[Declude.JunkMail] Not whitelisted, why
Log lines 01/21/2005 03:03:45 Qe18f09a600c0cf70 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 01/21/2005 03:03:45 Qe18f09a600c0cf70 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. ### first line in D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. WHITELISTFILE D:\Imail\declude\junkmailfiles\whitelistfiles\standardabrasives.com.whitelis t.txt And the X-Declude-Sender: [EMAIL PROTECTED] [218.16.121.102] is in the whitelist file as [EMAIL PROTECTED] We are on declude 1.82. Kevin Bilbee --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Not whitelisted, why
Log lines 01/21/2005 03:03:45 Qe18f09a600c0cf70 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 01/21/2005 03:03:45 Qe18f09a600c0cf70 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. Are there further log file entries? ### first line in D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. WHITELISTFILE D:\Imail\declude\junkmailfiles\whitelistfiles\standardabrasives.com.whitelis t.txt And the X-Declude-Sender: [EMAIL PROTECTED] [218.16.121.102] is in the whitelist file as [EMAIL PROTECTED] Is that the last line in the file (remember, Windows requires that the last line in text files end with a carriage return -- if you can't move the cursor below the last line in Notepad, you need to hit ENTER at the end of the line). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ping
Hello declude, ping Thanks, _M Pete McNeil (Madscientist) President, MicroNeil Research Corporation Chief SortMonster (www.sortmonster.com) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ping
Pong John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Monday, January 24, 2005 10:48 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] ping Hello declude, ping Thanks, _M Pete McNeil (Madscientist) President, MicroNeil Research Corporation Chief SortMonster (www.sortmonster.com) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ping
pong - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Monday, January 24, 2005 1:48 PM Subject: [Declude.JunkMail] ping Hello declude, ping Thanks, _M Pete McNeil (Madscientist) President, MicroNeil Research Corporation Chief SortMonster (www.sortmonster.com) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ping
pong Barry Simpson -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Monday, January 24, 2005 1:48 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] ping Hello declude, ping Thanks, _M Pete McNeil (Madscientist) President, MicroNeil Research Corporation Chief SortMonster (www.sortmonster.com) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Not whitelisted, why
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Monday, January 24, 2005 10:39 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Not whitelisted, why Log lines 01/21/2005 03:03:45 Qe18f09a600c0cf70 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 01/21/2005 03:03:45 Qe18f09a600c0cf70 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. Are there further log file entries? Yea there are further log entries but they are just references to the tests that failed and the final action of hold. ### first line in D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. WHITELISTFILE D:\Imail\declude\junkmailfiles\whitelistfiles\standardabrasives.c om.whitelis t.txt And the X-Declude-Sender: [EMAIL PROTECTED] [218.16.121.102] is in the whitelist file as [EMAIL PROTECTED] Is that the last line in the file (remember, Windows requires that the last line in text files end with a carriage return -- if you can't move the cursor below the last line in Notepad, you need to hit ENTER at the end of the line). No it is not the last line of the file! Kevin --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
Scott, Could you please let me know what condition causes E-mail to be left in the overflow directory, and exactly how Declude determines how/when to process such messages. On a side note, I was forced to do a rebuild on a backup server running Windows 2003. The DNS.exe process is a big-time dog compared to that on Windows 2000. I'm seeing DNS.exe reach over 50% of CPU utilization at times, and it never really drops below 10%, and I can't recall ever seeing DNS.exe on Windows 2000 ever go past the low single digits. No Active Directory on either machine, the processor power, memory and mail volume also. The only difference is the RAID card and only three 15K RPM drives in RAID 5 instead of six. Unless there is something unique to my environment, I would stay away from Windows 2003 DNS when used as a caching server with Declude/IMail, or for that matter, any possible high volume use of DNS on that platform. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Problem with mail from Earthlink, gmail and weblists.com
Declude 1.82 is continuing to use the wrong line for subject on these. The common problem is the domain key header: DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=test1; d=earthlink.net; h=Message-ID:From:To:Subject:Date:MIME-Version:Content-Type:X-Priority:X-MSM ail-Priority:X-Mailer:X-MimeOLE; b=lceW7U8Nm756EyIfANBSppcc49aIUof2dIuBftKbZ7WlYH+AHxtSCLy+Dzdyu7Kk; Declude is picking up Subject in there and using that as the subject line. (So is SpamReview) I thought this was fixed. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Problem with mail from Earthlink, gmail and weblists.com
John, It's fixed in the latest beta, but not 1.82. That version only fixed the one issue with SPAMHEADERS, otherwise it is the same as 1.81. Matt John Tolmachoff (Lists) wrote: Declude 1.82 is continuing to use the wrong line for subject on these. The common problem is the domain key header: DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=test1; d=earthlink.net; h=Message-ID:From:To:Subject:Date:MIME-Version:Content-Type:X-Priority:X-MSM ail-Priority:X-Mailer:X-MimeOLE; b=lceW7U8Nm756EyIfANBSppcc49aIUof2dIuBftKbZ7WlYH+AHxtSCLy+Dzdyu7Kk; Declude is picking up Subject in there and using that as the subject line. (So is SpamReview) I thought this was fixed. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
Matt, on the Windows 2003 DNS: You are aware of the time out issues and such aren't you? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, January 24, 2005 11:43 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS Scott, Could you please let me know what condition causes E-mail to be left in the overflow directory, and exactly how Declude determines how/when to process such messages. On a side note, I was forced to do a rebuild on a backup server running Windows 2003. The DNS.exe process is a big-time dog compared to that on Windows 2000. I'm seeing DNS.exe reach over 50% of CPU utilization at times, and it never really drops below 10%, and I can't recall ever seeing DNS.exe on Windows 2000 ever go past the low single digits. No Active Directory on either machine, the processor power, memory and mail volume also. The only difference is the RAID card and only three 15K RPM drives in RAID 5 instead of six. Unless there is something unique to my environment, I would stay away from Windows 2003 DNS when used as a caching server with Declude/IMail, or for that matter, any possible high volume use of DNS on that platform. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
I know I'm not aware, care to expand? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, January 24, 2005 11:59 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS Matt, on the Windows 2003 DNS: You are aware of the time out issues and such aren't you? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, January 24, 2005 11:43 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS Scott, Could you please let me know what condition causes E-mail to be left in the overflow directory, and exactly how Declude determines how/when to process such messages. On a side note, I was forced to do a rebuild on a backup server running Windows 2003. The DNS.exe process is a big-time dog compared to that on Windows 2000. I'm seeing DNS.exe reach over 50% of CPU utilization at times, and it never really drops below 10%, and I can't recall ever seeing DNS.exe on Windows 2000 ever go past the low single digits. No Active Directory on either machine, the processor power, memory and mail volume also. The only difference is the RAID card and only three 15K RPM drives in RAID 5 instead of six. Unless there is something unique to my environment, I would stay away from Windows 2003 DNS when used as a caching server with Declude/IMail, or for that matter, any possible high volume use of DNS on that platform. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude 2.0b status
Is anyone happily running Declude 2.0 beta for Imail?
Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
Could you please let me know what condition causes E-mail to be left in the overflow directory, and exactly how Declude determines how/when to process such messages. The short version is that the situation is handled better than if the overflow directory isn't used (many people don't get that). The longer version is that Declude will move E-mail (actually, just the Q*.SMD file) to the overflow directory when Declude detects that there are more than X service-started processes (where X is 30, unless you have IMail set to use a different number of maximum processes). Those can be declude.exe, smtp32.exe, or AV processes. Once this situation occurs, Declude will continue to move E-mails to the overflow directory until the number of service-started processes is less than X. At that point, when an E-mail arrives, Declude will start enough Declude processes to hit the limit of X (each of which scans a single E-mail). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Problem with mail from Earthlink, gmail and weblists.com
So much for my memory. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, January 24, 2005 11:55 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Problem with mail from Earthlink, gmail and weblists.com John, It's fixed in the latest beta, but not 1.82. That version only fixed the one issue with SPAMHEADERS, otherwise it is the same as 1.81. Matt John Tolmachoff (Lists) wrote: Declude 1.82 is continuing to use the wrong line for subject on these. The common problem is the domain key header: DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=test1; d=earthlink.net; h=Message-ID:From:To:Subject:Date:MIME-Version:Content-Type:X-Priority:X- MSM ail-Priority:X-Mailer:X-MimeOLE; b=lceW7U8Nm756EyIfANBSppcc49aIUof2dIuBftKbZ7WlYH+AHxtSCLy+Dzdyu7Kk; Declude is picking up Subject in there and using that as the subject line. (So is SpamReview) I thought this was fixed. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Not whitelisted, why
No it is not the last line of the file! In that case, the next step would be to double-check all settings (such as making sure that the paths are correct, no typos, etc.). If that doesn't explain the problem, you can use LOGLEVEL DEBUG, and send the results to [EMAIL PROTECTED], and we can see what is happening. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
My understanding is that this is an issue with just some firewalls and not universal. Please correct me if I am wrong. Thanks, Matt John Tolmachoff (Lists) wrote: Matt, on the Windows 2003 DNS: You are aware of the time out issues and such aren't you? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED]] On Behalf Of Matt Sent: Monday, January 24, 2005 11:43 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS Scott, Could you please let me know what condition causes E-mail to be left in the overflow directory, and exactly how Declude determines how/when to process such messages. On a side note, I was forced to do a rebuild on a backup server running Windows 2003. The DNS.exe process is a big-time dog compared to that on Windows 2000. I'm seeing DNS.exe reach over 50% of CPU utilization at times, and it never really drops below 10%, and I can't recall ever seeing DNS.exe on Windows 2000 ever go past the low single digits. No Active Directory on either machine, the processor power, memory and mail volume also. The only difference is the RAID card and only three 15K RPM drives in RAID 5 instead of six. Unless there is something unique to my environment, I would stay away from Windows 2003 DNS when used as a caching server with Declude/IMail, or for that matter, any possible high volume use of DNS on that platform. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] whitelist not configured right?
Hi, We regularly use the whitelist feature with our clients, and it always works. Now, however, when I try to use it with our own domain, it doesn't seem to be operating. When I connect to our mail server from home (using broadband cable) to send messages, the system always gives me a high spam score (specifically failing cmdspace and spffail). So in the whitelist file for our domain name, I put a line IP x.x.x.x, where x.x.x.x is my home IP address. However, the Declude continues to scan messages sent from my home PC for spam, and to act accordingly. What am I missing here? Ben BC Web --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelist not configured right?
So in the whitelist file for our domain name, I put a line IP x.x.x.x, where x.x.x.x is my home IP address. However, the Declude continues to scan messages sent from my home PC for spam, and to act accordingly. The problem is that whitelist files don't have an option of IP x.x.x.x. In this case, you could add a line WHITELIST IP x.x.x.x in the \IMail\Declude\global.cfg file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
Matt- I've been using W2003 on one of my DNS servers for several months now, and I have not experienced what you descibe. Have you checked the DNS event log? It's separate now from the App, Security, and System event logs. Maybe there's a clue there. -Dave Doherty Skywaves, inc. - Original Message - From: Matt To: Declude.JunkMail@declude.com Sent: Monday, January 24, 2005 3:09 PM Subject: Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS My understanding is that this is an issue with just some firewalls and not universal. Please correct me if I am wrong.Thanks,MattJohn Tolmachoff (Lists) wrote: Matt, on the Windows 2003 DNS: You are aware of the time out issues and such aren't you? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED]] On Behalf Of Matt Sent: Monday, January 24, 2005 11:43 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS Scott, Could you please let me know what condition causes E-mail to be left in the overflow directory, and exactly how Declude determines how/when to process such messages. On a side note, I was forced to do a rebuild on a backup server running Windows 2003. The DNS.exe process is a big-time dog compared to that on Windows 2000. I'm seeing DNS.exe reach over 50% of CPU utilization at times, and it never really drops below 10%, and I can't recall ever seeing DNS.exe on Windows 2000 ever go past the low single digits. No Active Directory on either machine, the processor power, memory and mail volume also. The only difference is the RAID card and only three 15K RPM drives in RAID 5 instead of six. Unless there is something unique to my environment, I would stay away from Windows 2003 DNS when used as a caching server with Declude/IMail, or for that matter, any possible high volume use of DNS on that platform. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
This was covered quite extensively on the Imail list oh probably a year ago. From my memory (we all know what that means) there are 2 possible issues: 1. If there is more than 1 IP on the server, Imail was sending DNS tests requests (ala Imail Anti-Spam) on one IP and the response was coming back to a different IP in Windows 2003 DNS service. This was a minor problem, and was never known to affect Declude that I can remember. 2. Windows 2003 DNS service added/changed configuration which the end result was the length of the data was greater than it should be and that was causing problems. Again, this is in the Imail archives. If I did not have so much work right now, I would help did them up as I was one of the persons involved in investigating it. Fixes were registry settings. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Aaron Moreau-Cook Sent: Monday, January 24, 2005 12:02 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS I know I'm not aware, care to expand? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, January 24, 2005 11:59 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS Matt, on the Windows 2003 DNS: You are aware of the time out issues and such aren't you? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, January 24, 2005 11:43 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS Scott, Could you please let me know what condition causes E-mail to be left in the overflow directory, and exactly how Declude determines how/when to process such messages. On a side note, I was forced to do a rebuild on a backup server running Windows 2003. The DNS.exe process is a big-time dog compared to that on Windows 2000. I'm seeing DNS.exe reach over 50% of CPU utilization at times, and it never really drops below 10%, and I can't recall ever seeing DNS.exe on Windows 2000 ever go past the low single digits. No Active Directory on either machine, the processor power, memory and mail volume also. The only difference is the RAID card and only three 15K RPM drives in RAID 5 instead of six. Unless there is something unique to my environment, I would stay away from Windows 2003 DNS when used as a caching server with Declude/IMail, or for that matter, any possible high volume use of DNS on that platform. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
Declude Queue is nice and was invaluable before the Queue Manager service on Imail. The only problem is this: RSP than X. At that point, when an E-mail arrives, Declude will start enough RSP Declude processes to hit the limit of X (each of which scans a single E-mail). DQ requires a continues flow of email in order to clear the /overflow folder. Sending a single message through will not keep the DQ delivery process going. We're still having a number of Imail/PF issues and when a machine gets swamped we switch processing entirely to another box. Then we're stuck with q files in the /overflow folder and no way to get them out. If you copy them into the /spool they don't get scanned by Declude JM or Virus -- Best regards, Davidmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
Scott, Am I to assume a first in, first out type of scenario in the way that it handles the overflow? I have my server set to 60 delivery threads, up from the default 30. Sandy I believe indicated that 64 was the limit due to the fact that IMail is not multi-threaded or something to that tune. My E-mail backup isn't bad at the moment, just occasional stuff at peak times up to about 100, although the other day when the processors were pegged due to my not having disabled the Indexing Service, I backed it up for about 45 minutes worth. I'm probably averaging about 60% utilization (hourly average) right now. Right now we are deleting about 75% of all E-mail (using the DELETE action). I'm pretty sure that if we are reaching 60 threads, we are only doing so with the totality of messages and not just what we might deliver or ROUTETO/COPYTO. Counting the files in my spool, I am coming up measurably short of 60 Q*.SMD files while I see messages in the overflow (which happens every few minutes). It seems that this would represent the number of threads that are open, apart from what Declude has in overflow. Does having Declude DELETE E-mail go against the thread total? Also, how should I confirm how many threads are being used by IMail just so that I can rule out the issue with not seeing 60 such files? Lastly, you indicated multiple things that can go against this number, am I to assume that Declude counts not what IMail is limited by (IMail threads), but instead it just uses this as a guide, so maybe increasing the number in IMail even higher, while it won't have an effect on IMail, it would cause Declude to not overflow, especially when there is processing power to spare? Although I'm definitely moving from IMail, I fear hitting a wall before that actually happens. There is definitely more I/O and processor to spare on this box, but the overflow conditions happen every few minutes. Thanks, Matt R. Scott Perry wrote: Could you please let me know what condition causes E-mail to be left in the overflow directory, and exactly how Declude determines how/when to process such messages. The short version is that the situation is handled better than if the overflow directory isn't used (many people don't get that). The longer version is that Declude will move E-mail (actually, just the Q*.SMD file) to the overflow directory when Declude detects that there are more than X service-started processes (where X is 30, unless you have IMail set to use a different number of maximum processes). Those can be declude.exe, smtp32.exe, or AV processes. Once this situation occurs, Declude will continue to move E-mails to the overflow directory until the number of service-started processes is less than X. At that point, when an E-mail arrives, Declude will start enough Declude processes to hit the limit of X (each of which scans a single E-mail). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 2.0b status
Scott Fisher wrote: Is anyone happily running Declude 2.0 beta for Imail? I asked about this last week and received an email from Declude saying there would be news last week. So I dunno what the status is... I'm running Smartermail and REALLY want to get Declude running again. Jim --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Problems with msn and hotmail
Anyone seeing odd problems with hotmail and msn.com accounts being rejected. I have a number of valid email's that are being rejected. 1:24 13:00 SMTPD(61d200c101cc4412) [66.162.138.13] connect 65.54.168.114 port 60403 01:24 13:00 SMTPD(61d200c101cc4412) [65.54.168.114] EHLO hotmail.com 01:24 13:00 SMTPD(61d200c101cc4412) [65.54.168.114] unacceptable mail address in MAIL FROM:[EMAIL PROTECTED] I am seeing fairly large amounts of these sometimes they mention something about RFC's. Sometimes not. Almost looks like they are in the kill.lst but they aren't. Ideas? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT - File manager for nonstandard files
Hi, all- A colo customer's website was hacked to include a bunch of movie files buried deep in his site. The directoriesuse nonstandard Windows characters, and I can't get to the filesthrough the command prompt or the Windows Explorer. The diruse.exe utility does see them, however. Does anybody here know of a way to get to these files and remove them? -Dave DohertySkywaves, Inc.301-652-8822 x209
RE: [Declude.JunkMail] OT - File manager for nonstandard files
TryDeleteFXPfiles available here... http://www.tucows.com/preview/335686.html -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Dave DohertySent: Monday, January 24, 2005 4:23 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] OT - File manager for nonstandard files Hi, all- A colo customer's website was hacked to include a bunch of movie files buried deep in his site. The directoriesuse nonstandard Windows characters, and I can't get to the filesthrough the command prompt or the Windows Explorer. The diruse.exe utility does see them, however. Does anybody here know of a way to get to these files and remove them? -Dave DohertySkywaves, Inc.301-652-8822 x209
Re: [Declude.JunkMail] OT - File manager for nonstandard files
Hi Dave, There is a posix utility called RM.EXE from the Windows 2000 Resource Kit (in the apps/posixdirectoryon the CD) that can be used to remove these. You first need to find out the 8.3 directory and filenames from the command line for use with this old utility. I've used this for exactly the scenario you've outlined. You'll need to stop any services that are using these files/directories first. If you can't find the utility in the W2K Resource Kit, email me offlist and I'll send you the .EXE. Darin. - Original Message - From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Monday, January 24, 2005 5:23 PM Subject: [Declude.JunkMail] OT - File manager for nonstandard files Hi, all- A colo customer's website was hacked to include a bunch of movie files buried deep in his site. The directoriesuse nonstandard Windows characters, and I can't get to the filesthrough the command prompt or the Windows Explorer. The diruse.exe utility does see them, however. Does anybody here know of a way to get to these files and remove them? -Dave DohertySkywaves, Inc.301-652-8822 x209
Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
David, We do the same thing. One thing you can do is fake mail coming in. I use a batch file. REM THIS WILL CLEAN OUT THE DECLUDE QUEUE declude x:\imail\spool\Qa6da175e02447716.SMD call x:\imail\cleandq.bat The Q file I referenced does not exist and it does not matter that it does not. Declude will see that there are not 30 processes running and than start to process the mail in the overflow directory. The loop calling the batch file ensures that 30 process stay running. Once the overflow is clean ctrl+c the batch file and move on. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. David Sullivan writes: Declude Queue is nice and was invaluable before the Queue Manager service on Imail. The only problem is this: RSP than X. At that point, when an E-mail arrives, Declude will start enough RSP Declude processes to hit the limit of X (each of which scans a single E-mail). DQ requires a continues flow of email in order to clear the /overflow folder. Sending a single message through will not keep the DQ delivery process going. We're still having a number of Imail/PF issues and when a machine gets swamped we switch processing entirely to another box. Then we're stuck with q files in the /overflow folder and no way to get them out. If you copy them into the /spool they don't get scanned by Declude JM or Virus -- Best regards, Davidmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT - File manager for nonstandard files
Thanks, Harry. I'll try it. -Dave - Original Message - From: Harry Palmer To: Declude.JunkMail@declude.com Sent: Monday, January 24, 2005 5:29 PM Subject: RE: [Declude.JunkMail] OT - File manager for nonstandard files TryDeleteFXPfiles available here... http://www.tucows.com/preview/335686.html -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Dave DohertySent: Monday, January 24, 2005 4:23 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] OT - File manager for nonstandard files Hi, all- A colo customer's website was hacked to include a bunch of movie files buried deep in his site. The directoriesuse nonstandard Windows characters, and I can't get to the filesthrough the command prompt or the Windows Explorer. The diruse.exe utility does see them, however. Does anybody here know of a way to get to these files and remove them? -Dave DohertySkywaves, Inc.301-652-8822 x209
Re: [Declude.JunkMail] OT - File manager for nonstandard files
Thanks, Darin. I'll look for it. -d - Original Message - From: Darin Cox To: Declude.JunkMail@declude.com Sent: Monday, January 24, 2005 5:36 PM Subject: Re: [Declude.JunkMail] OT - File manager for nonstandard files Hi Dave, There is a posix utility called RM.EXE from the Windows 2000 Resource Kit (in the apps/posixdirectoryon the CD) that can be used to remove these. You first need to find out the 8.3 directory and filenames from the command line for use with this old utility. I've used this for exactly the scenario you've outlined. You'll need to stop any services that are using these files/directories first. If you can't find the utility in the W2K Resource Kit, email me offlist and I'll send you the .EXE. Darin. - Original Message - From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Monday, January 24, 2005 5:23 PM Subject: [Declude.JunkMail] OT - File manager for nonstandard files Hi, all- A colo customer's website was hacked to include a bunch of movie files buried deep in his site. The directoriesuse nonstandard Windows characters, and I can't get to the filesthrough the command prompt or the Windows Explorer. The diruse.exe utility does see them, however. Does anybody here know of a way to get to these files and remove them? -Dave DohertySkywaves, Inc.301-652-8822 x209
Re[2]: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
Hello Darrell, Monday, January 24, 2005, 5:38:51 PM, you wrote: Dsic We do the same thing. One thing you can do is fake mail coming in. I use a Dsic batch file. Dsic REM THIS WILL CLEAN OUT THE DECLUDE QUEUE Thanks we'll give it a shot. This should be a great help. -- Best regards, Davidmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelist not configured right?
Thanks, Scott. I also thought that whitelist files included all of the same options as the whitelist commands that go into a global.cfg file. What about @domain-name? Does that work in a whitelist file? Thanks, Ben - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, January 24, 2005 12:23 PM Subject: Re: [Declude.JunkMail] whitelist not configured right? So in the whitelist file for our domain name, I put a line IP x.x.x.x, where x.x.x.x is my home IP address. However, the Declude continues to scan messages sent from my home PC for spam, and to act accordingly. The problem is that whitelist files don't have an option of IP x.x.x.x. In this case, you could add a line WHITELIST IP x.x.x.x in the \IMail\Declude\global.cfg file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
Scott, thanks for the explanations. I still have a few follow-ups though if you don't mind. First off, since DNS is acting like such a hog on Windows 2003, I'm going to guess that this is what is slowing down the processing of E-mail and why I am suddenly getting steady overflow. I can resolve that in various ways, but this is a temporary situation since I am going to migrate back to the other box once I rebuild it. DNS will be migrated to a separate server in the coming months...my first foray into Linux. I'm more concerned about the future, and hitting a wall that wasn't necessarily expected, otherwise thinking that I still had plenty of capacity to spare, and hence the additional questions. You seemed to indicate that service launched processes count against the threads...meaning that smtp32.exe launches declude.exe, which launches F-Prot and McAfee. So would this count for 4 threads (not according to Declude, but Windows/IMail)? What about Sniffer and each external test that I have configured within Declude, would those count as well? I also re-read the following post by Sandy: http://www.mail-archive.com/imail_forum@list.ipswitch.com/msg94576.html It seems to indicate that there is no thread limit, but something else instead; a limit of 64 objects per thread. I'm not sure how that might apply here. So if I am seeing overflow with processing power to spare, I should be able to increase the threads in IMail to a higher number than 60 in order to better utilize my server's capacity. With memory utilization below 50%, it doesn't seem like there is much risk in doing this, would that be correct? I haven't applied any of the registry tweaks, and probably won't on this box since it is only a temporary home. Still good stuff to know about should I ever have to do this again. Thanks, Matt R. Scott Perry wrote: Am I to assume a first in, first out type of scenario in the way that it handles the overflow? I believe so, but that is handled by Windows (Declude simply asks Windows for all the files, and whatever Windows returns first gets processed first). I have my server set to 60 delivery threads, up from the default 30. Sandy I believe indicated that 64 was the limit due to the fact that IMail is not multi-threaded or something to that tune. Unfortunately, there is no set limit. Some people have problems with 30, others are fine with 60 or higher. It also depends on any changes made to the registry settings for the mystery heap (which gets even weirder; some people see better results by raising the value there, while others see better results by lowering it!). Does having Declude DELETE E-mail go against the thread total? Not with IMail v8 (since IMail v8 uses one process to handle an unlimited number of E-mail deliveries). So using the DELETE action versus another action will have little effect (with IMail v8) on the overflow situation. Also, how should I confirm how many threads are being used by IMail just so that I can rule out the issue with not seeing 60 such files? You would need to count the total number of Declude.exe, SMTP32.exe, and AV processes. Lastly, you indicated multiple things that can go against this number, am I to assume that Declude counts not what IMail is limited by (IMail threads), but instead it just uses this as a guide, so maybe increasing the number in IMail even higher, while it won't have an effect on IMail, it would cause Declude to not overflow, especially when there is processing power to spare? Declude counts (to the best of its ability) the number of service-started processes. That is what IMail (Windows, to be technical) is limited by. Changing the IMail setting will also change the number that Declude uses. Although I'm definitely moving from IMail, I fear hitting a wall before that actually happens. There is definitely more I/O and processor to spare on this box, but the overflow conditions happen every few minutes. Correct. The I/O and processor time aren't relevant here -- they could both be at 0, and the situation could still occur (for example, if 60 E-mails come in simultaneously, and take 30 seconds each to scan due to waiting for DNS packets to come back). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives
Re: [Declude.JunkMail] whitelist not configured right?
Thanks, Scott. I also thought that whitelist files included all of the same options as the whitelist commands that go into a global.cfg file. No: The D:\IMail\Declude\mywhitelist.txt file would then contain either one E-mail address ([EMAIL PROTECTED]) or domain (@example.com) or subdomain (.example.com) per line. What about @domain-name? Does that work in a whitelist file? Yes, that will work. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
John, I do recall seeing this stuff, but I came away with the impression that it was only applicable if you were behind a particular type of firewall that had issues with the size of the packets or something to that tune. If this was causing many timeouts, I would have seen a slight increase in spam getting through I would think, but nothing out of the ordinary has occurred that I am aware of. It is possible however that the new capability of the Windows 2003 DNS server is what is causing the extra processor utilization, and I don't think that I benefit from having it on, so I'll try turning it off using the registry hack and then see if it makes any difference. I'm also going to look at what ways if any are available to tune the cache in DNS, thinking that a substantial difference here might also be an issue. Thanks, Matt John Tolmachoff (Lists) wrote: This was covered quite extensively on the Imail list oh probably a year ago. From my memory (we all know what that means) there are 2 possible issues: 1. If there is more than 1 IP on the server, Imail was sending DNS tests requests (ala Imail Anti-Spam) on one IP and the response was coming back to a different IP in Windows 2003 DNS service. This was a minor problem, and was never known to affect Declude that I can remember. 2. Windows 2003 DNS service added/changed configuration which the end result was the length of the data was greater than it should be and that was causing problems. Again, this is in the Imail archives. If I did not have so much work right now, I would help did them up as I was one of the persons involved in investigating it. Fixes were registry settings. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED]] On Behalf Of Aaron Moreau-Cook Sent: Monday, January 24, 2005 12:02 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS I know I'm not aware, care to expand? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff (Lists) Sent: Monday, January 24, 2005 11:59 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS Matt, on the Windows 2003 DNS: You are aware of the time out issues and such aren't you? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED]] On Behalf Of Matt Sent: Monday, January 24, 2005 11:43 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS Scott, Could you please let me know what condition causes E-mail to be left in the overflow directory, and exactly how Declude determines how/when to process such messages. On a side note, I was forced to do a rebuild on a backup server running Windows 2003. The DNS.exe process is a big-time dog compared to that on Windows 2000. I'm seeing DNS.exe reach over 50% of CPU utilization at times, and it never really drops below 10%, and I can't recall ever seeing DNS.exe on Windows 2000 ever go past the low single digits. No Active Directory on either machine, the processor power, memory and mail volume also. The only difference is the RAID card and only three 15K RPM drives in RAID 5 instead of six. Unless there is something unique to my environment, I would stay away from Windows 2003 DNS when used as a caching server with Declude/IMail, or for that matter, any possible high volume use of DNS on that platform. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL
Re: [Declude.JunkMail] Problems with msn and hotmail
This appears to be an issue with your IMail settings. It is unsafe to use Mail From rejection for domains that fail a lookup unless you expect everyone else's DNS to be operational and accessible 100% of the time and perfectly configured. My suggestion would be to turn this off in the IMail anti-spam settings. If you are using Declude (appears that way), generally it seems like a good idea to turn off all of IMail's anti-spam because it has been the source of multiple resource and stability issues, and can cause unpredictable behavior. I would also suggest turning off the DNS caching and failed domain skipping found under the Queue Manager settings. This stuff tends to exacerbate transient problems. Matt Ncl Admin wrote: Anyone seeing odd problems with hotmail and msn.com accounts being rejected. I have a number of valid email's that are being rejected. 1:24 13:00 SMTPD(61d200c101cc4412) [66.162.138.13] connect 65.54.168.114 port 60403 01:24 13:00 SMTPD(61d200c101cc4412) [65.54.168.114] EHLO hotmail.com 01:24 13:00 SMTPD(61d200c101cc4412) [65.54.168.114] unacceptable mail address in MAIL FROM:[EMAIL PROTECTED] I am seeing fairly large amounts of these sometimes they mention something about RFC's. Sometimes not. Almost looks like they are in the kill.lst but they aren't. Ideas? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
You seemed to indicate that service launched processes count against the threads...meaning that smtp32.exe launches declude.exe, which launches F-Prot and McAfee. So would this count for 4 threads (not according to Declude, but Windows/IMail)? What about Sniffer and each external test that I have configured within Declude, would those count as well? Unfortunately, we are not aware of a way to determine if a process was started by a service or not. Currently, Declude looks for declude.exe, smtp32.exe, scan.exe, F-Prot.exe processes (and any processes listed in the rarely used DAISYCHAIN option). Note that SMTPD32.exe -- the IMail process/service that starts Declude -- is just a single process, so it will only count once. Message Sniffer and other external tests won't count, since Declude doesn't specifically look for it (but it does indeed count as a service-started process, and could cause the memory limit to be reached). However, there would only be a maximum of one of them per E-mail (since Declude runs the external tests in serial, not in parallel). I also re-read the following post by Sandy: http://www.mail-archive.com/imail_forum@list.ipswitch.com/msg94576.html It seems to indicate that there is no thread limit, but something else instead; a limit of 64 objects per thread. That's not related here. The overflow issue deals with processes, not threads. Processes are what are listed in the Process tab in the Task Manager (such as one SMTPD32.exe process, 0 to 30 or so Declude.exe processes, etc.). Each process can have from 1 to an (almost) infinite number of threads. I'm not sure how that might apply here. So if I am seeing overflow with processing power to spare, I should be able to increase the threads in IMail to a higher number than 60 in order to better utilize my server's capacity. With memory utilization below 50%, it doesn't seem like there is much risk in doing this, would that be correct? Anything referring to thread or threads in IMail settings is not relevant to this (IMail v8 introduced one or more thread options). Declude JunkMail looks at the MaxQueProc IMail registry setting (which may also be an advanced setting in IMail Administrator, with a name such as maximum number of processes). Any other settings are not used. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Supporting Users with port 25 blocked
SBC just blocked port 25 for their dynamically assigned DSL users. I can have those users switch to SBC's SMTP servers but I have been meaning to open up port 587 for my users that travel. I was wondering what software solutions you guys have been using if any that could be run on the IMail machine. I tried Port Tunnel which worked but turned the machine in to an open relay at the same time. Is there anyway that something could be added in to Declude to make the server listen on an alternate port (in addition to port 25 of course) for SMTP? Any suggestions would be appreciated. I already asked on the IMail list. Thanks, Gary ComsecNet Dedicated Data Services Stockton, CA Phone:(209) 463-2809 Fax:(209) 938-0481 Email: [EMAIL PROTECTED] Web: www.comsec.net This message is intended for the use of the individual or entity to which it is addressed and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or an employee or agent responsible for delivering to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error please destroy this message and notify the sender by reply email. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
I found MaxQueProc in the registry and changed that to 60. There is no GUI config for this option. I also looked at the issue with MS DNS 2003. After a restart of DNS, utilization dropped from an average of about 25% to under 1% (I had it in performance monitor)...but then over the next couple of hours, it has crept back up to 10%. I have watched it enough to verify that it's utilization grows consistently over time. Disabling the EDNS thing has no effect. I've found nothing really telling about this in Google, but it looks like a classic memory leak. This installation was fresh and there is hardly anything installed on it. I would be a bit surprised to see a memory leak in DNS go undetected/unfixed at this point. If anyone else has experienced this, or can confirm my findings, please speak up. I was intending on using this server for my Web hosting DNS, but this may keep me from going there. Matt R. Scott Perry wrote: You seemed to indicate that service launched processes count against the threads...meaning that smtp32.exe launches declude.exe, which launches F-Prot and McAfee. So would this count for 4 threads (not according to Declude, but Windows/IMail)? What about Sniffer and each external test that I have configured within Declude, would those count as well? Unfortunately, we are not aware of a way to determine if a process was started by a service or not. Currently, Declude looks for declude.exe, smtp32.exe, scan.exe, F-Prot.exe processes (and any processes listed in the rarely used DAISYCHAIN option). Note that SMTPD32.exe -- the IMail process/service that starts Declude -- is just a single process, so it will only count once. Message Sniffer and other external tests won't count, since Declude doesn't specifically look for it (but it does indeed count as a service-started process, and could cause the memory limit to be reached). However, there would only be a maximum of one of them per E-mail (since Declude runs the external tests in serial, not in parallel). I also re-read the following post by Sandy: http://www.mail-archive.com/imail_forum@list.ipswitch.com/msg94576.html It seems to indicate that there is no thread limit, but something else instead; a limit of 64 objects per thread. That's not related here. The overflow issue deals with processes, not threads. Processes are what are listed in the Process tab in the Task Manager (such as one SMTPD32.exe process, 0 to 30 or so Declude.exe processes, etc.). Each process can have from 1 to an (almost) infinite number of threads. I'm not sure how that might apply here. So if I am seeing overflow with processing power to spare, I should be able to increase the threads in IMail to a higher number than 60 in order to better utilize my server's capacity. With memory utilization below 50%, it doesn't seem like there is much risk in doing this, would that be correct? Anything referring to thread or threads in IMail settings is not relevant to this (IMail v8 introduced one or more thread options). Declude JunkMail looks at the MaxQueProc IMail registry setting (which may also be an advanced setting in IMail Administrator, with a name such as maximum number of processes). Any other settings are not used. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
Matt, I seen a few articles about memory leaks in Win2K3 DNS. One specific one comes to mind about a leak when adding zones via scripting. Another one that we ran into (internally) was KB 830381. (Server Responsiveness Degrades and Queries Time Out When You Run the DNS Server Service). Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Matt [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, January 24, 2005 10:31 PM Subject: Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS I found MaxQueProc in the registry and changed that to 60. There is no GUI config for this option. I also looked at the issue with MS DNS 2003. After a restart of DNS, utilization dropped from an average of about 25% to under 1% (I had it in performance monitor)...but then over the next couple of hours, it has crept back up to 10%. I have watched it enough to verify that it's utilization grows consistently over time. Disabling the EDNS thing has no effect. I've found nothing really telling about this in Google, but it looks like a classic memory leak. This installation was fresh and there is hardly anything installed on it. I would be a bit surprised to see a memory leak in DNS go undetected/unfixed at this point. If anyone else has experienced this, or can confirm my findings, please speak up. I was intending on using this server for my Web hosting DNS, but this may keep me from going there. Matt R. Scott Perry wrote: You seemed to indicate that service launched processes count against the threads...meaning that smtp32.exe launches declude.exe, which launches F-Prot and McAfee. So would this count for 4 threads (not according to Declude, but Windows/IMail)? What about Sniffer and each external test that I have configured within Declude, would those count as well? Unfortunately, we are not aware of a way to determine if a process was started by a service or not. Currently, Declude looks for declude.exe, smtp32.exe, scan.exe, F-Prot.exe processes (and any processes listed in the rarely used DAISYCHAIN option). Note that SMTPD32.exe -- the IMail process/service that starts Declude -- is just a single process, so it will only count once. Message Sniffer and other external tests won't count, since Declude doesn't specifically look for it (but it does indeed count as a service-started process, and could cause the memory limit to be reached). However, there would only be a maximum of one of them per E-mail (since Declude runs the external tests in serial, not in parallel). I also re-read the following post by Sandy: http://www.mail-archive.com/imail_forum@list.ipswitch.com/msg94576.html It seems to indicate that there is no thread limit, but something else instead; a limit of 64 objects per thread. That's not related here. The overflow issue deals with processes, not threads. Processes are what are listed in the Process tab in the Task Manager (such as one SMTPD32.exe process, 0 to 30 or so Declude.exe processes, etc.). Each process can have from 1 to an (almost) infinite number of threads. I'm not sure how that might apply here. So if I am seeing overflow with processing power to spare, I should be able to increase the threads in IMail to a higher number than 60 in order to better utilize my server's capacity. With memory utilization below 50%, it doesn't seem like there is much risk in doing this, would that be correct? Anything referring to thread or threads in IMail settings is not relevant to this (IMail v8 introduced one or more thread options). Declude JunkMail looks at the MaxQueProc IMail registry setting (which may also be an advanced setting in IMail Administrator, with a name such as maximum number of processes). Any other settings are not used. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus
Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
Thanks Darrell, that definitely sounds like it's the culprit: http://support.microsoft.com/?kbid=830381 This didn't come up in my searches because it is described so generically and I was searching for things like processor utilization and memory leaks. I like the part where the describe the workaround: "There is no suggested workaround. To minimize the effects of the problem, periodically stop and then restart the DNS Server service." The hotfix has been requested, I'll update the list as to whether or not this works. It certainly sounds promising. Matt Darrell ([EMAIL PROTECTED]) wrote: Matt, I seen a few articles about memory leaks in Win2K3 DNS. One specific one comes to mind about a leak when adding zones via scripting. Another one that we ran into (internally) was KB 830381. (Server Responsiveness Degrades and Queries Time Out When You Run the DNS Server Service). Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: "Matt" [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, January 24, 2005 10:31 PM Subject: Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS I found MaxQueProc in the registry and changed that to 60. There is no GUI config for this option. I also looked at the issue with MS DNS 2003. After a restart of DNS, utilization dropped from an average of about 25% to under 1% (I had it in performance monitor)...but then over the next couple of hours, it has crept back up to 10%. I have watched it enough to verify that it's utilization grows consistently over time. Disabling the EDNS thing has no effect. I've found nothing really telling about this in Google, but it looks like a classic memory leak. This installation was fresh and there is hardly anything installed on it. I would be a bit surprised to see a memory leak in DNS go undetected/unfixed at this point. If anyone else has experienced this, or can confirm my findings, please speak up. I was intending on using this server for my Web hosting DNS, but this may keep me from going there. Matt R. Scott Perry wrote: You seemed to indicate that service launched processes count against the threads...meaning that smtp32.exe launches declude.exe, which launches F-Prot and McAfee. So would this count for 4 threads (not according to Declude, but Windows/IMail)? What about Sniffer and each external test that I have configured within Declude, would those count as well? Unfortunately, we are not aware of a way to determine if a process was started by a service or not. Currently, Declude looks for declude.exe, smtp32.exe, scan.exe, F-Prot.exe processes (and any processes listed in the rarely used DAISYCHAIN option). Note that SMTPD32.exe -- the IMail process/service that starts Declude -- is just a single process, so it will only count once. Message Sniffer and other external tests won't count, since Declude doesn't specifically look for it (but it does indeed count as a service-started process, and could cause the memory limit to be reached). However, there would only be a maximum of one of them per E-mail (since Declude runs the external tests in serial, not in parallel). I also re-read the following post by Sandy: http://www.mail-archive.com/imail_forum@list.ipswitch.com/msg94576.html It seems to indicate that there is no "thread limit", but something else instead; a limit of "64 objects per thread". That's not related here. The overflow issue deals with processes, not threads. Processes are what are listed in the "Process" tab in the Task Manager (such as one SMTPD32.exe process, 0 to 30 or so Declude.exe processes, etc.). Each process can have from 1 to an (almost) infinite number of threads. I'm not sure how that might apply here. So if I am seeing overflow with processing power to spare, I should be able to increase the threads in IMail to a higher number than 60 in order to better utilize my server's capacity. With memory utilization below 50%, it doesn't seem like there is much risk in doing this, would that be correct? Anything referring to "thread" or "threads" in IMail settings is not relevant to this (IMail v8 introduced one or more "thread" options). Declude JunkMail looks at the MaxQueProc IMail registry setting (which may also be an advanced setting in IMail Administrator, with a name such as "maximum number of processes"). Any other settings are not used. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and
RE: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS
One way of checking for a work around is to schedule a batch file say hourly to flush the cache. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, January 24, 2005 10:00 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003 DNS Thanks Darrell, that definitely sounds like it's the culprit: http://support.microsoft.com/?kbid=830381 This didn't come up in my searches because it is described so generically and I was searching for things like processor utilization and memory leaks. I like the part where the describe the workaround: There is no suggested workaround. To minimize the effects of the problem, periodically stop and then restart the DNS Server service. The hotfix has been requested, I'll update the list as to whether or not this works. It certainly sounds promising. Matt Darrell ([EMAIL PROTECTED]) wrote: Matt,I seen a few articles about memory leaks in Win2K3 DNS. One specific onecomes to mind about a leak when adding zones via scripting. Another onethat we ran into (internally) was KB 830381. (Server ResponsivenessDegrades and Queries Time Out When You Run the DNS Server Service).Darrell---Check out http://www.invariantsystems.com for utilities for Declude AndImail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTGIntegration, and Log Parsers.- Original Message - From: Matt [EMAIL PROTECTED]To: Declude.JunkMail@declude.comSent: Monday, January 24, 2005 10:31 PMSubject: Re: [Declude.JunkMail] Overflow directory and a note about Windows2003 DNS I found MaxQueProc in the registry and changed that to 60. There is noGUI config for this option.I also looked at the issue with MS DNS 2003. After a restart of DNS,utilization dropped from an average of about 25% to under 1% (I had itin performance monitor)...but then over the next couple of hours, it hascrept back up to 10%. I have watched it enough to verify that it'sutilization grows consistently over time. Disabling the EDNS thing hasno effect. I've found nothing really telling about this in Google, butit looks like a classic memory leak. This installation was fresh andthere is hardly anything installed on it. I would be a bit surprised tosee a memory leak in DNS go undetected/unfixed at this point. If anyoneelse has experienced this, or can confirm my findings, please speak up.I was intending on using this server for my Web hosting DNS, but thismay keep me from going there.MattR. Scott Perry wrote: You seemed to indicate that service launched processes count againstthe threads...meaning that smtp32.exe launches declude.exe, whichlaunches F-Prot and McAfee. So would this count for 4 threads (notaccording to Declude, but Windows/IMail)? What about Sniffer andeach external test that I have configured within Declude, would thosecount as well? Unfortunately, we are not aware of a way to determine if a process wasstarted by a service or not. Currently, Declude looks fordeclude.exe, smtp32.exe, scan.exe, F-Prot.exe processes (and anyprocesses listed in the rarely used DAISYCHAIN option).Note that SMTPD32.exe -- the IMail process/service that starts Declude-- is just a single process, so it will only count once.Message Sniffer and other external tests won't count, since Decludedoesn't specifically look for it (but it does indeed count as aservice-started process, and could cause the memory limit to bereached). However, there would only be a maximum of one of them perE-mail (since Declude runs the external tests in serial, not inparallel). I also re-read the following post by Sandy:http://www.mail-archive.com/imail_forum@list.ipswitch.com/msg94576.htmlIt seems to indicate that there is no thread limit, but somethingelse instead; a limit of 64 objects per thread. That's not related here. The overflow issue deals with processes, notthreads. Processes are what are listed in the Process tab in theTask Manager (such as one SMTPD32.exe process, 0 to 30 or soDeclude.exe processes, etc.). Each process can have from 1 to an(almost) infinite number of threads. I'm not sure how that might apply here. So if I am seeing overflowwith processing power to spare, I should be able to increase thethreads in IMail to a higher number than 60 in order to betterutilize my server's capacity. With memory utilization below 50%, itdoesn't seem like there is much risk in doing this, would that becorrect? Anything referring to thread or threads in IMail settings is notrelevant to this (IMail v8 introduced one or more thread options).Declude JunkMail looks at the MaxQueProc IMail registry setting (whichmay also be an advanced setting in IMail Administrator, with a namesuch as maximum number of processes). Any other settings are not used. -Scott---Declude JunkMail: The advanced
