Incoming message triggers TWO messages on Zimbra

[Norweg]

I did a quick search for this problem, but I haven't found any info on this, but I applogize if this topic is a dupe.

I've noticed in postfix log that each incoming message actually spawns 2 processing threads:

Dec 26 13:53:35 xxxxxxxxx2-fr postfix/smtpd[32614]: connect from 189-69-107-45.dsl.telesp.net.br[189.69.107.45]
Dec 26 13:53:36 xxxxxxxxx2-fr postfix/smtpd[32614]: 249739C56: client=189-69-107-45.dsl.telesp.net.br[189.69.107.45]
Dec 26 13:53:36 xxxxxxxxx2-fr postfix/cleanup[32624]: 249739C56: message-id=<20091226095048.r411fnto674938@www.opk.ru>
Dec 26 13:53:46 xxxxxxxxx2-fr postfix/qmgr[25993]: 249739C56: from=<thisisjusttestletter@alfrescowoodfiredovens. com.au>, size=119034, nrcpt=1 (queue active)
Dec 26 13:53:47 xxxxxxxxx2-fr postfix/smtpd[32614]: disconnect from 189-69-107-45.dsl.telesp.net.br[189.69.107.45]
Dec 26 13:53:51 xxxxxxxxx2-fr postfix/smtpd[336]: connect from localhost[127.0.0.1]
Dec 26 13:53:51 xxxxxxxxx2-fr postfix/smtpd[336]: ACA4EA2ED: client=localhost[127.0.0.1]
Dec 26 13:53:51 xxxxxxxxx2-fr postfix/cleanup[32624]: ACA4EA2ED: message-id=<20091226095048.r411fnto674938@www.opk.ru>
Dec 26 13:53:51 xxxxxxxxx2-fr postfix/smtpd[336]: disconnect from localhost[127.0.0.1]
Dec 26 13:53:51 xxxxxxxxx2-fr postfix/smtp[32625]: 249739C56: to=<admin@xxxxxxxxx.ru>, relay=127.0.0.1[127.0.0.1]:10024, delay=16, delays=11/0/0/5, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=06530-07, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as ACA4EA2ED)
Dec 26 13:53:51 xxxxxxxxx2-fr postfix/qmgr[25993]: 249739C56: removed
Dec 26 13:53:51 xxxxxxxxx2-fr postfix/qmgr[25993]: ACA4EA2ED: from=<thisisjusttestletter@alfrescowoodfiredovens. com.au>, size=119797, nrcpt=1 (queue active)
Dec 26 13:53:51 xxxxxxxxx2-fr postfix/lmtp[342]: ACA4EA2ED: to=<admin@xxxxxxxxx.ru>, relay=xxxxxxxxx2-fr.xxxxxxxxx.com[yy.yy.yy.yy]:7025, delay=0.26, delays=0.07/0.01/0/0.17, dsn=2.1.5, status=sent (250 2.1.5 Delivery OK)


Question: Is this normal? And if yes, what is the localhost thread for?

I'm running Open Zimbra GNR-603 for Suse Enterprise server on OpenSuse 11.2

[raj]

localhost lines are for AMAVIS i.e (antispam/antivirus) scanning.
so all incoming mail is handed over to localhost and then passed back for local delivery, that is why you see this..

This is normal if you doing antispam/antivirus scanning in zimbra.

Raj

[Norweg]

Thanks! Antispam is on, so that explains it.
Ironically this piece of log is for spam message.
It's not yet clear to me how to train antispam filter to reject these messages.

Again Thanks for your swift reply

[phoenix]

Originally Posted by Norweg

It's not yet clear to me how to train antispam filter to reject these messages.

What sort of messages?

You could make a start with some of the steps in this article: Improving Anti-spam system - Zimbra :: Wiki - a good place to start is this one: Improving Anti-spam system - Zimbra :: Wiki and add some decent RBLs (Spamhaus, etc).