(added the image that was not visible on the first post)

What changed two days ago?

try this:

mysql
use mailscanner;
select username from users;

What do you get?

ooooh! that's useful. I didn't know that one.

Actually, that should be possible. I'll investigate. There may be a few ways this may be done: 1/ you can allow the exchange user Y to "send as X", thus the email from user Y will have an address of X - manual process though. 2/ possibly the transport rules in exchange server may allow rewriting? Ne...

I previously had performance issues running the vmware image under esxi server - and somehow I resolved the problem. I think I had a problem with my disk controller configuration on my esxi server so disk io performance was terribly slow. Are you running your vm image under esxi server? If so, what ...

This feature is not a feature of EFA, but rather your mail server.

What mail server do you use?

Which log file on which machine did you pull that message from?

So, there is something funny going on with your mysql. What, I'm not sure. One good thing is your IO Wait is low (0.2%wa) which would normally indicate a problem with writing to the disks if it were high. And your memory allocation seems reasonable, so that shouldn't be it. And your system has enoug...

Maybe. If I look at the logs in more detail, I should be able to see if that is the pattern or not.

Or, I could look at the sqlgrey source code and find the definitive answer...

To better answer your question: is it possible for EFA to block a message and not record it? Yes, but that will be in the /var/log/maillog files. If it is not, then it never reached EFA at all.

First, you have to know what your mail flow is. Then, you need to check the logs of every system under your control to see if the mail actually arrived. For example, my system is Internet -> Messagelabs -> EFA -> Exchange. Since Messagelabs is the first point of contact, I check their logs for the m...

The problem is macro detection is very very weird. When I was looking into the problem earlier, I discovered that there is no "one way" to absolutely guarantee that you can detect a macro inside an office document file because of the multitude of office document formats from over the years and diffe...

Apologies, been sick, so I forgot to follow up. I suspect your sql instance isn't configured to use enough memory. Can you give me a "top" screenshot showing your mysqld. For a reference, here is my top (sorted by % memory) top - 11:10:13 up 50 days, 1 min, 1 user, load average: 0.23, 0.17, 0.13 Tas...

I suggest you search the maillog and look for the string " sqlgrey: ". This string will be the message lines that tell you what sqlgrey is doing. In my logs, I see the following: whitelist: -> emails senders that have been whitelisted already by sqlgrey spam: -> huh? how does sql grey know if a mess...

^^^ spam. Could someone delete that garbage please?

Have you tried training the system with the spam that was misclassified?

I've checked the spam report, and the difference is that the later emails have a negative AWL score which then allows it through. For example: -1.32 AWL Adjusted score from AWL reputation of From: address I'd be curious know what the AWL score is from the 6 messages you listed. Was the AWL score go...

Can someone run a "SpamAssassun Rule Hits" report under "Search and Reports" for me and tell me if you have any entries for AWL or TXREP and what your results are? It's supposed to be enabled by default, but it doesn't seem to be doing anything on my system, so I'd like to make a comparison. My repo...

That score is being generated by the spamassassin autowhitelist plugin.

Some reasons it might be going wrong.

Now that I am looking, it seems this plugin is not giving me any results on my system, so I cannot test and verify what it is doing until I resolve that issue.

No, for the reason @Rhopkins13 described.

You can only see the message after it has been resent and accepted

ok, so what i can see is there is a delete query running on the mtalog table that's taking a long time to complete. And because that query locks the table, everything else stalls. So, why is there a delete query, and why is it taking so long? I'll need to check the mailwatch code to see if I can fig...

Most people here just want an appliance that "just works". When you start messing with the system and installing your own custom software, then you run the risk of creating conflicts that make it very difficult to upgrade the system. If you're comfortable with these kinds of things, then go for it. ...

Looks like I am getting things mixed up. Anyway, according to my previous test, the whitelisting/blacklisting worked just fine. Can you add a valid external email address to your blacklist and test it yourself like I did? Then repeat it for the whitelist in the manner similar to what I did? Accordin...

How do you know it's not using them? Try this: cd /var/spool/MailScanner grep -r X-Greylist: *|less I get a lot of entries like this: quarantine/20180914/nonspam/A2B9B182AA3.A9CDD:X-Greylist: whitelisted by SQLgrey-1.8.0 quarantine/20180914/nonspam/17388182A9B.ADAAB:X-Greylist: whitelisted by SQLgre...