tion, MRTG
Integration, and Log Parsers.
- Original Message -
From: "Matt" [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Monday, January 24, 2005 10:31 PM
Subject: Re: [Declude.JunkMail] Overflow directory and a note about Windows
2003 DNS
I found MaxQue
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail]
Overflow directory and a note about Windows 2003 DNS
Well, I can say definitively that the hotfix
worked. My DNS process is averaging less than 1% of CPU now during full
traffic and 12 hours after the last restart with a very heavy config
y,
January 25, 2005 10:25
AM
To:
Declude.JunkMail@declude.com
Subject: Re:
[Declude.JunkMail]
Overflow directory and a note about Windows 2003 DNS
Well, I can say definitively
that the hotfix
worked. My DNS process is averaging less than 1% of CPU now during
full
traffic and 12 hours a
,
SURBL/URI integration, MRTG Integration, and Log Parsers.
- Original Message -
From:
Matt
To: Declude.JunkMail@declude.com
Sent: Tuesday, January 25, 2005 1:24
PM
Subject: Re: [Declude.JunkMail] Overflow
directory and a note about Windows 2003 DNS
Well, I can
: [Declude.JunkMail] Overflow
directory and a note about Windows 2003 DNS
Yeah, that's what I meant :)I also screwed up the stat
for what MS DNS 2003 can apparently handle; it is in fact 9,500 per second and
not minute.http://www.microsoft.com/resources/documentation/WindowsServ/2003
-
From:
Matt
To:
Declude.JunkMail@declude.com
Sent:
Tuesday, January 25, 2005 2:01 PM
Subject:
Re: [Declude.JunkMail] Overflow directory and a note about Windows 2003
DNS
Yeah, that's what I meant :)
I also screwed up the stat for what MS DNS 2003 can
Scott,
Could you please let me know what condition causes E-mail to be left in
the overflow directory, and exactly how Declude determines how/when to
process such messages.
On a side note, I was forced to do a rebuild on a backup server running
Windows 2003. The DNS.exe process is a big-time
, 2005 11:43 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Overflow directory and a note about Windows
2003 DNS
Scott,
Could you please let me know what condition causes E-mail to be left in
the overflow directory, and exactly how Declude determines how/when to
process
I know I'm not aware, care to expand?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Monday, January 24, 2005 11:59 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Overflow directory and a note about
Could you please let me know what condition causes E-mail to be left in
the overflow directory, and exactly how Declude determines how/when to
process such messages.
The short version is that the situation is handled better than if the
overflow directory isn't used (many people don't get
/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED]] On Behalf Of Matt
Sent: Monday, January 24, 2005 11:43 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Overflow directory and a note about Windows
.
- Original Message -
From:
Matt
To: Declude.JunkMail@declude.com
Sent: Monday, January 24, 2005 3:09
PM
Subject: Re: [Declude.JunkMail] Overflow
directory and a note about Windows 2003 DNS
My understanding is that this is an issue with just some
firewalls
PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Aaron Moreau-Cook
Sent: Monday, January 24, 2005 12:02 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Overflow directory and a note about
Windows 2003
DNS
I know I'm not aware, care to expand
Declude Queue is nice and was invaluable before the Queue
Manager service on Imail.
The only problem is this:
RSP than X. At that point, when an E-mail arrives, Declude will start enough
RSP Declude processes to hit the limit of X (each of which scans a single
E-mail).
DQ requires a continues
Scott,
Am I to assume a first in, first out type of scenario in the way that
it handles the overflow?
I have my server set to 60 delivery threads, up from the default 30.
Sandy I believe indicated that 64 was the limit due to the fact that
IMail is not multi-threaded or something to that
David,
We do the same thing. One thing you can do is fake mail coming in. I use a
batch file.
REM THIS WILL CLEAN OUT THE DECLUDE QUEUE
declude x:\imail\spool\Qa6da175e02447716.SMD
call x:\imail\cleandq.bat
The Q file I referenced does not exist and it does not matter that it does
not.
Hello Darrell,
Monday, January 24, 2005, 5:38:51 PM, you wrote:
Dsic We do the same thing. One thing you can do is fake mail coming in. I
use a
Dsic batch file.
Dsic REM THIS WILL CLEAN OUT THE DECLUDE QUEUE
Thanks we'll give it a shot. This should be a great help.
--
Best regards,
Scott, thanks for the explanations. I still have a few follow-ups
though if you don't mind.
First off, since DNS is acting like such a hog on Windows 2003, I'm
going to guess that this is what is slowing down the processing of
E-mail and why I am suddenly getting steady overflow. I can
] [mailto:Declude.JunkMail-
[EMAIL PROTECTED]] On Behalf Of Aaron Moreau-Cook
Sent: Monday, January 24, 2005 12:02 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Overflow directory and a note about
Windows 2003
DNS
I know I'm not aware, care to expand
You seemed to indicate that service launched processes count against the
threads...meaning that smtp32.exe launches declude.exe, which launches
F-Prot and McAfee. So would this count for 4 threads (not according to
Declude, but Windows/IMail)? What about Sniffer and each external test
that
I found MaxQueProc in the registry and changed that to 60. There is no
GUI config for this option.
I also looked at the issue with MS DNS 2003. After a restart of DNS,
utilization dropped from an average of about 25% to under 1% (I had it
in performance monitor)...but then over the next
]
To: Declude.JunkMail@declude.com
Sent: Monday, January 24, 2005 10:31 PM
Subject: Re: [Declude.JunkMail] Overflow directory and a note about Windows
2003 DNS
I found MaxQueProc in the registry and changed that to 60. There is no
GUI config for this option.
I also looked at the issue with MS DNS 2003. After
ot; [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Monday, January 24, 2005 10:31 PM
Subject: Re: [Declude.JunkMail] Overflow directory and a note about Windows
2003 DNS
I found MaxQueProc in the registry and changed that to 60. There is no
GUI config for this option.
I also
24, 2005 10:00 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail]
Overflow directory and a note about Windows 2003 DNS
Thanks Darrell, that definitely sounds like it's the
culprit:
http://support.microsoft.com/?kbid=830381
This didn't come up in my searches because
I think I saw mention of this, but I could not find it.
Declude Queue is put all files that start with Q into the overflow in a
overflow condition, including webmail temp files, forwarded messages, mail1
messages and so forth.
Can this be fixed promptly?
John Tolmachoff
I think I saw mention of this, but I could not find it.
Declude Queue is put all files that start with Q into the overflow in a
overflow condition, including webmail temp files, forwarded messages, mail1
messages and so forth.
Can this be fixed promptly?
The only way for it to be fixed is to fix
I think I saw mention of this, but I could not find it.
Declude Queue is put all files that start with Q into the overflow in a
overflow condition, including webmail temp files, forwarded messages,
mail1
messages and so forth.
Can this be fixed promptly?
The only way for it to be fixed
So, the reason for the SMTP service not processing will be investigated once
the overflow is cleared, but in the mean time why are webmail temp files and
list messages and postmaster message also being placed there?
That's because those are E-mails that need to be scanned and delivered,
just
, October 25, 2004 11:53 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Overflow
So, the reason for the SMTP service not processing will be investigated
once
the overflow is cleared, but in the mean time why are webmail temp files
and
list messages and postmaster message also being
.LST message do not need to be scanned.
Declude will not scan mailing list messages the second time (in the .LST
files). But, they still need to be delivered by IMail. So having them
bypass Declude Queue would just slow down delivery of other E-mails that
are in the overflow queue.
I
:10 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Overflow
.LST message do not need to be scanned.
Declude will not scan mailing list messages the second time (in the .LST
files). But, they still need to be delivered by IMail. So having them
bypass Declude Queue would just
The overflow is a temporary problem cause by for some reason the SMTP
service stopped processing at 6:00 PM yesterday even thought is was
running,
and I found out about it at 10:00 this morning, restarted and the flood
gates opened up. Until the backflow of inbound and lists are processed,
the
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED])
Sent: Monday, October 25, 2004 9:07 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Overflow
The overflow is a temporary problem cause by for some
typoed an important email, they would never know.
Thank you,
Chuck Frolick
ArgoLink.net
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Monday, December 22, 2003 9:47 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Overflow
]
[mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Monday, December 22, 2003 9:47 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Overflow
Nick,
I think I might have been asking the question the other way around,
though I'm not positive it was taken the wrong way.
The theory
- Original Message -
From: Matthew Bramble [EMAIL PROTECTED]
These attacks can go on for hours and hours and hours. If you've seen
this stuff in your logs, you would see strings like
[EMAIL PROTECTED] 26^8 for instance equals ~210,000,000,000
addresses. If they've got a database
If any one is experiencing the overflow folder filling up and it is not
attributable to server load, please contact me.
The first thing to do is determine whether the issue is with Declude
JunkMail, Declude Virus, or both. If you are running both programs, you
should temporarily disable one.
At 10:34 AM 12/22/2003, John Tolmachoff \(Lists\) wrote:
If any one is experiencing the overflow folder filling up and it is not
attributable to server load, please contact me. I am having this problem and
am narrowing it down.
John,
Do you run Sniffer? If so, are you running the wide beta
for something.
I loaded DNS on the mail server to eliminate it as the problem.
Fred
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, December 22, 2003 10:34 AM
Subject: [Declude.JunkMail] Overflow
If any one is experiencing
PROTECTED]
Subject: [Declude.JunkMail] Overflow
If any one is experiencing the overflow folder filling up and it is not
attributable to server load, please contact me. I am having this problem
and
am narrowing it down.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
]
Subject: Re: [Declude.JunkMail] Overflow
At 10:34 AM 12/22/2003, John Tolmachoff \(Lists\) wrote:
If any one is experiencing the overflow folder filling up and it is not
attributable to server load, please contact me. I am having this problem
and
am narrowing it down.
John,
Do you run
I loaded DNS on the mail server to eliminate it as the problem.
But is it still reoccurring? If so, have you tried clearing the cache and it
starts working again?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus
The Declude process looks like it take 10 - 60 seconds per email.
It is almost like it is in a wait state looking for something.
There is about a 99% chance this *is* a DNS issue.
If you are positive that your DNS server is working well (answering cached
queries very quickly, with no
dnsbl.njabl.org 127.0.0.2 8 0
DSBL ip4r list.dsbl.org * 6 0
DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 3 0
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, December 22, 2003 11:00 AM
Subject: Re: [Declude.JunkMail] Overflow
The Declude process
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Frederick Samarelli
Sent: Monday, December 22, 2003 8:36 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Overflow
I am 100% sure it is not DNS.
I have
Subject: RE: [Declude.JunkMail] Overflow
Fredrick, please answer my question.
You said you are using the MS DNS service on the server to help with the
problem.
Does it still reoccur, and if so, have you tried clearing the MS DNS service
cache and does that allow mail to flow until it reoccurs?
John
] On Behalf Of Frederick Samarelli
Sent: Monday, December 22, 2003 9:03 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Overflow
John,
I have not tried to clear the MS DNS Cache.
But the problem goes away after a while.
It is fine at the moment but it will come back soon.
Fred
I have not tried to clear the MS DNS Cache.
But the problem goes away after a while.
It is fine at the moment but it will come back soon.
When it comes back, I would recommend checking the DNS server. First,
check to see the IP of the DNS server Declude JunkMail will be using (the
first one
PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Frederick Samarelli
Sent: Monday, December 22, 2003 10:38 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Overflow
OK.
It just happened again.
I cleared the Cache and the backup cleared.
What does the mean.
Fred
It just happened again.
I cleared the Cache and the backup cleared.
What does the mean.
That means that your DNS server is dying. It sounds like this may be a
common problem with Microsoft DNS, where it starts choking if it has too
much in its cache. Switching to the latest version of BIND
It just happened again.
I cleared the Cache and the backup cleared.
What does the mean.
That means that your DNS server is dying. It sounds like this may be a
common problem with Microsoft DNS, where it starts choking if it has too
much in its cache. Switching to the latest version
: [Declude.JunkMail] Overflow
It just happened again.
I cleared the Cache and the backup cleared.
What does the mean.
That means that your DNS server is dying. It sounds like this may be a
common problem with Microsoft DNS, where it starts choking if it has too
much in its cache. Switching
Is this all being found on Windows 2003? I'm a couple of months away
from adding a new server and this would definitely resolve any questions
that I might have about Windows 2003 being an option. I know why John
needs to play with the latest and greatest, but I have no such
inclination or
: [Declude.JunkMail] Overflow
Is this all being found on Windows 2003? I'm a couple of months away
from adding a new server and this would definitely resolve any questions
that I might have about Windows 2003 being an option. I know why John
needs to play with the latest and greatest, but I have
That means that your DNS server is dying. It sounds like this may be a
common problem with Microsoft DNS, where it starts choking if it has too
much in its cache. Switching to the latest version of BIND may be the best
option.
Not sure what you are suggesting.
Latest version of Bind?
Hey guys, this sounds like same problem that I have been experiencing,
however it has been a bunch of spam with c.c. 's to non-existant mail
addresses on my server (dictionary attack style) ..My DNS is working fine.
I spent the weekend returning mail from the old spool to a new spool that I
had
I just loaded a copy of Metaip DNS software.
http://www.metainfo.com/
Removed the MS DNS.
Will keep you informed.
- Original Message -
From: Charles Frolick [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, December 22, 2003 3:19 PM
Subject: RE: [Declude.JunkMail] Overflow
I've been rethinking my strategy for dealing with dictionary attacks on
my server. While the nobody alias has proved to be problematic, so does
not having a nobody alias due to the possibility of being dictionary
attacked.
I'm thinking of setting up all the nobody aliases to redirect E-mail
Hi Matt,
Is anyone getting dictionary attacked for long periods of time on a
domain with a nobody alias or something that is gatewayed?
Thanks,
Yes. I get hammered everyday..; I got rid of the nobody alias, filter
the log files for the ip's that connected - and add them to my Imail
Access
Responding to a couple of posts.
Hey guys, this sounds like same problem that I have been experiencing,
however it has been a bunch of spam with c.c. 's to non-existant mail
addresses on my server (dictionary attack style) ..My DNS is working fine.
The specific problem I am reviewing and
Nick,
I think I might have been asking the question the other way around,
though I'm not positive it was taken the wrong way.
The theory here is that domains which accept every E-mail address in the
HELO won't be dictionary attacked past a few attempts because the
attacker's software will
John Tolmachoff (Lists) wrote:
This is a cache only setup, no domains. Cost is a concern at this time,
unless I can prove that would be the answer. However, as I said earlier, the
problem was first experienced using BIND DNS servers. I need to follow up on
this.
Keith had a problem after a
]
[mailto:[EMAIL PROTECTED] On Behalf Of Fritz Squib
Sent: Wednesday, December 17, 2003 7:35 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Overflow Directory
Scott,
I've got a little problem here, all of a sudden (as of this morning)
the declude overflow directory is flooded with mail waiting
Scott,
I've got a little problem here, all of a sudden (as of this morning) the
declude overflow directory is flooded with mail waiting to be delivered.
1:47 AM - 2:04 AM not moving at all so I copied them from overflow spool
to another directory.
Big gap until 3:11 PM - mail is coming in
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Overflow Directory
Scott,
I've got a little problem here, all of a sudden (as of this morning) the
declude overflow directory is flooded with mail waiting to be delivered.
1:47 AM - 2:04 AM not moving at all so I copied them from overflow
]
Subject: [Declude.JunkMail] Overflow Directory
Scott,
I've got a little problem here, all of a sudden (as of this morning) the
declude overflow directory is flooded with mail waiting to be delivered.
1:47 AM - 2:04 AM not moving at all so I copied them from overflow spool
to another directory
I've got a little problem here, all of a sudden (as of this morning) the
declude overflow directory is flooded with mail waiting to be delivered.
This will happen if E-mail isn't being scanned/delivered as fast as it is
coming in. In most cases, it is a DNS issue.
Currently 30,927 in the
Hi John,
Ok, you got me...why ask about Florida?
Darin.
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, December 17, 2003 9:08 PM
Subject: RE: [Declude.JunkMail] Overflow Directory
BTW, this is not on a mail server some
/\- against microsoft attachments
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Wednesday, December 17, 2003 9:08 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Overflow Directory
BTW, this is not on a mail
: [Declude.JunkMail] Overflow Directory
John,
Nope, I'm in snowy western Pennsylvania. Sprint ATT backbone(s).
My DNS servers seem to be resolving everything OK, no warnings in the DJM
log file, same DNS server for Imail DNS and my ip4r tests.
The network guys and a consultant have been working
: Wednesday, December 17, 2003 10:12 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Overflow Directory
Hi,
I had a similar problem a while back. There is a known and internally
documented bug that goes back several versions in IMail.
Under some circumstances, IMail loses the ability
Hi Scott,
Can I manually move spooled D and Q-files in the overflow folder?
When they will be respooled?
Markus
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail
Can I manually move spooled D and Q-files in the overflow folder?
When they will be respooled?
You can, but it is not recommended.
If there are any files in the overflow directory (there should only be Q*.*
files in there), it means that your mailserver is overloaded (not that it
*was*
Perry
Sent: Tuesday, January 07, 2003 4:08 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Overflow directory
Can I manually move spooled D and Q-files in the overflow
folder? When
they will be respooled?
You can, but it is not recommended.
If there are any files
So we have a very large spool folder with many timed out delivery
attempts and I will try to move some large msgs in a temporary folder
until tonight.
Ah, I see.
The overflow directory won't help here -- if you move the
\IMail\spool\Q*.SMD files to the \IMail\spool\overflow directory,
So there are a lot of msgs where the remote mailserver after some
mb's of transfered data terminates the trasmission.
Any mail server that terminates the session instead of sending a 5xx
is broken, as it's just inviting more waste on both sides. If the
server terminates
Any mail server that terminates the session instead of
sending a 5xx is broken, as it's just inviting more
waste on both sides.
Why they don't answer with an 5xx code?
There was one single 531 - Mailbox has exceeded disk quota today but a
lot of
01:07 10:00 SMTP-(07BC) .
01:07
Why they don't answer with an 5xx code? There was one single 531 -
Mailbox has exceeded disk quota today...
Because they're stupid. They don't want to wait, so they just keep it
comin' 1/2 hour later.
If the server terminates the session and blacklists you temporarily
or permanently for
What would be nice, though,
is if IMail had a way of listing all the SMTP processes in
memory and what
they were working on, and allowed you to stop them.
Can we place another wish list, even if christmas just passed?
;-)
In this case, you could move some of the Q*.SMD files to a
79 matches
Mail list logo
