Spam kill list

[dljordaneku]

Is there anyway to see what emails Zimbra killed over the course of a day? I have a user that over the last couple of days that is expecting an email but hasn't received it. I know the email made it through to our system but he never gets it. I was wondering if Zimbra was killing it before it got to him.

dj

[uxbod]

Have you checked in /var/log/zimbra.log ?

[dljordaneku]

Originally Posted by uxbod

Have you checked in /var/log/zimbra.log ?

I looked over the log file for the time frame and I don't see where the message listed at all. If Zimbra kills something it thinks is spam, will it show up in the log file.

dj

[uxbod]

Yes as Postfix has to receive it first before handing off to Amavis. You could also increase the log_level in /opt/zimbra/conf/amavisd.conf.in to level 2 and then do

su - zimbra
zmamavisdctl stop ; zmamavisdctl start

[dljordaneku]

Originally Posted by uxbod

Yes as Postfix has to receive it first before handing off to Amavis. You could also increase the log_level in /opt/zimbra/conf/amavisd.conf.in to level 2 and then do

su - zimbra
zmamavisdctl stop ; zmamavisdctl start

But that just changes it from that point out. No way to go back and search the last couple of days?

dj

[uxbod]

Nope; but you should be able to see emails that have hit Postfix but then not been delivered via LMTP.

[dljordaneku]

Originally Posted by uxbod

Nope; but you should be able to see emails that have hit Postfix but then not been delivered via LMTP.

Ok. Maybe I am missing something then. So the Zimbra log file will show what was killed before being delivered to the end user right?

dj

[ewilen]

There are two ways an email can be "killed" by Zimbra. Either it's refused at the mta level or it's killed by Amavisd.

MTA-level (RBLs configured via Admin GUI) will generate a bounce to the sender. There will also be a notation in both /var/log/zimbra.log and /var/log/maillog

Amavisd (Spamassassin) won't generate bounces. But in zimbra.log you'll see a line containing either the text "Passed SPAMMY" (meaning it went to the Junk folder) OR "Blocked SPAM" (meaning it was silently dropped).

How do you know that the email made it through to your system? Can you post the relevant log entries showing this?

One thing that could be happening is that the user has a filter which is filing or deleting the message. This will show up in /opt/zimbra/log/mailbox.log--that file shows final disposition of messages after they're moved into an account.