Gary, Are your timings in your SmarterMail (command line time out) and (command timeout) set to 300 or have you lowered the time?
David Barker www.declude.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, September 27, 2005 5:30 PM To: [email protected] Subject: Re: [Declude.JunkMail] opening a ticket with Declude support What made you think I was on IMail? I'm using SmarterMail 2.6. The Declude version I'm running is 2.0.6 (I purchased the product in July 2005). AUTOWHITELIST is definitely not ON. Here's a little snippet from the log file: 09/26/2005 01:25:17 39819112 Msg failed WEIGHT30 (Weight of 31 reaches or exceeds the limit of 30.). Action=HOLD. 09/26/2005 01:25:17.022 39819112 [2408] actionsdata[ i ] = [26 Sep 2005] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - holddir [C:\SMARTERMAIL\SPOOL\spam] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - datafile [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - recipfile [C:\SMARTERMAIL\SPOOL\proc\39819112.HDR] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - datahold [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - reciphold [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.HDR] 09/26/2005 01:25:17 39819112 Subject: [EMAIL PROTECTED] ---> $1.56 per dose pmonkz qdvfg ouo 09/26/2005 01:25:17 39819112 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 219.13.84.45 ID: A3FF561BF4 09/26/2005 01:25:17 39819112 Tests failed [weight=31]: CATCHALLMAILS=IGNORE NOLEGITCONTENT=WARN IPNOTINMX=WARN CBL=WARN MXRATE-BLOCK=WARN SORBS-DUHL=WARN SPAMBAG=WARN FIVETENSRC=WARN ROUTING=WARN WEIGHT6=WARN WEIGHT10=HOLD WEIGHT14=HOLD WEIGHT20=HOLD WEIGHT30=HOLD 09/26/2005 01:25:17 39819112 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN HOLD [LAST ACTION=HOLD] 09/26/2005 01:25:17.022 39819112 [2408] Done Looping 09/26/2005 01:25:17.022 39819112 [2408] RecipFile( C:\SMARTERMAIL\SPOOL\proc\39819112.HDR ); 09/26/2005 01:25:17.022 39819112 [2408] QUEUEFILE_SAVEFILE = newhdrfile = [C:\SMARTERMAIL\SPOOL\proc\39819112.HDR] 09/26/2005 01:25:17.022 39819112 [2408] QUEUEFILE_SAVEFILE = newemlfile = [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] 09/26/2005 01:25:17 39819112 Cumulative action(s) taken on this email = IGNORE WARN HOLD [LAST ACTION=HOLD] 09/26/2005 01:25:17.022 39819112 [2408] AlterMessage 09/26/2005 01:25:17.022 39819112 [2408] Subject = [] 09/26/2005 01:25:17.022 39819112 [2408] Warning = [X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: CBL: "Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=219.13.84.45"; X-RBL-Warning: MXRATE-BLOCK: "http://www.mxrate.com/lookup/refused.asp?ipaddress=219.13.84.45"; X-RBL-Warning: SORBS-DUHL: "Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?219.13.84.45"; X-RBL-Warning: SPAMBAG: 45.84.13.219.blacklist.spambag.org. X-RBL-Warning: FIVETENSRC: 45.84.13.219.blackholes.five-ten-sg.com. X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [2000010f]. X-RBL-Warning: WEIGHT6: Weight of 31 reaches or exceeds the limit of 6. X-Declude-Sender: [EMAIL PROTECTED] [219.13.84.45] X-Declude-Spoolname: 39819112.EML X-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [31] at 01:25:17 on 26 Sep 2005 X-Declude-Tests: NOLEGITCONTENT, IPNOTINMX, CBL, MXRATE-BLOCK, SORBS-DUHL, SPAMBAG, F 09/26/2005 01:25:17.022 39819112 [2408] Header = [] 09/26/2005 01:25:17.022 39819112 [2408] Footer = [--- [This E-mail scanned for viruses by Declude Virus] ] 09/26/2005 01:25:17.022 39819112 [2408] MoveFile in AlterMessage - datafile = [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] TempFile = [C:\SMARTERMAIL\SPOOL\proc\39819112.EM$] 09/26/2005 01:25:17.022 39819112 [2408] CreateHoldFolder parameter [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] 09/26/2005 01:25:17.022 39819112 [2408] Hold directory is [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005] 09/26/2005 01:25:17.022 39819112 [2408] Moving file to spam hold directory [C:\SMARTERMAIL\SPOOL\proc\39819112.EML][C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] 09/26/2005 01:25:17 39819112 ERROR: Could not move spam to hold! Code: [2] Error String: [The system cannot find the file specified.] [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] 09/26/2005 01:25:17.022 39819112 [2408] Moving file to spam hold directory [C:\SMARTERMAIL\SPOOL\proc\39819112.HDR][C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.HDR] 09/26/2005 01:25:17 39819112 ERROR: Could not move spam to hold! Code: [2] Error String: [The system cannot find the file specified.] [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] -------- Original Message -------- > From: Matt <[EMAIL PROTECTED]> > Sent: Tuesday, September 27, 2005 4:10 PM > To: [email protected] > Subject: Re: [Declude.JunkMail] opening a ticket with Declude support > > Gary, > > If you want help resolving this from the list members, it would be > best to post your Declude version and product levels, one such log > snippet for a message, and also your global.cfg and the associated > $default$.junkmail. > > I did note that you are using IMail 8.05, and I am on IMail 8.15 and > have no such issues, though I am not using the HOLD action, but > instead the COPYFILE action. > > There is a possibility that you have AUTOWHITELIST ON in your > global.cfg, and you have users than have themselves or others on their > own domain in their Webmail address books, and the effect of that > would be to whitelist the message if it came from a spammer that > forged the sender to match one of these entries. This is a common > thing for people with AUTOWHITELIST ON to experience, though your > description doesn't match exactly the circumstances here. > > Chances are that your issues can be solved with changing your > configuration and it might well not be a bug. > > Matt > > > > > Gary Steiner wrote: > > >I've been receiving a flurry of spam over the past two days where the spam gets delivered with no Declude header in the message. When viewing the log files, it seems that Declude scanned the message, found it to have a heavy spam weight, tried to move it to the hold directory, and failed with an error. > > > >I've reported this problem several times to Declude since I first installed the product back in July. Its resolution has not been pressing, since the number of spams getting through has been relatively few. However, for some reason over the past two days (coincidentally since 3.x came out) the number of these spams has increased dramatically, enough so that I've received complaints from my customers. > > > >The thing that the spams seem to have in common is that they are sent to multiple addreses within the domain. The implication is that when the message arrives, it creates a single file in the spool folder, but since it is sent to multiple addresses Declude scans it more than once. But since the file was already moved to hold from a previous scan, Declude experiences the file error and delivers the message anyway. > > > > > > > > -------- Original Message -------- > > > > > >>From: "David Barker" <[EMAIL PROTECTED]> > >>Sent: Tuesday, September 27, 2005 2:12 PM > >>To: [email protected] > >>Subject: RE: [Declude.JunkMail] opening a ticket with Declude > >>support > >> > >>Hi Gary, > >> > >>Currently the we have the ticket response system temporarily > >>disabled. As far as I am aware we have received all your messages. > >> > >>The way to open a ticket is to send an email to support @ > >>declude.com you can also submit a ticket using > >>http://support.declude.com/Customer/SubmitTicket.aspx > >> > >>Under general circumstances, support emails are answered within 24 > >>hours on business days. Which are Mon - Fri. If you feel that > >>support is taking too long to respond please feel free to email me > >>directly dbarker @ declude.com > >> > >>As for your support tickets, > >> > >>1. SmarterMail picking up on RBL's that Declude is not is currently > >>under review and as soon as we have an answer to this I will let you > >>know > >> > >>2. The header in the body is badly formed emails due to broken mail clients. > >>This is not a bug in declude but we are currently looking into a way > >>to bette handle these exceptions. > >> > >>3. AVAFTERJM ON > >>This is the way to have Declude EVA (Virus) run after Declude > >>JunkMail,tthis directive is located in your virus.cfg file. > >> > >>What specific issues are you refering to with 2.x ? I will follow up > >>on this and respond. > >> > >>David B > >>www.declude.com > >> > >> > >>-----Original Message----- > >>From: [EMAIL PROTECTED] > >>[mailto:[EMAIL PROTECTED] On Behalf Of Gary > >>Steiner > >>Sent: Tuesday, September 27, 2005 12:01 PM > >>To: [email protected] > >>Subject: [Declude.JunkMail] opening a ticket with Declude support > >> > >>It used to be that when I sent an email to [EMAIL PROTECTED] I > >>would get an automatic reply like the following: > >> > >> > >> > >>>Thank you for submitting a ticket to support. Your ticket number is > >>> > >>> > >>[xxx-xxxxxxxx-xxxx]. > >> > >> > >>>Please keep this ticket number for your records and include it in > >>>the > >>> > >>> > >>subject (including brackets) of all future emails regarding this issue. > >> > >> > >>>Thank You. > >>> > >>>Declude Technical Support > >>> > >>> > >>That doesn't happen anymore. If I do get a reply from > >>[EMAIL PROTECTED], it is usually from a specific support person > >>like David Barker. Other messages I have sent to > >>[EMAIL PROTECTED] received no response, and for all I know ended up in the bit bucket. > >> > >>How does one open a ticket with Declude support? Is the email > >>method no longer viable? Should I be using the web site at > >>http://support.declude.com/Customer/SubmitTicket.aspx ? > >> > >>I would love to download the 3.x upgrade, but I don't want to take > >>on 3.x until I see resolution of the issues with 2.x. Or at least a > >>statement from Declude saying that all the problems I've been having > >>with 2.x are fixed in 3.x. > >> > >> > >> > >> > >> > > > >--- > >[This E-mail scanned for viruses by Declude Virus] > > > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > >"unsubscribe Declude.JunkMail". The archives can be found at > >http://www.mail-archive.com. > > > > > > > > --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
