Stopping legal intercept

[zakai]

I was using zimbra OSS 6.X on Debian Etch with old perl version. I installed zimbra OSS 7.1.1 on Debian Lenny with 8GB of RAM and 3TB Raid 5. Since my installation is small I moved all accounts using: zmmailbox -z -m <user> getRestURL "//?fmt=tgz" > /tmp/<user>.tar.gz. I have had the new server up for a couple of months and have been unable to stop the legal intercept. I have used the the following link: Legal Intercept - Zimbra :: Wiki. I did not start the legal intercept and I am guessing the way I moved the accounts started it. I have done all kinds of research with no luck. The legal intercept is actually buggy because it has taken the server down several times. Does anyone have any clue as to how to stop it?

TIA,

Zak

[phoenix]

The legal intercept is actually buggy because it has taken the server down several times.

I doubt that very much, all it does is forward an email to another account - a fairly common function for a mail server.

Does anyone have any clue as to how to stop it?

Did you follow the instructions in the article for disabling the function? Do the intercept addresses get removed from the accounts (have you checked)?

[zakai]

If I use this command: zmprov ga accountToWatch@domain.com | grep zimbraInterceptAddress. I see that the account to watch is being forwarded to the admin account. So I use this command: zmprov ma accountToWatch@domain.com zimbraInterceptAddress '' to disable the intercept based on the wiki link above, but when I reran the zmprov ga accountToWatch@domain.com | grep zimbraInterceptAddress, the intercept is not disabled. The removal process seems simple enough to me. Am I doing something wrong?

Zak

[zakai]

The intercept has taken the server down by forwarding a ton of virus emails to the quarantine account and causing the following error: system - Fatal error occurred while handling connection. In order to mitigate this problem, I had to create a filter to discard all such emails.

[phoenix]

The intercept has taken the server down by forwarding a ton of virus emails to the quarantine account and causing the following error: system - Fatal error occurred while handling connection. In order to mitigate this problem, I had to create a filter to discard all such emails.

The legal intercept has nothing to do with the amount of spam you're receiving, that should be handled quite adequately by the installed packages and any changes you may have made to the anti-spam configuration.

What about the rest of the intercept values, did you set them and have you removed them?

[zakai]

I am not insinuating that legal intercept has anything to do with amount of spam received or spam at all. I am simply saying that the legal intercept caused issues with connection handling towards the quarantine account. It exacerbated the problem because it was sending intercepts to multiple accounts. The two accounts were quarantine and admin. It was sending virus quarantine to the quarantine and admin accounts. I was being bombarded with viruses this weekend.

I did not set legal intercept at all. I set no values for legal intercept except for trying to turn it off. I am baffled as well.

Zak

[phoenix]

I did not set legal intercept at all. I set no values for legal intercept except for trying to turn it off. I am baffled as well.

If you have no accounts on your server with the legal intercept set then it's not that causing your problem. Moving your accounts from one server to another does not start the legal intercept, you have to specifically set those fields by using zmprov - nothing else will do it. You need to investigate further to determine what exactly your problem is.