Can anyone explain this "Milter add:..." spike in my logs by spamd!

[Anthony Kamau <An...@diamondkey.com>]

Hello fellow anti-spam advocates.

After getting a rather large logwatch report, I went hunting in my logs
to get to the root of the problem.  I noticed a very big spike in the
number of occurences of the following line in the /var/log/maillog file:

"Milter add: header: Content-Type: multipart/mixed; boundary=..."

I collated data off of the log files (I keep 3 years worth) and below is
what I uncovered in the last few days:

Day	   Occurences
======   ==========
27-May -   12
28-May -    6
29-May -    9
30-May -    6
31-May -    5
1-Jun	 -  724
2-Jun	 -  609
3-Jun	 -   31
4-Jun	 -  576
5-Jun	 -  706
6-Jun	 -  515
7-Jun	 -   17


Number of similar occurences in the last quarter:

Week ending        Occurences
================   ==========  
Week ending 3/18 -    1
Week ending 3/25 -   27
Week ending 4/1  -   70
Week ending 4/8  -   67
Week ending 4/15 -   59
Week ending 4/22 -   47
Week ending 4/29 -   33
Week ending 5/6  -   31
Week ending 5/13 -   40
Week ending 5/20 -   61
Week ending 5/27 - 1402
Week ending 6/3  - 1931

Prior to June 1, the highest occurrence was 70 back in May.

What the heck is going on?


Cheers,
Anthony.

RE: Can anyone explain this "Milter add:..." spike in my logs by spamd!

[Anthony Kamau <An...@diamondkey.com>]

Thanks sm.

It is indeed sendmail that is responsible - I totally ignored that part
in the logs!

I guess it is time to hunt down the sendmail list.


Cheers,
Anthony.


-----Original Message-----
From: SM [mailto:sm@resistor.net] 
Sent: Thursday, 7 June 2007 1:59 PM
To: users@spamassassin.apache.org
Subject: Re: Can anyone explain this "Milter add:..." spike in my logs
by spamd!

At 20:19 06-06-2007, Anthony Kamau wrote:
>After getting a rather large logwatch report, I went hunting in my logs
>to get to the root of the problem.  I noticed a very big spike in the
>number of occurences of the following line in the /var/log/maillog
file:
>
>"Milter add: header: Content-Type: multipart/mixed; boundary=..."

spamd is not doing that.  It's your milter which is adding that header.

Regards,
-sm

Re: Can anyone explain this "Milter add:..." spike in my logs by spamd!

[SM <sm...@resistor.net>]

At 20:19 06-06-2007, Anthony Kamau wrote:
>After getting a rather large logwatch report, I went hunting in my logs
>to get to the root of the problem.  I noticed a very big spike in the
>number of occurences of the following line in the /var/log/maillog file:
>
>"Milter add: header: Content-Type: multipart/mixed; boundary=..."

spamd is not doing that.  It's your milter which is adding that header.

Regards,
-sm