Re: Re[4]: [sniffer] Rash of false positives

2005-11-09 Thread Richard Farris
This morning my server quit sending mail and my tech said the Dr. Watson error on the server was my Sniffer file...I rebooted and thought it was OK but quit again..I had a lot of mail back logged...so I updated a new rule base but it did not seem to helpI reinstalled Imail and things

RE: Re[4]: [sniffer] Rash of false positives

2005-11-09 Thread John Moore
We had this same thing happen. It has been happening more frequently recently and we are looking into disabling sniffer as it seems to be the culprit each time. John Moore 305 Spin From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Wednesday,

Re[6]: [sniffer] Rash of false positives

2005-11-09 Thread Pete McNeil
This problem with Dr.Watson errors has been covered before on Declude's support list as well as ours. It's actually not SNF itselft that's causing the problem, but rather an undocumented heap in Windows that can run out of space and cause the next item to load to fail with a Dr. Watson error.

Re: Re[4]: [sniffer] Rash of false positives

2005-11-09 Thread Darin Cox
Arecorrupted rulebase files the culprit? How do you update... and do you run snf2check on the updates? Just wondering if the rulebase file is theproblem, if the problemoccurs during the update, or if you are running into obscure errors with the EXE itself Darin. - Original

RE: Re[4]: [sniffer] Rash of false positives

2005-11-09 Thread John Moore
We have not run snf2check on the updates. And it may be a coincidence or bad timing that sniffer appears to be the culprit. But we have stopped sniffer (commented out in the declude global.cfg) for an observed period of time and the mail never stops (and had never stopped before sniffer)

Re[6]: [sniffer] Rash of false positives

2005-11-09 Thread Pete McNeil
It is _VERY_ important to validate rulebase files with the snf2check utility. The snf2check utility tests the rulebase files in ways that the SNF scanning utility does not (for the sake of speed). If you don't check your downloads with the snf2check utility you run the risk of pressing a

Re: [sniffer] Rash of false positives

2005-11-09 Thread Matt
John, The mystery heap issue is a memory issue with Windows where it only reserves so much memory for running things like Declude, Sniffer, other external tests and your virus scanners. If you have something that is hanging, running slowly, or taking too long, it can gobble up all of the

RE: [sniffer] Rash of false positives

2005-11-09 Thread John Moore
Matt, Thank you for your help and thorough explanation. I added the declude.cfg with the PROCESSES 20 We are running declude 2.06 and have the JM pro and AV standard. We will look into getting the persistent mode setup and see if that helps as well. Thanks, again. John

Re: [sniffer] Rash of false positives

2005-11-09 Thread Serge
i thought declude.cfg is for V 3.x Am I wrong ?is declude.cfg used with V 2.x ? - Original Message - From: John Moore To: sniffer@SortMonster.com Sent: Wednesday, November 09, 2005 11:12 PM Subject: RE: [sniffer] Rash of false positives Matt, Thank you

Re: [sniffer] Rash of false positives

2005-11-09 Thread Darrell (supp...@invariantsystems.com)
It is used in both versions for different things. Darrell ---Check out http://www.invariantsystems.com for utilities for Declude, mxGuard,and Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and