One more thing, is there a way (Bill) of (1st) comparing the c:\declude.log for unique IDs to say the virus log for unique ID and (2nd) list those found in declude.log but not in the virus log? Then we could take those and find all the log lines for those and see if they are were delivered by Imail right as a queue run happened.
When Queue Manager makes a timed run, does it look at all Q files, or those over a certain age or what? John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Friday, December 05, 2003 10:58 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Declude not taking action > > Scott, since my own server only gets about 4000 messages per day, is there > any testing or logging I can do that will help track this down? > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > > Sent: Friday, December 05, 2003 10:51 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] Declude not taking action > > > > This issue has really gotten my attention since one of the 0.1% of > > messages > > not scanned happened to have a virus attachment and caused a bit of > ruckus > > with the client got it and demanded to know why he is paying me money to > > scan messages and then a virus got through. (Fortunately, I am adamant > at > > making sure there is current AV on each computer, so that caught it.) > > > > John Tolmachoff > > Engineer/Consultant/Owner > > eServices For You > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > [EMAIL PROTECTED] On Behalf Of Matthew Bramble > > > Sent: Friday, December 05, 2003 8:25 PM > > > To: [EMAIL PROTECTED] > > > Subject: Re: [Declude.JunkMail] Declude not taking action, IMail 7.15 > H2 > > > with Declude 1.76i30 H2 with Declude 1.76i30 Declude 1.76i30 H2 with > > > Declude 1.76i30 Declude 1.76i30 H2 with Declude 1.76i30 > > > > > > Well, I was really hoping it would have been a Declude problem...that > > > way it probably would have been fixed in days as opposed to requiring > me > > > to get an upgrade to IMail 8 for them to fix the issue. > > > > > > I'm going to reduce my queue from running every 15 minutes to every > hour > > > just to lessen the possibility of this happening. Please keep us > posted > > > if you hear anything. I imagine it will take them a while and IMail 7 > > > users may be out in the dark. > > > > > > Matt > > > > > > > > > > > > R. Scott Perry wrote: > > > > > > > > > > >> This is the first time that I have ever seen this and it occurred > > > >> just a few days after upgrading from 1.75i6 to 1.76i28-30. Unlike > > > >> some others that I have noted in the past, I am using IMail 7.15 > > > >> Hotfix 2, so it doesn't seem related to IMail 8. > > > > > > > > > > > > This is getting scary. It looks like there is a serious bug in > IMail > > > > v7 and v8 that is just starting to be discovered: > > > > > > > >> --- IMail Log --- > > > >> 20031205 184256 127.0.0.1 SMTPD (046101B0) [208.7.179.15] > > > >> connect 64.119.217.36 port 41441 > > > >> 20031205 184258 127.0.0.1 SMTPD (queue run) 13471 1 69 > > > >> 20031205 184258 127.0.0.1 SMTPD (046101B0) [64.119.217.36] > > > >> E:\spool\D1800046101b02123.SMD 1332 > > > >> 20031205 184258 127.0.0.1 SMTP (3696) processing > > > >> E:\spool\Q1800046101b02123.SMD > > > >> 12/05/2003 18:43:02 Q1800046101b02123 Scanned: Virus Free [MIME: 1 > > 765] > > > >> 12/05/2003 18:43:04 Q1800046101b02123 Msg failed DELETE (Weight of > 80 > > > >> reaches or exceeds the limit of 30.). Action=DELETE. > > > > > > > > > > > > This is the same pattern that we tracked in another E-mail: > > > > > > > > [1] IMail's SMTPD process starts receiving the E-mail. > > > > [2] IMail starts a "queue run" to deliver E-mail in the spool > > > > [3] IMail's SMTPD process saves the E-mail to the hard drive > > > > [4] IMail's queue run delivers the E-mail > > > > [5] IMail's SMTPD process starts Declude > > > > [6] IMail tries to deliver the E-mail that Declude scanned > > > > > > > > Ipswitch has been notified that there is a problem here; hopefully, > > > > they will take care of it. > > > > > > > > -Scott > > > > > > > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > > (http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
