What's rec_bl_ccat?

Hi, people, lately I've been seeing several mails
originating at my
domains (legal, solicited mails) which trigger something
like this on
the logs:

do_notify_and_quarantine: rec_bl_ccat=(1,0), ccat=(1,1)
somedest.outside.mydomain

Just to clarify, why is it triggering
do_notify_and_quarantine? what
do rec_bl_ccat and ccat mean?

Thanks in advance,


Luis

-- 
-------------------------------------------------
GNU-GPL: "May The Source Be With You...
Linux Registered User #448382.
When I grow up, I wanna be like Theo...
-------------------------------------------------

------------------------------------------------------------
-------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and
a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Luis,

> Hi, people, lately I've been seeing several mails
originating at my
> domains (legal, solicited mails) which trigger
something like this on
> the logs:
> do_notify_and_quarantine: rec_bl_ccat=(1,0),
ccat=(1,1)
> somedest.outside.mydomain
>
> Just to clarify, why is it triggering
do_notify_and_quarantine? what
> do rec_bl_ccat and ccat mean?

The do_notify_and_quarantine is called for every message.
It checks what is a content type of a message and whether
it needs to be quarantined or not, and whether a
notification
needs to be sent to administrator or recipient, or not.

The corresponding logging call in the current version is:

  do_log(2,"do_notify_and_quarantine:
rec_bl_ccat=(%d,%d), ccat=(%d,%d) %s",
            $rec_ccat_maj, $rec_ccat_min, $ccat, $ccat_min,
$rec)
            if $rec_ccat_maj != $ccat || $rec_ccat_min !=
$ccat_min;

It is probably all normal, it is just saying that a 'minor
contents category'
for a recipient somedest.outside.mydomain is different from a
per-message minor contents category, which shows a
summarized info
pertaining to all recipients of a message (it takes a max of
velues
across all recipients).

In this particular case, the ccat is 1, which means
CC_CLEAN:

  CC_CATCHALL()  
  CC_CLEAN ()      # tag_level =
"CC_CLEAN,1"
  CC_MTA   ()      # trouble passing mail back to MTA
  CC_OVERSIZED() 
  CC_BADH  ()    
  CC_SPAMMY()      # tag2_level  (and: tag3_level =
"CC_SPAMMY,1")
  CC_SPAM  ()      # kill_level
  CC_UNCHECKED() 
  CC_BANNED()    
  CC_VIRUS ()    

A CC_CLEAN with a minor ccat 1 means it crossed tag_level
for at least
one recipient, but not for this particular recipient, which
has CC_CLEAN,0.

So it seems you have spam_tag_level_maps which gives different
levels
for different recipients. Quite normal.

  Mark 

------------------------------------------------------------
-------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and
a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/