$value}}
  use_bsmtp
  user = mail


majordomo_pipe:
  driver = pipe
  group = daemon
  return_fail_output
  user = majordomo


local_delivery:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  file = /var/mail/$local_part
  group = mail
  mode = 0660
  return_path_add
  user = ${local_part}


virtual_localdelivery:
  driver = appendfile
  create_directory
  delivery_date_add
  directory_mode = 700
  envelope_to_add
  file = /var/spool/virtual/${domain}/${local_part}
  group = mail
  mode = 660
  return_path_add
  user = "${lookup{$domain}lsearch*{/etc/virtual/domainowners}{$value}}"
  quota = ${if exists{/etc/virtual/${domain}/quota}{${lookup{$local_part}lsearch*{/etc/virtual/${domain}/quota}{$value}{0}}}{0}}

uservacation:
  driver = autoreply
  file = /etc/virtual/${domain}/reply/${local_part}.msg
  from = "${local_part}@${domain}"
  log = /etc/virtual/${domain}/reply/${local_part}.log
  no_return_message
  subject = "${if def:h_Subject: {Autoreply: ${quote:${escape:$h_Subject:}}} {I am on vacation}}"
  text = "\
        ------                                                           ------\n\n\
        This message was automatically generated by email software\n\
        The delivery of your message has not been affected.\n\n\
        ------                                                           ------\n\n"
  to = "${sender_address}"
  user = mail

userautoreply:
  driver = autoreply
  bcc = ${lookup{${local_part}} lsearch {/etc/virtual/${domain}/autoresponder.conf}{$value}}
  file = /etc/virtual/${domain}/reply/${local_part}.msg
  from = "${local_part}@${domain}"
  log = /etc/virtual/${domain}/reply/${local_part}.log
  no_return_message
  subject = "${if def:h_Subject: {Autoreply: ${quote:${escape:$h_Subject:}}} {Autoreply Message}}"
  to = "${sender_address}"
  user = mail


remote_smtp:
  driver = smtp


address_pipe:
  driver = pipe
  return_output

virtual_address_pipe:
  driver = pipe
  group = nobody
  return_output
  user = "${lookup{$domain}lsearch* {/etc/virtual/domainowners}{$value}}"


address_file:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add


address_reply:
  driver = autoreply





begin retry

*                      *           F,2h,15m; G,16h,1h,1.5; F,4d,8h

I've tested my configuration:

Code:

# exim -bV
Exim version 4.67 #1 built 17-May-2007 12:38:42
Copyright (c) University of Cambridge 2006
Berkeley DB: Sleepycat Software: Berkeley DB 4.3.29: (January  7, 2007)
Support for: crypteq iconv() Perl OpenSSL move_frozen_messages Content_Scanning Old_Demime
Lookups: lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmnz
Authenticators: cram_md5 plaintext spa
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Size of off_t: 8
Configuration file is /etc/exim.conf

And all sems OK.

I've looked in the logs but couldnt find anything wrong.
Any ideas where could be the problem or how can i do to find it?

Thanks in advance!
Bye.

PD: Sorry for my poor English.

nobaloney · Oct 1, 2009

Code:

***** BAD FORMAT (Possible data corruption or Exim bug) *****

Logwatch doesn't like the format of the exim logs. Exim does. Since exim allows operator-defined logs, and since our exim.conf defines logs, you may see that error. I don't know how to fix it because I've never studied logwatch, and logwatch is the problem.

You can certainly comment out the entire log_selector section but then you're on your own with logging help.

All the rest is just telling you what's going on in the logs. Whether that's normal or not for you is up to you to decide.

Jeff

[EXIM] Logwatch: BAD FORMAT (Possible data corruption or Exim bug)

IPaddress

Verified User

nobaloney

NoBaloney Internet Svcs - In Memoriam †