I am running 2 versions of Smartermail Declude both running Sniffer
and InvURIBL. One is Smartermail4/Declude4.3.3 Other is
Smartermail2/Declude3.
These servers can run perfectly for weeks but for the past few weeks we
have been sporadically seeing Declude back up files in the Proc
What are you seeing the logs that indicates this? Declude will terminate long
running external processes and log that it terminated it. Are you seeing
those entries? Also, during these times when you look at task manager do you
see a bunch of idle sniffer processes?
Typically from my
starting yesterday feb 18 at 3:33 am (ET) I get errors from decludeproc.exe
every 10 to 15 seconds.. the error is as follows:
Faulting application decludeproc.exe, version 0.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0x20202020
I am running Imail and decludeproc version
By the way, declude stopped scanning since the errors started. My proc is
holding thousands of messages now. I have reinstall declude, installed older
versions and the error keep showing up in the eventlog.
Luis Arango
_
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
I know you mentioned that you have tried a reinstall - but have you tried an
uninstall and made sure after that the decludeproc and declude.exe files are
gone from the Imail directory? Once you know they are gone try to reinstall
again.
Darrell
What does the Declude Junkmail or Virus log say?
John T
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Luis
Alberto Arango E.
Sent: Monday, February 19, 2007 7:51 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Decludeproc.ex
I found that I installed a very old version. I have the installer for 4.1
version.. I will uninstall and reinstall.. I will let you know
_
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: lunes, 19 de febrero de 2007 12:12
To:
John.
the vir log is working fine and logging the info. However very slowly (as I
have seen).
the dec logs are logging nothing since 9 am aprox. ( I check the config
files and the log directory are ok and haven't been touched.)
I just renew the SA for that service. I will see if the latest
I get this in logs:
02/19/2007 05:16:12.213 23859386 ERROR: External program SNIFFER didn't
finish quick enough; terminating.
02/19/2007 05:16:12.213 23859386 Couldn't get external program exit code
At this point I see thousands of .xxx and .fin files built up in the
sniffer directory.
Now with version 4.13.30 everything is working fine..
I don't know why version 4.1 didn't work even with DEP deactivated..
thank you very much for your help.
regards
Luis Arango
_
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Luis
Alberto Arango E.
Sent: lunes,
Any time Luis, let me know if you need anything else.
David
_
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Luis
Alberto Arango E.
Sent: Monday, February 19, 2007 1:21 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Decludeproc.ex Faulting
Chris,
I am gathering that you are running Sniffer in persistant mode? I would stop
your declude and Sniffer services. Than go into the sniffer directory and
remove all of the *.fin, *.svr files. I am not sure what the .xxx files are.
I have yet to see those. Than I would check your
Just a little warning about DEP. I found someone's server was having
Declude caught with DEP. I recommend that DEP either be turned off or
limited to just Windows services.
Matt
Luis Alberto Arango E. wrote:
Now with version 4.13.30 everything is working fine..
I don't know why version
On Monday, February 19, 2007, 1:39:39 PM, Darrell ([EMAIL PROTECTED]) wrote:
If I might add to this...
Declude is topping SNF instances before they have time to work -- This causes job files (.XXX and so forth) to build up and cause other SNF instances to relax their timing - in theory to
When this issue happens which seems more frequent, I do clear out the
thousands of left behind files. I am more trying to find a way to
prevent it or reason that is happening.
And yes, Sniffer does have a hard time operating when it hoses up that
bad.
Pete McNeil wrote:
You will need to adjust the amount of time that SNF is allowed to run
and extend it. I've heard of this setting but I don't know precisely
where it is. Someone here probably does.
I believe that way back when I was asking Scott about this on the list
that the timeout is
In my declude.cfg I have set the:
AUTOREVIEW OFF
which is the default for this directive. I've seen a poison email
that makes Declude crash or stop quietly, and AUTOREVIEW ON just puts
the poison email back in the queue again. You may find that there are
c:\declude.gp1 and c:\declude.gp2
Isn't the function of DEP to protect all internet-facing services from buffer
overflows?Does Declude legitimately execute code in a data segment?If
DEP cannot be enabled, collect samples of poison messages / messages that cause
.GP1 and .GP2 files with the latest version and send them
Definitely! AUTOREVIEW ON is very dangerous. It was intended as a fix
for messages that land in Review from a restart or crash, however if
there is a killer message it will get moved back to Proc immediately and
cause crashes over and over again. Declude could do this much better by
This isn't a fix, but it would help mitigate the overload conditions.
You could also use Pete's weightgate with sniffer.
This will only run sniffer when the email falls into your specified
weight-range.
You should easily be able to skip 25% of the email going into sniffer.
With some
Threads = 500
3 days (approx): 1420731 [Spam: 1392289Virus: 114]
Relay High: 0
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Darrell ([EMAIL PROTECTED])
Sent: Monday, February 19, 2007 2:53 PM
To:
Based on these numbers, in addition to everyone else's suggestions you may
consider adding a prescanning gateway in front of Declude.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Chris Patterson
Sent: Monday, February 19, 2007 12:33 PM
To:
This really is a front end gateway to a front end also running declude.
Even thought the thread count sounds high even at 500 threads being used
in Task Manager, we never hit 100% CPU.
2 - dual-core opterons. 3 - 15K SCSI's in Raid 5, 3 gigs Ram on a
DL385.
When this happens all 500
500 threads is a lot of threads. Is that volume for one server? That's about
~500K messages a day - thats a very busy server.
I would think that you could reduce that down to around 50-75. With 500
threads the system is starving itself with context switching especially when
launching all
Even thought the thread count sounds high even at 500 threads being used in
Task Manager, we never hit 100% CPU.
I think this may be because the system is bogged down context switching amongst
all of the threads.
Darrell
Chris,
There are desktop heap issues when you start to reach around 50
non-service processes on a Windows box. Windows just doesn't enable
such things, and there isn't a whole lot of tweaking that you can do to
increase this. I run at 50 threads and I occasionally get heap errors.
This of
Upgrade, declude is not developing any fixes for that version and its got
some flaws.
On 2/19/07, Luis Alberto Arango E. [EMAIL PROTECTED] wrote:
By the way, declude stopped scanning since the errors started. My proc is
holding thousands of messages now. I have reinstall declude,
your app may not be authenticating, try this:
http://support.declude.com/Customer/KBArticle.aspx?articleid=57
On 2/19/07, Mike N [EMAIL PROTECTED] wrote:
Isn't the function of DEP to protect all internet-facing services from
buffer overflows?Does Declude legitimately execute code in a
thank you all for your answers
I upgraded and everything started working correctly.
For some reason at 3:33 am Sunday Feb 18, the DEP system stopped
decludeproc.exe. And also for some unknown reason decludeproc.exe and
declude.exe were corrupted. I even reinstalled my 4.1 version and it didn't
29 matches
Mail list logo
