Mailing List Archive

So this issue hasn’t resolved itself unfortunately and so I still get the occasional email that just simply fails to deliver.

Does anybody have any more ideas as to how I investigate this further since I don’t have debug as I’m not an admin and the folks responsible for the exim build claim that this is all due to the fact that I’m using a custom filter which I am but it’s understood that my filter itself couldn’t be responsible for the errors I’m seeing when things error.

failing that is there anyway I can force the delivery or something before my filter is invoked so that I can backup the message.

If you remember I do this prior to my pipe but that doesn’t cause delivery to occur immediately

save $home/Maildir/.INBOX.intray.backup/

after this here’s the pipe

pipe "nice -10 $home/perlscripts/filter.pl"

Still don’t see reasons why the errors still occur or anything about the messages impacted.

But for at least one sender I can see _all_ their mail consistently fails.

but that is not the case for all emails that fail. ie. there are some senders who’s emails fail but the same senders email won’t necessarily fail all the time.

Does anybody know the signficance of the errno in this case?

2023-05-31 06:16:13 1q441n-0006Lk-3A internal problem in userforward router (recipient is elastica@lhvm02.lizardhill.com): failure to transfer data from subprocess: status=0100 readerror='No such file or directory'
2023-05-31 06:16:13 1q441n-0006Lk-3A == elastica@lhvm02.lizardhill.com <robert@elastica.com> R=userforward defer (-1): internal problem in userforward router (recipient is elastica@lhvm02.lizardhill.com): failure to transfer data from subprocess: status=0100 readerror='No such file or directory’

without a sandbox to play in this is considerably difficult to resolve.


> On May 14, 2023, at 3:35 AM, Andrew C Aitchison via Exim-users <exim-users@lists.exim.org> wrote:
>
> On Sat, 13 May 2023, Robert Nicholson via Exim-users wrote:
>
>> What would a basic .forward file look like if all I wanted to do is to have a .forward file in place but for everything to go it’s default places?
>
> The single line:
> # Exim filter <<== Do not edit or remove this line !
>
> --
> Andrew C. Aitchison Kendal, UK
> andrew@aitchison.me.uk
>
> --
> ## subscription configuration (requires account):
> ## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
> ## unsubscribe (doesn't require an account):
> ## exim-users-unsubscribe@lists.exim.org
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Hi.

On Wed, May 31, 2023 at 09:56:25AM -0500, Robert Nicholson via Exim-users wrote:
> Does anybody have any more ideas as to how I investigate this
> further since I don’t have debug as I’m not an admin and the folks
> responsible for the exim build claim that this is all due to the
> fact that I’m using a custom filter which I am but it’s understood
> that my filter itself couldn’t be responsible for the errors I’m
> seeing when things error.
...
> pipe "nice -10 $home/perlscripts/filter.pl"

If you can modify this filter.pl (I assume it's your own script),
use a wrapper with strace/ltrace utilities to log syscalls.

Your error message is 'No such file or directory', so pay attention
to file-related syscalls, such as open(2)/openat(2).
--
Eugene Berdnikov

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Wed, 31 May 2023, Robert Nicholson wrote:

> So this issue hasn’t resolved itself unfortunately and so I still get the occasional email that just simply fails to deliver.
>
> Does anybody have any more ideas as to how I investigate this further since I don’t have debug as I’m not an admin and the folks responsible for the exim build claim that this is all due to the fact that I’m using a custom filter which I am but it’s understood that my filter itself couldn’t be responsible for the errors I’m seeing when things error.

"my filter" means your .forward, or $home/perlscripts/filter.pl ?
"Understood" or verified ? Can you confirm that you perlscript is
running as the expected user and with the expected environment ?

> failing that is there anyway I can force the delivery or something
> before my filter is invoked so that I can backup the message.
>
> If you remember I do this prior to my pipe but that doesn’t cause
> delivery to occur immediately
>
> save $home/Maildir/.INBOX.intray.backup/

Ah. I think you need to save to a file, not a directory.

After this line, just for the sender that always fails, add the
"finish" command:
if $sender_address: contains ".." then finis endif

You do have
if error_message then finish endif
near the top of your .forward file, as recommended by the filter.txt
section 3.25 ?

> after this here’s the pipe
>
> pipe "nice -10 $home/perlscripts/filter.pl"

Just to be thorough, could you try putting the full path for nice
and hand-expanding $home ?
And check that the perl binary in the first line of filter.pl
exists. If it is set with /usr/bin/env try without that.



> Still don’t see reasons why the errors still occur or anything about the messages impacted.
>
> But for at least one sender I can see _all_ their mail consistently fails.
>
> but that is not the case for all emails that fail. ie. there are some senders who’s emails fail but the same senders email won’t necessarily fail all the time.
>
> Does anybody know the signficance of the errno in this case?
>
> 2023-05-31 06:16:13 1q441n-0006Lk-3A internal problem in userforward router (recipient is elastica@lhvm02.lizardhill.com): failure to transfer data from subprocess: status=0100 readerror='No such file or directory'
> 2023-05-31 06:16:13 1q441n-0006Lk-3A == elastica@lhvm02.lizardhill.com <robert@elastica.com> R=userforward defer (-1): internal problem in userforward router (recipient is elastica@lhvm02.lizardhill.com): failure to transfer data from subprocess: status=0100 readerror='No such file or directory’

If 0100 is the permissions of a file in octal, you might need to add
execute permission, if the system allows it.

Is this supposed to be running as user robert or elastica ?

> without a sandbox to play in this is considerably difficult to resolve.
>
>
>> On May 14, 2023, at 3:35 AM, Andrew C Aitchison via Exim-users <exim-users@lists.exim.org> wrote:
>>
>> On Sat, 13 May 2023, Robert Nicholson via Exim-users wrote:
>>
>>> What would a basic .forward file look like if all I wanted to do is to have a .forward file in place but for everything to go it’s default places?
>>
>> The single line:
>> # Exim filter <<== Do not edit or remove this line !

--
Andrew C. Aitchison Kendal, UK
andrew@aitchison.me.uk

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

thanks for this suggestion.

here’s what things look like

pipe "$home/perlscripts/filter.sh"

where filter.sh looks like this

#! /bin/sh

/usr/bin/strace -o /home/elastica/filter2.log -A nice -10 /usr/bin/perl /home/elastica/perlscripts/filter.pl

for now seems to be working.

I just have to get more offending messages.

I will say right now though there’s a lot of “ENOENT” errors and this is not unexpected because whenever something has a search path it’s going to try many places to locate something so these kinds of errors are going to be very prevalent when you start tracing.


> On Jun 1, 2023, at 5:14 AM, Evgeniy Berdnikov via Exim-users <exim-users@lists.exim.org> wrote:
>
> Hi.
>
> On Wed, May 31, 2023 at 09:56:25AM -0500, Robert Nicholson via Exim-users wrote:
>> Does anybody have any more ideas as to how I investigate this
>> further since I don’t have debug as I’m not an admin and the folks
>> responsible for the exim build claim that this is all due to the
>> fact that I’m using a custom filter which I am but it’s understood
>> that my filter itself couldn’t be responsible for the errors I’m
>> seeing when things error.
> ...
>> pipe "nice -10 $home/perlscripts/filter.pl"
>
> If you can modify this filter.pl (I assume it's your own script),
> use a wrapper with strace/ltrace utilities to log syscalls.
>
> Your error message is 'No such file or directory', so pay attention
> to file-related syscalls, such as open(2)/openat(2).
> --
> Eugene Berdnikov
>
> --
> ## subscription configuration (requires account):
> ## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
> ## unsubscribe (doesn't require an account):
> ## exim-users-unsubscribe@lists.exim.org
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Having done this and looking at all the timestamps that appear in the trace log relative to the exim mainlog I think I can safely conclude that these emails never make their way to my filter. since none of the timestamps are lining up for the offending emails when they are processed.

> On Jun 1, 2023, at 5:14 AM, Evgeniy Berdnikov via Exim-users <exim-users@lists.exim.org> wrote:
>
> Hi.
>
> On Wed, May 31, 2023 at 09:56:25AM -0500, Robert Nicholson via Exim-users wrote:
>> Does anybody have any more ideas as to how I investigate this
>> further since I don’t have debug as I’m not an admin and the folks
>> responsible for the exim build claim that this is all due to the
>> fact that I’m using a custom filter which I am but it’s understood
>> that my filter itself couldn’t be responsible for the errors I’m
>> seeing when things error.
> ...
>> pipe "nice -10 $home/perlscripts/filter.pl"
>
> If you can modify this filter.pl (I assume it's your own script),
> use a wrapper with strace/ltrace utilities to log syscalls.
>
> Your error message is 'No such file or directory', so pay attention
> to file-related syscalls, such as open(2)/openat(2).
> --
> Eugene Berdnikov
>
> --
> ## subscription configuration (requires account):
> ## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
> ## unsubscribe (doesn't require an account):
> ## exim-users-unsubscribe@lists.exim.org
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

> On Jun 1, 2023, at 7:31 AM, Andrew C Aitchison <exim@aitchison.me.uk> wrote:
>
> On Wed, 31 May 2023, Robert Nicholson wrote:
>
>> So this issue hasn’t resolved itself unfortunately and so I still get the occasional email that just simply fails to deliver.
>>
>> Does anybody have any more ideas as to how I investigate this further since I don’t have debug as I’m not an admin and the folks responsible for the exim build claim that this is all due to the fact that I’m using a custom filter which I am but it’s understood that my filter itself couldn’t be responsible for the errors I’m seeing when things error.
>
> "my filter" means your .forward, or $home/perlscripts/filter.pl ?

Yes correct.

> "Understood" or verified ? Can you confirm that you perlscript is
> running as the expected user and with the expected environment ?
>
Yes it is but remember and I’m assuming this is relevant. Not all mail consistently fails. Only some.

>> failing that is there anyway I can force the delivery or something
>> before my filter is invoked so that I can backup the message.
>>
>> If you remember I do this prior to my pipe but that doesn’t cause
>> delivery to occur immediately
>>
>> save $home/Maildir/.INBOX.intray.backup/

This works for other emails ;-)

>
> Ah. I think you need to save to a file, not a directory.
>
> After this line, just for the sender that always fails, add the
> "finish" command:
> if $sender_address: contains ".." then finis endif
>
> You do have
> if error_message then finish endif
> near the top of your .forward file, as recommended by the filter.txt
> section 3.25 ?

I do now but my problem doesn’t relate to an actual error message per se.

>
>> after this here’s the pipe
>>
>> pipe "nice -10 $home/perlscripts/filter.pl"
>
> Just to be thorough, could you try putting the full path for nice
> and hand-expanding $home ?
> And check that the perl binary in the first line of filter.pl
> exists. If it is set with /usr/bin/env try without that.
>
> my entire .foward looks like this right now

# Exim filter

if error_message then finish endif

logfile $home/filter.log 0600

logwrite "$tod_full GOT $header_received: $header_date: message from $header_from: to $header_to: about $header_subject:"

#pipe "nice -10 $home/perlscripts/filter.pl -runsa"
#pipe "/usr/bin/nice -10 $home/perlscripts/filter.pl"
pipe "$home/perlscripts/filter.sh"

finish

A reminder many emails go thru this filter without issue.

This shell script is now running my filter using strace and I capture the log and for those emails that still error within exim I never
see any activity in the strace log for those messages.

#! /bin/sh

TODAY=`date "+%Y%m%d"`
TODAYTIME=`date "+%Y%m%d%H%M%S"`

echo "filter.sh $TODAYTIME" >> /home/elastica/filter.log.$TODAY

/usr/bin/strace -tt -o /home/elastica/filter.log.$TODAY -A nice -10 /usr/bin/perl /home/elastica/perlscripts/filter.pl

for file in `/usr/bin/find /home/elastica -name "filter.log*" -print | grep -v $TODAY | grep -v "filter.log$"`
do
/usr/bin/gzip -q $file
done


>
>> Still don’t see reasons why the errors still occur or anything about the messages impacted.
>>
>> But for at least one sender I can see _all_ their mail consistently fails.
>>
>> but that is not the case for all emails that fail. ie. there are some senders who’s emails fail but the same senders email won’t necessarily fail all the time.
>>
>> Does anybody know the signficance of the errno in this case?
>>
>> 2023-05-31 06:16:13 1q441n-0006Lk-3A internal problem in userforward router (recipient is elastica@lhvm02.lizardhill.com): failure to transfer data from subprocess: status=0100 readerror='No such file or directory'
>> 2023-05-31 06:16:13 1q441n-0006Lk-3A == elastica@lhvm02.lizardhill.com <robert@elastica.com> R=userforward defer (-1): internal problem in userforward router (recipient is elastica@lhvm02.lizardhill.com): failure to transfer data from subprocess: status=0100 readerror='No such file or directory’
>
> If 0100 is the permissions of a file in octal, you might need to add
> execute permission, if the system allows it.
>
> Is this supposed to be running as user robert or elastica ?
>
>> without a sandbox to play in this is considerably difficult to resolve.
>>
>>
>>> On May 14, 2023, at 3:35 AM, Andrew C Aitchison via Exim-users <exim-users@lists.exim.org> wrote:
>>>
>>> On Sat, 13 May 2023, Robert Nicholson via Exim-users wrote:
>>>
>>>> What would a basic .forward file look like if all I wanted to do is to have a .forward file in place but for everything to go it’s default places?
>>>
>>> The single line:
>>> # Exim filter <<== Do not edit or remove this line !
>
> --
> Andrew C. Aitchison Kendal, UK
> andrew@aitchison.me.uk


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

> On Jun 1, 2023, at 7:31 AM, Andrew C Aitchison <exim@aitchison.me.uk> wrote:
>
> On Wed, 31 May 2023, Robert Nicholson wrote:
>
>> So this issue hasn’t resolved itself unfortunately and so I still get the occasional email that just simply fails to deliver.
>>
>> Does anybody have any more ideas as to how I investigate this further since I don’t have debug as I’m not an admin and the folks responsible for the exim build claim that this is all due to the fact that I’m using a custom filter which I am but it’s understood that my filter itself couldn’t be responsible for the errors I’m seeing when things error.
>
> "my filter" means your .forward, or $home/perlscripts/filter.pl ?

Yes correct.

> "Understood" or verified ? Can you confirm that you perlscript is
> running as the expected user and with the expected environment ?
>
Yes it is but remember and I’m assuming this is relevant. Not all mail consistently fails. Only some.

>> failing that is there anyway I can force the delivery or something
>> before my filter is invoked so that I can backup the message.
>>
>> If you remember I do this prior to my pipe but that doesn’t cause
>> delivery to occur immediately
>>
>> save $home/Maildir/.INBOX.intray.backup/

This works for other emails ;-)

>
> Ah. I think you need to save to a file, not a directory.
>
> After this line, just for the sender that always fails, add the
> "finish" command:
> if $sender_address: contains ".." then finis endif
>
> You do have
> if error_message then finish endif
> near the top of your .forward file, as recommended by the filter.txt
> section 3.25 ?

I do now but my problem doesn’t relate to an actual error message per se.

>
>> after this here’s the pipe
>>
>> pipe "nice -10 $home/perlscripts/filter.pl"
>
> Just to be thorough, could you try putting the full path for nice
> and hand-expanding $home ?
> And check that the perl binary in the first line of filter.pl
> exists. If it is set with /usr/bin/env try without that.
>
> my entire .foward looks like this right now

# Exim filter

if error_message then finish endif

logfile $home/filter.log 0600

logwrite "$tod_full GOT $header_received: $header_date: message from $header_from: to $header_to: about $header_subject:"

#pipe "nice -10 $home/perlscripts/filter.pl -runsa"
#pipe "/usr/bin/nice -10 $home/perlscripts/filter.pl"
pipe "$home/perlscripts/filter.sh"

finish

A reminder many emails go thru this filter without issue.

This shell script is now running my filter using strace and I capture the log and for those emails that still error within exim I never
see any activity in the strace log for those messages.

#! /bin/sh

TODAY=`date "+%Y%m%d"`
TODAYTIME=`date "+%Y%m%d%H%M%S"`

echo "filter.sh $TODAYTIME" >> /home/elastica/filter.log.$TODAY

/usr/bin/strace -tt -o /home/elastica/filter.log.$TODAY -A nice -10 /usr/bin/perl /home/elastica/perlscripts/filter.pl

for file in `/usr/bin/find /home/elastica -name "filter.log*" -print | grep -v $TODAY | grep -v "filter.log$"`
do
/usr/bin/gzip -q $file
done


>
>> Still don’t see reasons why the errors still occur or anything about the messages impacted.
>>
>> But for at least one sender I can see _all_ their mail consistently fails.
>>
>> but that is not the case for all emails that fail. ie. there are some senders who’s emails fail but the same senders email won’t necessarily fail all the time.
>>
>> Does anybody know the signficance of the errno in this case?
>>
>> 2023-05-31 06:16:13 1q441n-0006Lk-3A internal problem in userforward router (recipient is elastica@lhvm02.lizardhill.com): failure to transfer data from subprocess: status=0100 readerror='No such file or directory'
>> 2023-05-31 06:16:13 1q441n-0006Lk-3A == elastica@lhvm02.lizardhill.com <robert@elastica.com> R=userforward defer (-1): internal problem in userforward router (recipient is elastica@lhvm02.lizardhill.com): failure to transfer data from subprocess: status=0100 readerror='No such file or directory’
>
> If 0100 is the permissions of a file in octal, you might need to add
> execute permission, if the system allows it.
>
> Is this supposed to be running as user robert or elastica ?
>
>> without a sandbox to play in this is considerably difficult to resolve.
>>
>>
>>> On May 14, 2023, at 3:35 AM, Andrew C Aitchison via Exim-users <exim-users@lists.exim.org> wrote:
>>>
>>> On Sat, 13 May 2023, Robert Nicholson via Exim-users wrote:
>>>
>>>> What would a basic .forward file look like if all I wanted to do is to have a .forward file in place but for everything to go it’s default places?
>>>
>>> The single line:
>>> # Exim filter <<== Do not edit or remove this line !
>
> --
> Andrew C. Aitchison Kendal, UK
> andrew@aitchison.me.uk


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Fri, Jun 02, 2023 at 09:56:16AM -0500, Robert Nicholson via Exim-users wrote:
> Having done this and looking at all the timestamps that appear in
> the trace log relative to the exim mainlog I think I can safely
> conclude that these emails never make their way to my filter. since
> none of the timestamps are lining up for the offending emails when
> they are processed.

Interesting. As far as I understand, you save a copy of each e-mail
before pipe... Is this situation reproducible with this copy?
Would this copy be lost if sent to destination address?
--
Eugene Berdnikov

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

I’ve shrunk the .forward now and some of the problematic emails started getting delivered.

Still I don’t have root cause.

But I’m told that the backup that you see me saving things into it’s immediate but rather delayed hence the messages don’t end up there either.

The biggest contributor making this difficult to resolve is largely the inability to push test data thru it without involving Admins (takes time) because I don’t have the actual messages nor can I push it thru end to end thru userforward etc myself as I don’t have the permissions.

> On Jun 2, 2023, at 1:57 PM, Evgeniy Berdnikov via Exim-users <exim-users@lists.exim.org> wrote:
>
> On Fri, Jun 02, 2023 at 09:56:16AM -0500, Robert Nicholson via Exim-users wrote:
>> Having done this and looking at all the timestamps that appear in
>> the trace log relative to the exim mainlog I think I can safely
>> conclude that these emails never make their way to my filter. since
>> none of the timestamps are lining up for the offending emails when
>> they are processed.
>
> Interesting. As far as I understand, you save a copy of each e-mail
> before pipe... Is this situation reproducible with this copy?
> Would this copy be lost if sent to destination address?
> --
> Eugene Berdnikov
>
> --
> ## subscription configuration (requires account):
> ## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
> ## unsubscribe (doesn't require an account):
> ## exim-users-unsubscribe@lists.exim.org
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

So the following .forward works

# Exim filter

if error_message then finish endif

logfile $home/filter.log 0600

logwrite "$tod_full GOT $header_received: $header_date: message from $header_from: to $header_to: about $header_subject:"

#pipe "nice -10 $home/perlscripts/filter.pl -runsa"
#pipe "/usr/bin/nice -10 $home/perlscripts/filter.pl"
pipe "$home/perlscripts/filter.sh"

finish

———

This is the one that breaks still.

# Exim filter

if error_message then finish endif

logfile $home/filter.log 0600

logwrite "$tod_full GOT $header_received: $header_date: message from $header_from: to $header_to: about $header_subject:"

if $header_from: matches Viagra or
$header_subject: contains "Men's Health" or
$header_subject: matches VIAGRA or
$header_subject: matches "PenisSize" or
$header_subject: matches "Vicodin" or
$header_subject: matches "CIALIS" or
$header_subject: matches "USA Loan" or
$header_subject: matches "Magic Jack" or
$header_from: matches "[Mm]agic\s*[Jj]ack" or
$header_subject: matches "Pre-approved Offer" or
$header_subject: matches "CRITICAL: There has been a change to your" or
$header_subject: matches "Rep1icaCartier watches" or
$header_subject: matches "Adobe Creative Suite 3 Design Premium"
then
logwrite "Spam $header_from: $header_subject:"
seen finish
endif

if foranyaddress $header_to: ( $thisaddress does not match ^robert\@elastica.com\$ )
and foranyaddress $header_from: ( $thisaddress does not match ^robert\@elastica.com|robert\@audrey.local\$ )
and ${domain:$header_to:} matches ^elastica.com\$
then
logwrite "junk header_from $header_from: header_to $header_to:"
seen finish
endif

if foranyaddress $header_to:,$header_cc: ( $thisaddress matches ^robert\@elastica.com\$ )
and foranyaddress $header_from: ( $thisaddress does not match ^rss\@elastica.com\$ )
and
(
$rheader_subject: does not match \N[^\x00-\x7f]{5,}\N and
$rheader_from: does not match "\\s*=\\?(ks_c_5601-|big5|euc-|shift[-_]jis|(iso.\{0,4\}639-)|hkscs|sil|koi[78]|iscii|guobiao|gb2312|gb18030|(iso.\{0,4\}2022)|(iso.\{0,4\}8859-[57])|(windows-1251)|(windows-1255)|(windows-1256))" and
$rheader_content-type: does not match "\\s*=\\?(ks_c_5601-|big5|euc-|shift[-_]jis|(iso.\{0,4\}639-)|hkscs|sil|koi[78]|iscii|guobiao|gb2312|gb18030|(iso.\{0,4\}2022)|(iso.\{0,4\}8859-[57])|(windows-1251)|(windows-1255)|(windows-1256))" and
$rheader_subject: does not match "\\s*=\\?(ks_c_5601-|big5|euc-|shift[-_]jis|(iso.\{0,4\}639-)|hkscs|sil|koi[78]|iscii|guobiao|gb2312|gb18030|(iso.\{0,4\}2022)|(iso.\{0,4\}8859-[57])|(windows-1251)|(windows-1255)|(windows-1256))" and
$message_body: does not match ".*charset=3D(ks_c_5601-|big5|euc-|shift[-_]jis|(iso.\{0,4\}639-)|hkscs|sil|koi[78]|iscii|guobiao|gb2312|gb18030|(iso.\{0,4\}202)|(iso.\{0,4\}8859-[57])|(windows-1251)|(windows-1255)|(windows-1256))"
)
then
# logwrite "saving backup header_from $header_from: header_to $header_to:"
save $home/Maildir/.INBOX.intray.backup/
endif

#pipe "nice -10 $home/perlscripts/filter.pl -runsa"
#pipe "/usr/bin/nice -10 $home/perlscripts/filter.pl"
pipe "$home/perlscripts/filter.sh"

finish


> On Jun 2, 2023, at 1:57 PM, Evgeniy Berdnikov via Exim-users <exim-users@lists.exim.org> wrote:
>
> On Fri, Jun 02, 2023 at 09:56:16AM -0500, Robert Nicholson via Exim-users wrote:
>> Having done this and looking at all the timestamps that appear in
>> the trace log relative to the exim mainlog I think I can safely
>> conclude that these emails never make their way to my filter. since
>> none of the timestamps are lining up for the offending emails when
>> they are processed.
>
> Interesting. As far as I understand, you save a copy of each e-mail
> before pipe... Is this situation reproducible with this copy?
> Would this copy be lost if sent to destination address?
> --
> Eugene Berdnikov
>
> --
> ## subscription configuration (requires account):
> ## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
> ## unsubscribe (doesn't require an account):
> ## exim-users-unsubscribe@lists.exim.org
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Fri, Jun 02, 2023 at 03:20:45PM -0500, Robert Nicholson via Exim-users wrote:
> So the following .forward works
...
> This is the one that breaks still.

Well, it gives a straitforward way to locate point of failure.
The logwrite statement should help to reduce number of steps.
--
Eugene Berdnikov

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Fri, 2 Jun 2023, Robert Nicholson via Exim-users wrote:

> I?ve shrunk the .forward now and some of the problematic emails
> started getting delivered.
>
> Still I don?t have root cause.
>
> But I?m told that the backup that you see me saving things into it?s
> immediate but rather delayed hence the messages don?t end up there
> either.
>
> The biggest contributor making this difficult to resolve is largely
> the inability to push test data thru it without involving Admins
> (takes time) because I don?t have the actual messages nor can I push
> it thru end to end thru userforward etc myself as I don?t have the
> permissions.

I am a bit confused. You say that some of the problematic messages have
been delivered but you don't have actual messages.

Does `exim -bf ~/.forward < ... ` work in your circumstances ?

--
Andrew C. Aitchison Kendal, UK
andrew@aitchison.me.uk

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Here I’m testing with an earlier message that originally failed.

It eventually came thru after I simplified the .forward.

2023-06-02 12:36:42 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1q5AZm-0002cJ-0b

2023-06-02 12:36:42 1q5AZm-0002cJ-0b <= bbarlow@matlensilver.com H=mail-lf1-f42.google.com [209.85.167.42] P=esmtps X=TLS1.2:ECDHE-ECDSA-AES128-GCM-SHA256:128 CV=no S=8426 DKIM=matlensilver-com.20221208.gappssmtp.com id=CAMp+ihqxHtpWWBWrj4ifG27gqX+-YqF8BAgrGqPhAcpaiT-urg@mail.gmail.com T="Test #2" from <bbarlow@matlensilver.com> for robert@elastica.com
2023-06-02 12:36:42 1q5AZm-0002cJ-0b SIGSEGV (fault address: (nil))
2023-06-02 12:36:42 1q5AZm-0002cJ-0b SIGSEGV (null pointer indirection)
2023-06-02 12:36:42 1q5AZm-0002cJ-0b internal problem in userforward router (recipient is elastica@lhvm02.lizardhill.com): failure to transfer data from subprocess: status=0100 readerror='No such file or directory'
2023-06-02 12:36:42 1q5AZm-0002cJ-0b == elastica@lhvm02.lizardhill.com <robert@elastica.com> R=userforward defer (-1): internal problem in userforward router (recipient is elastica@lhvm02.lizardhill.com): failure to transfer data from subprocess: status=0100 readerror='No such file or directory'
2023-06-02 13:16:23 1q5AZm-0002cJ-0b => |$home/perlscripts/filter.sh (elastica@lhvm02.lizardhill.com) <robert@elastica.com> F=<bbarlow@matlensilver.com> R=userforward T=address_pipe S=8481
2023-06-02 13:16:23 1q5AZm-0002cJ-0b Completed

-----

This is with the working .forward file.

exim -bf ~/.forward </tmp/6.txt
Return-path copied from sender
Sender = elastica@lhvm02.lizardhill.com
Recipient = elastica@lhvm02.lizardhill.com
Testing Exim filter file "/home/elastica/.forward"

Logfile /home/elastica/filter.log
Logwrite "Sat, 03 Jun 2023 08:39:37 -0700 GOT from mail-lf1-f42.google.com ([209.85.167.42])\n by lhvm02.lizardhill.com with esmtps (TLS1.2) tls TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\n (Exim 4.96-58-g4e9ed49f8)\n (envelope-from <bbarlow@matlensilver.com>)\n id 1q5AZm-0002cJ-0b\n for robert@elastica.com;\n Fri, 02 Jun 2023 12:36:42 -0700\nby mail-lf1-f42.google.com with SMTP id 2adb3069b0e04-4f004cc54f4so3402189e87.3\n for <robert@elastica.com>; Fri, 02 Jun 2023 12:36:39 -0700 (PDT) Fri, 2 Jun 2023 15:36:25 -0400 message from Brandon Barlow <bbarlow@matlensilver.com> to robert@elastica.com about Test #2\n"
Pipe message to: $home/perlscripts/filter.sh
Finish
Filtering set up at least one significant delivery or other action.
No other deliveries will occur.


This is testing with a .forward that was failing with this message.

exim -bf ~/.forward.20230602 </tmp/6.txt
Return-path copied from sender
Sender = elastica@lhvm02.lizardhill.com
Recipient = elastica@lhvm02.lizardhill.com
Testing Exim filter file "/home/elastica/.forward.20230602"

Logfile /home/elastica/filter.log
Logwrite "Sat, 03 Jun 2023 08:39:20 -0700 GOT from mail-lf1-f42.google.com ([209.85.167.42])\n by lhvm02.lizardhill.com with esmtps (TLS1.2) tls TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\n (Exim 4.96-58-g4e9ed49f8)\n (envelope-from <bbarlow@matlensilver.com>)\n id 1q5AZm-0002cJ-0b\n for robert@elastica.com;\n Fri, 02 Jun 2023 12:36:42 -0700\nby mail-lf1-f42.google.com with SMTP id 2adb3069b0e04-4f004cc54f4so3402189e87.3\n for <robert@elastica.com>; Fri, 02 Jun 2023 12:36:39 -0700 (PDT) Fri, 2 Jun 2023 15:36:25 -0400 message from Brandon Barlow <bbarlow@matlensilver.com> to robert@elastica.com about Test #2\n"
Pipe message to: $home/perlscripts/filter.sh
Finish
Filtering set up at least one significant delivery or other action.
No other deliveries will occur.


-----

So you can see I don’t really have a very good way to test since the above isn’t reproducing the issue as far as I can tell.

If it’s relevant here’s my attempt at -d

working .forward

exim -d -bf ~/.forward </tmp/6.txt
Exim version 4.96-58-g4e9ed49f8 uid=1043 gid=1045 pid=30436 D=f7715cfd
Support for: crypteq IPv6 Perl OpenSSL TLS_resume move_frozen_messages Content_Scanning DKIM DNSSEC Event OCSP PIPECONNECT PRDR Queue_Ramp SPF SRS TCP_Fast_Open
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmjz dbmnz dnsdb
Authenticators: cram_md5 dovecot plaintext spa
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Malware: f-protd f-prot6d drweb aveserver fsecure kavdaemon sophie clamd mksd avast sock cmdline
Fixed never_users: 0
Configure owner: 0:0
Size of off_t: 8
Compiler: GCC [4.8.5 20150623 (Red Hat 4.8.5-44)]
Library version: Glibc: Compile: 2.17
Runtime: 2.17
Library version: BDB: Compile: Berkeley DB 5.3.21: (May 11, 2012)
Runtime: Berkeley DB 5.3.21: (May 11, 2012)
Library version: OpenSSL: Compile: OpenSSL 1.0.2k-fips 26 Jan 2017
Runtime: OpenSSL 1.0.2k-fips 26 Jan 2017
: built on: reproducible build, date unspecified
Library version: spf2: Compile: 1.2.11
Runtime: 1.2.11
Library version: PCRE2: Compile: 10.35
Runtime: 10.35 2020-05-09
Total 11 lookups
WHITELIST_D_MACROS unset
TRUSTED_CONFIG_LIST unset
changed uid/gid: -C, -D, -be or -bf forces real uid
uid=1043 gid=1045 pid=30436
auxiliary group list: 1045
seeking password data for user "mail": cache not available
getpwnam() succeeded uid=8 gid=12
seeking password data for user "majordomo": cache not available
getpwnam() succeeded uid=993 gid=2
seeking password data for user "diradmin": cache not available
getpwnam() succeeded uid=995 gid=995
seeking password data for user "root": cache not available
getpwnam() succeeded uid=0 gid=0
openssl option, adding to 03104000: 01000000 (no_sslv2 +no_sslv3 +no_tlsv1 +no_tlsv1_1 +cipher_server_preference)
openssl option, adding to 03104000: 02000000 (no_sslv3 +no_tlsv1 +no_tlsv1_1 +cipher_server_preference)
openssl option, adding to 03104000: 04000000 (no_tlsv1 +no_tlsv1_1 +cipher_server_preference)
openssl option, adding to 07104000: 10000000 (no_tlsv1_1 +cipher_server_preference)
openssl option, adding to 17104000: 00400000 (cipher_server_preference)
XDG_SESSION_ID in keep_environment? no (end of list)
HOSTNAME in keep_environment? no (end of list)
TERM in keep_environment? no (end of list)
SHELL in keep_environment? no (end of list)
HISTSIZE in keep_environment? no (end of list)
SSH_CLIENT in keep_environment? no (end of list)
PERL5LIB in keep_environment? no (end of list)
SSH_TTY in keep_environment? no (end of list)
USER in keep_environment? no (end of list)
LS_COLORS in keep_environment? no (end of list)
MAIL in keep_environment? no (end of list)
PATH in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
LANG in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HISTCONTROL in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
SHLVL in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
LOGNAME in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
SSH_CONNECTION in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
LESSOPEN in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
XDG_RUNTIME_DIR in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
_ in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
OLDPWD in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
configuration file is /etc/exim.conf
log selectors = 000024ac 73205036 0000000e
exim: debugging permission denied


Problematic .forward

exim -d -bf ~/.forward.20230602 </tmp/6.txt
Exim version 4.96-58-g4e9ed49f8 uid=1043 gid=1045 pid=30492 D=f7715cfd
Support for: crypteq IPv6 Perl OpenSSL TLS_resume move_frozen_messages Content_Scanning DKIM DNSSEC Event OCSP PIPECONNECT PRDR Queue_Ramp SPF SRS TCP_Fast_Open
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmjz dbmnz dnsdb
Authenticators: cram_md5 dovecot plaintext spa
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Malware: f-protd f-prot6d drweb aveserver fsecure kavdaemon sophie clamd mksd avast sock cmdline
Fixed never_users: 0
Configure owner: 0:0
Size of off_t: 8
Compiler: GCC [4.8.5 20150623 (Red Hat 4.8.5-44)]
Library version: Glibc: Compile: 2.17
Runtime: 2.17
Library version: BDB: Compile: Berkeley DB 5.3.21: (May 11, 2012)
Runtime: Berkeley DB 5.3.21: (May 11, 2012)
Library version: OpenSSL: Compile: OpenSSL 1.0.2k-fips 26 Jan 2017
Runtime: OpenSSL 1.0.2k-fips 26 Jan 2017
: built on: reproducible build, date unspecified
Library version: spf2: Compile: 1.2.11
Runtime: 1.2.11
Library version: PCRE2: Compile: 10.35
Runtime: 10.35 2020-05-09
Total 11 lookups
WHITELIST_D_MACROS unset
TRUSTED_CONFIG_LIST unset
changed uid/gid: -C, -D, -be or -bf forces real uid
uid=1043 gid=1045 pid=30492
auxiliary group list: 1045
seeking password data for user "mail": cache not available
getpwnam() succeeded uid=8 gid=12
seeking password data for user "majordomo": cache not available
getpwnam() succeeded uid=993 gid=2
seeking password data for user "diradmin": cache not available
getpwnam() succeeded uid=995 gid=995
seeking password data for user "root": cache not available
getpwnam() succeeded uid=0 gid=0
openssl option, adding to 03104000: 01000000 (no_sslv2 +no_sslv3 +no_tlsv1 +no_tlsv1_1 +cipher_server_preference)
openssl option, adding to 03104000: 02000000 (no_sslv3 +no_tlsv1 +no_tlsv1_1 +cipher_server_preference)
openssl option, adding to 03104000: 04000000 (no_tlsv1 +no_tlsv1_1 +cipher_server_preference)
openssl option, adding to 07104000: 10000000 (no_tlsv1_1 +cipher_server_preference)
openssl option, adding to 17104000: 00400000 (cipher_server_preference)
XDG_SESSION_ID in keep_environment? no (end of list)
HOSTNAME in keep_environment? no (end of list)
TERM in keep_environment? no (end of list)
SHELL in keep_environment? no (end of list)
HISTSIZE in keep_environment? no (end of list)
SSH_CLIENT in keep_environment? no (end of list)
PERL5LIB in keep_environment? no (end of list)
SSH_TTY in keep_environment? no (end of list)
USER in keep_environment? no (end of list)
LS_COLORS in keep_environment? no (end of list)
MAIL in keep_environment? no (end of list)
PATH in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
LANG in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HISTCONTROL in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
SHLVL in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
LOGNAME in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
SSH_CONNECTION in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
LESSOPEN in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
XDG_RUNTIME_DIR in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
_ in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
OLDPWD in keep_environment? no (end of list)
PWD in keep_environment? yes (matched "PWD")
HOME in keep_environment? yes (matched "HOME")
configuration file is /etc/exim.conf
log selectors = 000024ac 73205036 0000000e
exim: debugging permission denied


> On Jun 3, 2023, at 5:50 AM, Andrew C Aitchison via Exim-users <exim-users@lists.exim.org> wrote:
>
> On Fri, 2 Jun 2023, Robert Nicholson via Exim-users wrote:
>
>> I’ve shrunk the .forward now and some of the problematic emails
>> started getting delivered.
>>
>> Still I don’t have root cause.
>>
>> But I’m told that the backup that you see me saving things into it’s
>> immediate but rather delayed hence the messages don’t end up there
>> either.
>>
>> The biggest contributor making this difficult to resolve is largely
>> the inability to push test data thru it without involving Admins
>> (takes time) because I don’t have the actual messages nor can I push
>> it thru end to end thru userforward etc myself as I don’t have the
>> permissions.
>
> I am a bit confused. You say that some of the problematic messages have been delivered but you don't have actual messages.
>
> Does `exim -bf ~/.forward < ... ` work in your circumstances ?
>
> --
> Andrew C. Aitchison Kendal, UK
> andrew@aitchison.me.uk
>
> --
> ## subscription configuration (requires account):
> ## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
> ## unsubscribe (doesn't require an account):
> ## exim-users-unsubscribe@lists.exim.org
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

It looks like this is the line that makes the difference

I’ve not tried to simplify this yet but if you have the permissions to test you may be able to reproduce my issue

if foranyaddress $header_to:,$header_cc: ( $thisaddress matches ^robert\@elastica.com\$ )
and foranyaddress $header_from: ( $thisaddress does not match ^rss\@elastica.com\$ )
and
(
$rheader_subject: does not match \N[^\x00-\x7f]{5,}\N and
$rheader_from: does not match "\\s*=\\?(ks_c_5601-|big5|euc-|shift[-_]jis|(iso.\{0,4\}639-)|hkscs|sil|koi[78]|iscii|guobiao|gb2312|gb18030|(iso.\{0,4\}2022)|(iso.\{0,4\}8859-[57])|(windows-1251)|(windows-1255)|(windows-1256))" and
$rheader_content-type: does not match "\\s*=\\?(ks_c_5601-|big5|euc-|shift[-_]jis|(iso.\{0,4\}639-)|hkscs|sil|koi[78]|iscii|guobiao|gb2312|gb18030|(iso.\{0,4\}2022)|(iso.\{0,4\}8859-[57])|(windows-1251)|(windows-1255)|(windows-1256))" and
$rheader_subject: does not match "\\s*=\\?(ks_c_5601-|big5|euc-|shift[-_]jis|(iso.\{0,4\}639-)|hkscs|sil|koi[78]|iscii|guobiao|gb2312|gb18030|(iso.\{0,4\}2022)|(iso.\{0,4\}8859-[57])|(windows-1251)|(windows-1255)|(windows-1256))" and
$message_body: does not match ".*charset=3D(ks_c_5601-|big5|euc-|shift[-_]jis|(iso.\{0,4\}639-)|hkscs|sil|koi[78]|iscii|guobiao|gb2312|gb18030|(iso.\{0,4\}202)|(iso.\{0,4\}8859-[57])|(windows-1251)|(windows-1255)|(windows-1256))"
)
then
# logwrite "saving backup header_from $header_from: header_to $header_to:"
save $home/Maildir/.INBOX.intray.backup/
endif


This is an attempt to keep what’s put in backup limited based on the charsets etc so that backup doesn’t grow too quickly.

right now what works is just when I have

save $home/Maildir/.INBOX.intray.backup/

however an earlier rule like this one keeps complete garbage from reaching backup.

if foranyaddress $header_to: ( $thisaddress does not match ^robert\@elastica.com\$ )
and foranyaddress $header_from: ( $thisaddress does not match ^robert\@elastica.com|robert\@audrey.local\$ )
and ${domain:$header_to:} matches ^elastica.com\$
then
logwrite "junk header_from $header_from: header_to $header_to:"
seen finish
endif

> On Jun 3, 2023, at 5:50 AM, Andrew C Aitchison via Exim-users <exim-users@lists.exim.org> wrote:
>
> On Fri, 2 Jun 2023, Robert Nicholson via Exim-users wrote:
>
>> I’ve shrunk the .forward now and some of the problematic emails
>> started getting delivered.
>>
>> Still I don’t have root cause.
>>
>> But I’m told that the backup that you see me saving things into it’s
>> immediate but rather delayed hence the messages don’t end up there
>> either.
>>
>> The biggest contributor making this difficult to resolve is largely
>> the inability to push test data thru it without involving Admins
>> (takes time) because I don’t have the actual messages nor can I push
>> it thru end to end thru userforward etc myself as I don’t have the
>> permissions.
>
> I am a bit confused. You say that some of the problematic messages have been delivered but you don't have actual messages.
>
> Does `exim -bf ~/.forward < ... ` work in your circumstances ?
>
> --
> Andrew C. Aitchison Kendal, UK
> andrew@aitchison.me.uk
>
> --
> ## subscription configuration (requires account):
> ## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
> ## unsubscribe (doesn't require an account):
> ## exim-users-unsubscribe@lists.exim.org
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/