not getting forwarded mail

[rmvg]

Have forwarding turned on for the admin account to my personal account on the same zimbra based server.

Getting lots of virus notifications in the admin account but they are not showing up in my account can u forward an email that is already aliased in zimbra?

[marcmac]

I don't understand the question.

The reason you're seeing virus notification in the admin, and not your normal account, is that we don't always notify users of inbound virii - check amavisd.conf for "warnvirusrecip" - if it's set to 0, they won't get notified. I think you can set this in the admin console.

[rmvg]

Sorry i guess i was not clear in my last post I would like to know why the admin accounts emails are not being forwarded to my email. As i have the forward option set in the admin account

I do not want to login to the admin account everyday to check on things instead i would like all of admin accounts email forwarded to my personal account.

[marcmac]

The admin forwarding should work the same for these emails - have you checked the postfix log, and verified that they're getting to the MTA?

[rmvg]

here is the zimbra.log of a virus being detected and sent to amin@shoemasters.com and the email address of the reciepent but i do not see anything about it getting forwarded to my account luck@computerking.ca

[zimbra@shoemasters rmvg]$ grep "Dec 14 15:26:45" /var/log/zimbra.log
Dec 14 15:26:45 shoemasters postfix/qmgr[8952]: 38DC07DC033: from=<Admin@egreetings.com>, size=76977, nrcpt=2 (queue active)
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) ESMTP::10024 /opt/zimbra/amavisd/tmp/amavis-20051214T152346-09018: <Admin@egreetings.com> -> <classic@classicautographics.com>,<sharpd@classica utographics.com> Received: SIZE=76977 from shoemasters.com ([127.0.0.1]) by localhost (shoemasters.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 09018-02; Wed, 14 Dec 2005 15:26:45 -0700 (MST)
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) body hash: 2df290bd8dcecfe486376767ee7ab5a0
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) Checking: s-EqtFz8GdFp [67.45.202.217] <Admin@egreetings.com> -> <classic@classicautographics.com>,<sharpd@classica utographics.com>
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) p003 1 Content-Type: multipart/mixed
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) p001 1/1 Content-Type: text/plain, size: 152 B, name:
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) p002 1/2 Content-Type: application/octet-stream, size: 55536 B, name: downloadm.zip
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) do_executable/do_unzip failed, ignoring: format error: bad signature: 0x00905a4d at offset 0 in file /opt/zimbra/amavisd/tmp/amavis-20051214T152346-09018/parts/p004
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) Checking for banned types and filenames
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) collect banned table[0]: classic@classicautographics.com, tables: DEFAULT=>Amavis::Lookup::RE=ARRAY(0x943064c)
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) collect banned table[0]: sharpd@classicautographics.com, tables: DEFAULT=>Amavis::Lookup::RE=ARRAY(0x943064c)
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) p.path classic@classicautographics.com: "P=p003,L=1,M=multipart/mixed | P=p001,L=1/1,M=text/plain,T=asc"
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) p.path sharpd@classicautographics.com: "P=p003,L=1,M=multipart/mixed | P=p001,L=1/1,M=text/plain,T=asc"
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) p.path classic@classicautographics.com: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/octet-stream,T=zip,N=downloadm.zip | P=p004,L=1/2/1,T=exe,T=exe-ms,N=File-packed_dataInfo.exe | P=p005,L=1/2/1/1,N=File-packed_dataInfo.exe"
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) p.path sharpd@classicautographics.com: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/octet-stream,T=zip,N=downloadm.zip | P=p004,L=1/2/1,T=exe,T=exe-ms,N=File-packed_dataInfo.exe | P=p005,L=1/2/1/1,N=File-packed_dataInfo.exe"
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) Using ClamAV-clamd: (built-in interface)
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) Using (ClamAV-clamd) on dir: CONTSCAN /opt/zimbra/amavisd/tmp/amavis-20051214T152346-09018/parts\n
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) ClamAV-clamd: Connecting to socket 127.0.0.1:3310
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) ClamAV-clamd: Sending CONTSCAN /opt/zimbra/amavisd/tmp/amavis-20051214T152346-09018/parts\n to INET socket 127.0.0.1:3310
Dec 14 15:26:45 shoemasters clamd[8618]: /opt/zimbra/amavisd/tmp/amavis-20051214T152346-09018/parts/p004: Worm.Sober.U FOUND
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) ask_av (ClamAV-clamd): /opt/zimbra/amavisd/tmp/amavis-20051214T152346-09018/parts INFECTED: Worm.Sober.U
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) virus_scan: (Worm.Sober.U), detected by 1 scanners: ClamAV-clamd
Dec 14 15:26:45 shoemasters amavis[9018]: (09018-02) Virus Worm.Sober.U matches (?-xism:^), sender addr ignored
[zimbra@shoemasters rmvg]$ grep "Dec 14 15:26:46" /var/log/zimbra.log
[zimbra@shoemasters rmvg]$ grep "Dec 14 15:26:47" /var/log/zimbra.log
Dec 14 15:26:47 shoemasters postfix/smtpd[9909]: disconnect from dpc6745202217.direcpc.com[67.45.202.217]
Dec 14 15:26:47 shoemasters amavis[9018]: (09018-02) ip_addr_to_name: returning: dpc6745202217.direcpc.com
Dec 14 15:26:47 shoemasters amavis[9018]: (09018-02) local delivery: <> -> <virus-quarantine>, mbx=/opt/zimbra/amavisd/quarantine/virus-s-EqtFz8GdFp
Dec 14 15:26:47 shoemasters postfix/smtpd[9917]: connect from localhost.localdomain[127.0.0.1]
Dec 14 15:26:47 shoemasters amavis[9018]: (09018-02) AUTH not needed, user='', MTA offers ''
Dec 14 15:26:47 shoemasters postfix/smtpd[9917]: DCFFB7DC075: client=localhost.localdomain[127.0.0.1]
Dec 14 15:26:47 shoemasters amavis[9018]: (09018-02) response to RCPT TO for <admin@shoemasters.com>: "250 Ok"
Dec 14 15:26:47 shoemasters postfix/cleanup[9913]: DCFFB7DC075: message-id=<VAs-EqtFz8GdFp@shoemasters.com>
Dec 14 15:26:47 shoemasters postfix/qmgr[8952]: DCFFB7DC075: from=<admin@shoemasters.com>, size=2070, nrcpt=1 (queue active)
Dec 14 15:26:47 shoemasters postfix/smtpd[9917]: disconnect from localhost.localdomain[127.0.0.1]
Dec 14 15:26:47 shoemasters amavis[9018]: (09018-02) SEND via SMTP: <admin@shoemasters.com> -> <admin@shoemasters.com>, 250 2.6.0 Ok, id=09018-02, from MTA([127.0.0.1]:10025): 250 Ok: queued as DCFFB7DC075
Dec 14 15:26:47 shoemasters postfix/smtpd[9917]: connect from localhost.localdomain[127.0.0.1]
Dec 14 15:26:47 shoemasters amavis[9018]: (09018-02) AUTH not needed, user='', MTA offers ''
[zimbra@shoemasters rmvg]$ grep "Dec 14 15:26:48" /var/log/zimbra.log
Dec 14 15:26:48 shoemasters postfix/smtpd[9917]: 0112A7DC08A: client=localhost.localdomain[127.0.0.1]
Dec 14 15:26:48 shoemasters amavis[9018]: (09018-02) response to RCPT TO for <classic@classicautographics.com>: "250 Ok"
Dec 14 15:26:48 shoemasters postfix/cleanup[9913]: 0112A7DC08A: message-id=<VRs-EqtFz8GdFp@shoemasters.com>
Dec 14 15:26:48 shoemasters postfix/qmgr[8952]: 0112A7DC08A: from=<admin@shoemasters.com>, size=1209, nrcpt=1 (queue active)
Dec 14 15:26:48 shoemasters postfix/smtpd[9917]: disconnect from localhost.localdomain[127.0.0.1]
Dec 14 15:26:48 shoemasters amavis[9018]: (09018-02) SEND via SMTP: <admin@shoemasters.com> -> <classic@classicautographics.com>, 250 2.6.0 Ok, id=09018-02, from MTA([127.0.0.1]:10025): 250 Ok: queued as 0112A7DC08A
Dec 14 15:26:48 shoemasters postfix/smtpd[9917]: connect from localhost.localdomain[127.0.0.1]
Dec 14 15:26:48 shoemasters amavis[9018]: (09018-02) AUTH not needed, user='', MTA offers ''
Dec 14 15:26:48 shoemasters postfix/smtpd[9917]: 1D6647DC08F: client=localhost.localdomain[127.0.0.1]
Dec 14 15:26:48 shoemasters amavis[9018]: (09018-02) response to RCPT TO for <sharpd@classicautographics.com>: "250 Ok"
Dec 14 15:26:48 shoemasters postfix/cleanup[9913]: 1D6647DC08F: message-id=<VRs-EqtFz8GdFp@shoemasters.com>
Dec 14 15:26:48 shoemasters postfix/qmgr[8952]: 1D6647DC08F: from=<admin@shoemasters.com>, size=1207, nrcpt=1 (queue active)
Dec 14 15:26:48 shoemasters postfix/smtpd[9917]: disconnect from localhost.localdomain[127.0.0.1]
Dec 14 15:26:48 shoemasters amavis[9018]: (09018-02) SEND via SMTP: <admin@shoemasters.com> -> <sharpd@classicautographics.com>, 250 2.6.0 Ok, id=09018-02, from MTA([127.0.0.1]:10025): 250 Ok: queued as 1D6647DC08F
Dec 14 15:26:48 shoemasters amavis[9018]: (09018-02) Blocked INFECTED (Worm.Sober.U), [67.45.202.217] [67.45.202.217] <?@dpc6745202217.direcpc.com> -> <classic@classicautographics.com>,<sharpd@classica utographics.com>, quarantine: virus-s-EqtFz8GdFp, Message-ID: <43d0.bddfb6fe9ae15@egreetings.com>, mail_id: s-EqtFz8GdFp, Hits: -, 2946 ms
Dec 14 15:26:48 shoemasters amavis[9018]: (09018-02) TIMING [total 2954 ms] - SMTP EHLO: 5 (0%)0, SMTP pre-MAIL: 2 (0%)0, lookup_ldap: 36 (1%)1, lookup_ldap: 77 (3%)4, SMTP pre-DATA-flush: 4 (0%)4, SMTP DATA: 6 (0%)4, body_hash: 3 (0%)5, gen_mail_id: 1 (0%)5, mime_decode: 39 (1%)6, get-file-type2: 12 (0%)6, decompose_part: 1 (0%)6, decompose_part: 42 (1%)8, get-file-type1: 10 (0%)8, decompose_part: 72 (2%)10, parts_decode: 0 (0%)11, AV-scan-1: 89 (3%)14, read_snmp_variables: 1 (0%)14, best_try_originator: 2026 (69%)82, update_cache: 2 (0%)82, write-header: 30 (1%)83, save-to-local-mailbox: 1 (0%)83, fwd-connect: 45 (2%)85, fwd-mail-from: 21 (1%)86, fwd-rcpt-to: 2 (0%)86, write-header: 6 (0%)86, fwd-data: 16 (1%)86, fwd-data-end: 25 (1%)87, fwd-rundown: 3 (0%)87, fwd-connect: 32 (1%)88, fwd-mail-from: 2 (0%)88, fwd-rcpt-to: 17 (1%)89, write-header: 6 (0%)89, fwd-data: 10 (0%)89, fwd-data-end: 61 (2%)92, fwd-rundown: 2 (0%)92, fwd-connect: 32 (1%)93, fwd-mail-from: 2 (0%)93, fwd-rcpt-to: 2 (0%)93, write-he...
Dec 14 15:26:48 shoemasters amavis[9018]: (09018-02) ...ader: 6 (0%)93, fwd-data: 8 (0%)93, fwd-data-end: 161 (5%)99, fwd-rundown: 2 (0%)99, deal_with_mail_size: 1 (0%)99, main_log_entry: 25 (1%)100, update_snmp: 5 (0%)100, unlink-2-files: 2 (0%)100, rundown: 1 (0%)100
Dec 14 15:26:48 shoemasters amavis[9018]: (09018-02) extra modules loaded: Net/LDAP/Bind.pm
Dec 14 15:26:48 shoemasters amavis[9018]: (09018-02) load: 2 %, total idle 178.071 s, busy 3.872 s
Dec 14 15:26:48 shoemasters postfix/smtp[9914]: 38DC07DC033: to=<classic@classicautographics.com>, relay=127.0.0.1[127.0.0.1], delay=24, status=sent (250 2.7.1 Ok, discarded, id=09018-02 - VIRUS: Worm.Sober.U)
Dec 14 15:26:48 shoemasters postfix/smtp[9914]: 38DC07DC033: to=<sharpd@classicautographics.com>, relay=127.0.0.1[127.0.0.1], delay=24, status=sent (250 2.7.1 Ok, discarded, id=09018-02 - VIRUS: Worm.Sober.U)
Dec 14 15:26:48 shoemasters postfix/qmgr[8952]: 38DC07DC033: removed
Dec 14 15:26:48 shoemasters postfix/lmtp[9918]: DCFFB7DC075: to=<admin@shoemasters.com>, relay=shoemasters.com[68.144.188.169], delay=1, status=sent (250 2.1.5 OK)
Dec 14 15:26:48 shoemasters postfix/qmgr[8952]: DCFFB7DC075: removed
[zimbra@shoemasters rmvg]$ grep "Dec 14 15:26:49" /var/log/zimbra.log
Dec 14 15:26:49 shoemasters postfix/lmtp[10124]: 0112A7DC08A: to=<classic@classicautographics.com>, relay=shoemasters.com[68.144.188.169], delay=2, status=sent (250 2.1.5 OK)
Dec 14 15:26:49 shoemasters postfix/qmgr[8952]: 0112A7DC08A: removed
Dec 14 15:26:49 shoemasters postfix/lmtp[10125]: 1D6647DC08F: to=<sharpd@classicautographics.com>, relay=shoemasters.com[68.144.188.169], delay=1, status=sent (250 2.1.5 OK)
Dec 14 15:26:49 shoemasters postfix/qmgr[8952]: 1D6647DC08F: removed

[marcmac]

Which account do you have set to forward to luck@computerking.ca?

[marcmac]

Never mind, I think I see the problem.

When a message comes in, postfix expands the recipients, then passes the message to the scanner. When it gets mail back from the scanner, it doesn't do any more recipient expansion (which is correct).

Unfortunately, the recipient expansion is what handles the forwarding.

I've filed bug 5021 for this.

[rmvg]

Thank u

kinda proud i caught another one i will keep trying to break er i mean test zimbra for ya.

I will just change the aliases from admin@shoemasters.com to luck@shoemasters.com for now as work around

Thanks again

[rmvg]

can remove the admin account and just create an alias of admin on my account or would this break stuff?

[marcmac]

That probably won't work, since the post-amavis delivery is likely not to work to well with anything but the actual account name - though, give it a shot, it may work.