Here are my numbers from yesterday:
gawk "{print $3}" dec1203.log | usort | uniq | grep -c Q
25462
gawk "{print $3}" vir1203.log | usort | uniq | grep -c Q
25460
grep "12/02/2003" declude.log | gawk "{print $4}" | usort | uniq | grep -c Q
25612
Scott, what information can we provide you to help you track down whether
IMail is calling Declude for each message or whether it is calling Declude
twice for the same message?
Bill
----- Original Message -----
From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 03, 2003 4:19 PM
Subject: RE: [Declude.JunkMail] Declude does not see email
So back to my original idea, in my case, yesterday 5 messages did not make
it to Virus or JunkMail processing. That is barely over 1/10 of 1%.
What are others experiences? (I will also do this latter on the other
servers I work on.)
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Bill Landry
> Sent: Wednesday, December 03, 2003 3:48 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Declude does not see email
>
> Great. The last script shown below should actually be:
>
> grep "12\/02\/2003" declude.log | gawk "{print $4}" | usort | uniq | grep
> -c
> Q
>
> Removed "-c" after the first grep command.
>
> Bill
>
> ----- Original Message -----
> From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Wednesday, December 03, 2003 3:40 PM
> Subject: RE: [Declude.JunkMail] Declude does not see email
>
>
> Bill, never mind. I just got the reference paper from you and it is listed
> in there where it is at and such. Works. Thanks.
>
> John Tolmachoff
> Engineer/Consultant/Owner
> eServices For You
>
>
> > -----Original Message-----
> > From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED]
> > Sent: Wednesday, December 03, 2003 3:32 PM
> > To: '[EMAIL PROTECTED]'
> > Subject: RE: [Declude.JunkMail] Declude does not see email
> >
> > Bill, usort was not included in the files on the unixtools site you
> posted
> > before, but I was able to find it here:
> > http://www.profsoftware.com/unixdos/ud09.htm However, now when running
> the
> > command, I am getting an error saying needed dll udbase.dll not found.
> >
> > John Tolmachoff
> > Engineer/Consultant/Owner
> > eServices For You
> >
> >
> > > -----Original Message-----
> > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > > [EMAIL PROTECTED] On Behalf Of Bill Landry
> > > Sent: Wednesday, December 03, 2003 1:47 PM
> > > To: [EMAIL PROTECTED]
> > > Subject: Re: [Declude.JunkMail] Declude does not see email
> > >
> > > John, a few weeks ago I sent you a copy of my 1st draft "UNIX
> Utilities
> > > Reference Guide" I had put together, but heard no response back from
> > you.
> > > Had you reviewed it you probably would have been able to figure this
> > out.
> > > Anyway, here is what I found on one of my IMail servers:
> > >
> > > gawk "{print $3}" dec1202.log | usort | uniq | grep -c Q
> > > 25624
> > >
> > > gawk "{print $3}" vir1202.log | usort | uniq | grep -c Q
> > > 25625
> > >
> > > grep -c "12\/02\/2003" declude.log | gawk "{print $4}" | usort | uniq
> |
> > > grep -c Q
> > > 25612
> > >
> > > Hmmm, strange that the number listed in the declude.log file is
> actually
> > > less then what's reported in the JunkMail and Virus log files.
> > >
> > > Bill
> > >
> > > ----- Original Message -----
> > > From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]>
> > > To: <[EMAIL PROTECTED]>
> > > Sent: Wednesday, December 03, 2003 12:34 PM
> > > Subject: RE: [Declude.JunkMail] Declude does not see email
> > >
> > >
> > > To help track this down, it would be helpful to do the following:
> > >
> > > Compare the number of messages logged in C:\declude.log to the number
> > > logged
> > > in the virus log in a 24 hour period.
> > >
> > > Any one know how to do that?
> > >
> > > John Tolmachoff
> > > Engineer/Consultant/Owner
> > > eServices For You
> > >
> > >
> > > > -----Original Message-----
> > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > > > [EMAIL PROTECTED] On Behalf Of R. Scott Perry
> > > > Sent: Wednesday, December 03, 2003 10:01 AM
> > > > To: [EMAIL PROTECTED]
> > > > Subject: RE: [Declude.JunkMail] Declude does not see email
> > > >
> > > >
> > > > >I am now seeing this also. This is disturbing as it is allowing
> > viruses
> > > > >through.
> > > > >
> > > > >The particular message that I am concerned with (containing a
> virus)
> > > does
> > > > >show up in the c:\declude.log file but is not in the virus or
> hijack
> > > log
> > > > but
> > > > >is seen in this line in the JM log:
> > > > >
> > > > >12/03/2003 06:11:30 Qeedf08fb02486d2c Could not lock
> > > > >F:\Spool\Qeedf08fb02486d2c.SMD; timed out (j=2).
> > > >
> > > > This will happen if either the Q*.SMD file disappears, or is locked
> by
> > > > another program (presumably IMail).
> > > >
> > > > It looks like there are several issues with IMail v8.
> > > >
> > > > -Scott
> > > > ---
> > > > Declude JunkMail: The advanced anti-spam solution for IMail
> > mailservers.
> > > > Declude Virus: Catches known viruses and is the leader in mailserver
> > > > vulnerability detection.
> > > > Find out what you've been missing: Ask about our free 30-day
> > evaluation.
> > > >
> > > > ---
> > > > [This E-mail was scanned for viruses by Declude Virus
> > > > (http://www.declude.com)]
> > > >
> > > > ---
> > > > This E-mail came from the Declude.JunkMail mailing list. To
> > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > > type "unsubscribe Declude.JunkMail". The archives can be found
> > > > at http://www.mail-archive.com.
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> > > (http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list. To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail". The archives can be found
> > > at http://www.mail-archive.com.
> > >
> > > .com.
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> > > (http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list. To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail". The archives can be found
> > > at http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
>
> .com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
