I was just wondering if anyone else has been seeing IMail SMTP crash
with a noticeable frequency in the last few weeks. I have had mine go
down 3 times now in the last 5 days or so, and this is something that I
can't recall the last time that it happened before that. Essentially
the SMTP
Matt wrote:
Hi Matt -
I have not had any issues at all - what other clues do you have to
offer? In your logs is there any simularity among the last message
processed before the crash(s). Do you record the 'peak memory usage' -
to see if there is some kind of of memory issue? Run the smtp
I am behind a firewall and run virus software and all that jazz, but I just
ran into a problem with my SMTP crashing repeatedly. Check for netsvc.exe
on your system. None of my scanners caught it, even in safe mode, but it
had a new date on it so I deleted it and my problems went away.
Susan
Matt wrote:
I might try the NET START SMTPSVC trick, however I did come across
someone else's server that would crash when SMTPSVC was in a bad state
and a restart attempt was made. In this case, a NET STOP would seem
to be required before a NET START since it only partially crashes.
Not an expert on pix (been years since I worked on one) but
generally there is a way on their routers to force a "barebones" boot that loads
no config and then you could tftp a config onto the
unit.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net
I've looked and looked for anything like that with
no luck. I don't know how definitive this answer was, but on another forum
I was told that if the erasedisk622.bin image I used did not work to clear all
flash RAM, then the unit wasmalfunctioning and would have to be
replaced.
Darin.
Best way to reset a PIX to factory defaults (if you can log in) is
"write erase" then reboot. If you don't have the password, check this
out: "http://www.cisco.com/warp/public/110/34.shtml#pix_without".
Not 100% if you can do it from the monitor, but I've been in a similar
trap in the past
Unfortunately, wr erase only works from enable
mode. We can only get to monitor mode, as the Pix hangs after loading the
flash image... I'm guessing it hangs in the process of loading the
startup-config.
Darin.
- Original Message -
From: S.J.Stanaitis
To:
Hi all,
I now successfully have JunkMail using SPAMC32 to access a
Linux spamd server for SPAM. I am training the bayes database as the user that
SPAMC32 is using to contact the spamd server. However, in this setup I am not
getting any subject line info (SPAM) or whatever I set up
Sucks dude. Any chance it's part of a load balanced config and it's
looking for the other PIX? Have you just let it sit to see if it times
out?
Darin Cox wrote:
Unfortunately, wr erase only works
from enable mode. We can only get to monitor mode, as the Pix hangs
after loading the
I don't think you're actually able to modify any of the messages with
SpamAssassin, you may be able to modify Declude to do so, but the
SpamAssassin setting to do so will not work. I just use the header
info and filter everything SpamAssassin nails into a sub-folder when
I'm fishing for
Only thing I can think of is from monitor mode...copy over the
flash with tftp.
Otherwise you have to call cisco support and get an erase
utility.
- Original Message -
From:
S.J.Stanaitis
To: Declude.JunkMail@declude.com
Sent: Monday, November 28, 2005 2:00
PM
Hi Geoff
Geoff Varney wrote:
Hi all,
I now successfully have
JunkMail using SPAMC32 to access a
Linux spamd server for SPAM. I am training the bayes database as the
user that
SPAMC32 is using to contact the spamd server. However, in this setup I
am not
getting any subject
You said it. Yeah I've let it sit for hours
to see if there was a process that would time out. On older firmware
versions (6.2 and earlier), it continually reboots. On 7.0 it just
sits.
I was originally seeing Errors in the config
related to failover... whichwere actual text messages in
Yep... no erase utilities after 6.22
evidently. When I loaded 6.22 through monitor mode, and thenloaded
the erase image (also through monitor mode),it erased the flash image but
not the configs.
Darin.
- Original Message -
From: Doug Anderson
To: Declude.JunkMail@declude.com
Only thing I can think of is from monitor mode...copy over the flash
with tftp.
A few different PIX OS images were tried, including the eraser
image, but none of them overwrote the corrupt area.
Darin gave me the full rundown off-line and, sadly, there was nothing
he could do (supported
Yep. Thanks again for the assist, Sandy. If only
Darin.
- Original Message -
From: Sanford Whiteman [EMAIL PROTECTED]
To: Doug Anderson Declude.JunkMail@declude.com
Sent: Monday, November 28, 2005 4:23 PM
Subject: Re[2]: [Declude.JunkMail] OT: Erasing Cisco Pix 515 flash RAM
I now successfully have JunkMail using SPAMC32 to access a Linux
spamd server for SPAM.
Good to hear.
However, in this setup I am not getting any subject line info
(SPAM) or whatever I set up for it to say.
Right. You won't get any header or subject modification
Is it possible you have a bad memory module in the box?
Remove one of the memory modules and load a 6.x release. If that does not
work try th other stick.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Darin Cox
Sent: Monday, November
I had two other sticks of RAM handy for an upgrade to another Pix, so I
swapped them just in case no go. It was worth a shot, but from what I'm
told, the flash RAM in the Pix 515 is actually soldered to the mobo.
Darin.
- Original Message -
From: Kevin Bilbee [EMAIL PROTECTED]
To:
I am trying to detect emails that are sent via webmail - be it from
yahoo, hotmail, etc. Can that be reliably done? What do I need to look
for in the headers?
Thanks!
-Nick
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail
Anyone using F-Prot for antivirus...they just came
out with a new update and I have been trying all day to get there to update with
no luck...anybody else see this?
Richard FarrisEthixs Online1.270.247.
Office1.800.548.3877 Tech Support"Crossroads to a Cleaner
Internet
If you find your are holding mail because of a
keyword, how do you find out which keyword it is?
Richard FarrisEthixs Online1.270.247.
Office1.800.548.3877 Tech Support"Crossroads to a Cleaner
Internet
Depends upon how it failed. If by
keyword you mean a filter test like my KEYSUBJECT then in the log it will tell
you which line of the associated filter file that a match was found.
John T
eServices For You
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL
Same
problem here. I get an "Internal Server Error"
Kevin
Bilbee
-Original Message-From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]On Behalf Of Richard
FarrisSent: Monday, November 28, 2005 4:48 PMTo:
Declude.JunkMail@declude.comSubject: [Declude.JunkMail]
F-prot
If I have a text file with all my keywords in it
and the log file says KEYWORD HOLD (which it should) How do I
know which keyword in the list of hundreds held it?
Richard FarrisEthixs Online1.270.247.
Office1.800.548.3877 Tech Support"Crossroads to a Cleaner
Internet"
- Original
If it is a filter file, it should say
something like (line 100 10 points) in the log.
Post a log snippet for the message in
question of send off list if you would rather.
John T
eServices For You
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
Richard,
That is going to be something that only the logs can tell you when you
do things this way, and you would need to be running in Debug mode.
The best way to tell what failed is to use a weight for the filter and
then set the filter action to WARN, that way it will insert in the
headers
asJohn said look at the log file for the message and it will tell
you the line number in the filter to look at. Only good if the filter has not
changed since the email was processed by declude.
Kevin
Bilbee
-Original Message-From:
[EMAIL PROTECTED]
[mailto:[EMAIL
I have not tried the update, but I am
using F-Prot on 4 servers.
I just downloaded it onto one of my
servers, so at least from Southern California I can get in.
John T
eServices For You
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Same here. I've been trying for over 8 hours straight with no luck.
Gary Steiner
Original Message
From: Richard Farris [EMAIL PROTECTED]
Sent: Monday, November 28, 2005 7:49 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] F-prot
Anyone using F-Prot
Two options - check the headers of the message
it should indicate the line (assuming the test is set to warn). If not you
need log level high for it to show the line number in the logs.
Darrell
Check
out
Need a quick grep script to get the number of messages sent by IP, and
another by authenticated users
sort by number of messages
TIA
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send
33 matches
Mail list logo
