Re: [Declude.JunkMail] SMD Files

2005-04-23 Thread Darrell \([EMAIL PROTECTED]) 
No, we did not have the window size adjusted.  FWIW - We had issues on both
2K3 and 2K - keeping in mind that the window size on 2k3 was not adjusted
with this patch.  My understanding is that the issue with the patch relates
to not handling pmtu correctly.
Darrell
Keith Johnson writes:
Darrell,
 Did you prior adjust your TcpWindowSize value?
Keith
-Original Message-
From: [EMAIL PROTECTED] on behalf of Darrell ([EMAIL PROTECTED])
Sent: Sat 4/23/2005 10:30 AM
To: Declude.JunkMail@declude.com
Cc:
Subject: Re: [Declude.JunkMail] SMD Files


Not saying this is your problem - but...  If you have applied the KB 
893066 patch from the latest round of MS Patches you may want to look into 
that.  We have seen substantial issues with this patch internally and 
externally.

Darrell
---
invURIBL - Intelligent URI filtering plug-in for Declude.  Stops 85% of 
the
SPAM with the default configuration.  Try it for free - 
http://www.invariantsystems.com

- Original Message -
From: Kyle Fisher 
To: Declude.JunkMail@declude.com
Sent: Saturday, April 23, 2005 2:40 AM
Subject: RE: [Declude.JunkMail] SMD Files
Ok thanks John.  Why do you think this just started happening 
the past 3 days I went from about 200 spool files to 1000 during the day and 
then 2 days later there are all of those left over files.

Do you mean the SMTP session from the client.  I have had some 
complaints (for about two weeks) from clients (connected by T1) saying they are 
getting SMTP errors occasionally.  They  have there client set to check mail 
every 5 minutes and throughout the day they get SMTP connection errors.

I mean I really donât know I am just searching at this point, 
but thanks for the info

Kyle


  _
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
John Tolmachoff (Lists)
Sent: Saturday, April 23, 2005 12:28 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] SMD Files

T files are incomplete Q files, where by some how the SMTP 
session was not completed. They along with the associated D file can be 
deleted. The reason it looks like they have already been sent is that the 
sending server/user upon disconnection of the SMTP session the resent the 
message in full.

John T
eServices For You

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
Kyle Fisher
Sent: Friday, April 22, 2005 2:49 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] SMD Files

Looking at some of these it looks like they have already been 
sent and it is trying to resend them again.  Also in some of these it is going 
to [EMAIL PROTECTED]


  _
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
Kyle Fisher
Sent: Friday, April 22, 2005 3:50 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] SMD Files

I am trying to find the article that explains the build up of 
Txx.smd and Dxx.smd files in the spool directory.  The past few days I 
have quite a few of these hanging around in the spool directory.

Here is a sample of whatâs in the files.  Some are from my 
local clients and some or from other mail servers.

Kyle

Imail 8.15
2.0.6 Junkmail and Antivirus
3.16b F-Prot
Message Sniffer 2.3

D03bc03690136cf5a.SMD

Received: from gwmsrm42 [172.16.52.2] by esc5.net with ESMTP
  (SMTPD32-8.15) id A3BC3690136; Thu, 21 Apr 2005 14:49:16 -0500


T03bc03690136cf5a.SMD

QD:\IMail\spool\D03bc03690136cf5a.SMD
Hesc5.net
I03bc03690136cf5a
X1
WE:\IMail
E0,
R<[EMAIL PROTECTED]>
S<[EMAIL PROTECTED]>
NRCPT TO: <[EMAIL PROTECTED]>
R<[EMAIL PROTECTED]>



Check out http://www.invariantsystems.com for utilities for Declude And
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-

RE: [Declude.JunkMail] SMD Files

2005-04-23 Thread Keith Johnson 
Darrell,
 Did you prior adjust your TcpWindowSize value?  
 
Keith

-Original Message- 
From: [EMAIL PROTECTED] on behalf of Darrell ([EMAIL PROTECTED]) 
Sent: Sat 4/23/2005 10:30 AM 
To: Declude.JunkMail@declude.com 
Cc: 
Subject: Re: [Declude.JunkMail] SMD Files


Not saying this is your problem - but...  If you have applied the KB 
893066 patch from the latest round of MS Patches you may want to look into 
that.  We have seen substantial issues with this patch internally and 
externally.
 
Darrell
---
invURIBL - Intelligent URI filtering plug-in for Declude.  Stops 85% of 
the
SPAM with the default configuration.  Try it for free - 
http://www.invariantsystems.com

- Original Message - 

From: Kyle Fisher   
To: Declude.JunkMail@declude.com 
Sent: Saturday, April 23, 2005 2:40 AM
Subject: RE: [Declude.JunkMail] SMD Files


Ok thanks John.  Why do you think this just started happening 
the past 3 days I went from about 200 spool files to 1000 during the day and 
then 2 days later there are all of those left over files.

 

Do you mean the SMTP session from the client.  I have had some 
complaints (for about two weeks) from clients (connected by T1) saying they are 
getting SMTP errors occasionally.  They  have there client set to check mail 
every 5 minutes and throughout the day they get SMTP connection errors.

 

I mean I really donât know I am just searching at this point, 
but thanks for the info

 

Kyle

 


  _  


From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
John Tolmachoff (Lists)
Sent: Saturday, April 23, 2005 12:28 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] SMD Files

 

T files are incomplete Q files, where by some how the SMTP 
session was not completed. They along with the associated D file can be 
deleted. The reason it looks like they have already been sent is that the 
sending server/user upon disconnection of the SMTP session the resent the 
message in full.

 

John T

eServices For You

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
Kyle Fisher
Sent: Friday, April 22, 2005 2:49 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] SMD Files

 

Looking at some of these it looks like they have already been 
sent and it is trying to resend them again.  Also in some of these it is going 
to [EMAIL PROTECTED] 

 


  _  


From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
Kyle Fisher
Sent: Friday, April 22, 2005 3:50 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] SMD Files

 

I am trying to find the article that explains the build up of 
Txx.smd and Dxx.smd files in the spool directory.  The past few days I 
have quite a few of these hanging around in the spool directory.

 

Here is a sample of whatâs in the files.  Some are from my 
local clients and some or from other mail servers.

 

Kyle

 

Imail 8.15

2.0.6 Junkmail and Antivirus

3.16b F-Prot

Message Sniffer 2.3

 

D03bc03690136cf5a.SMD

 

Received: from gwmsrm42 [172.16.52.2] by esc5.net with ESMTP

  (SMTPD32-8.15) id A3BC3690136; Thu, 21 Apr 2005 14:49:16 -0500

 

 

T03bc03690136cf5a.SMD

 

QD:\IMail\spool\D03bc03690136cf5a.SMD

Hesc5.net

I03bc03690136cf5a

X1

WE:\IMail

E0,

R<[EMAIL PROTECTED]>

S<[EMAIL PROTECTED]>

NRCPT TO: <[EMAIL PROTECTED]>

R<[EMAIL PROTECTED]>

 

<>

Re: [Declude.JunkMail] Tests Running when WhiteListed

2005-04-23 Thread Don Brown 
The the whitelisted IP in your own IP address space or was it a
foreign IP address?


Saturday, April 23, 2005, 4:20:51 PM, Darrell ([EMAIL PROTECTED]) <[EMAIL 
PROTECTED]> wrote:
Dsic> The IP in question for the line I showed was listed in the global.cfg and
Dsic> after the associated PREWHITELIST / and other WHITELIST options.

Dsic> Darrell
Dsic> ---
Dsic> Check out http://www.invariantsystems.com for utilities for Declude And
Dsic> Imail.  IMail Queue Monitoring, Declude Overflow Queue Monitoring, 
SURBL/URI
Dsic> integration, MRTG Integration, and Log Parsers.

Dsic> - Original Message - 
Dsic> From: "Don Brown" <[EMAIL PROTECTED]>
Dsic> To: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>
Dsic> Cc: 
Dsic> Sent: Saturday, April 23, 2005 5:05 PM
Dsic> Subject: Re: [Declude.JunkMail] Tests Running when WhiteListed


>> O.K.  Where do you have that whitelisted IP address configured? Is it
>> a line item in the global config. like mine was or is it elsewhere?
>>
>> The line item white list entries and all of the other items i
>> previously listed from the global.cfg, appear long before any tests
>> are configured in the global.cfg.
>>
>>
>>
>> Saturday, April 23, 2005, 3:19:11 PM, Darrell
Dsic> ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote:
>> Dsic> PREWHITELIST ON is working on 2.0.6 for me.
>>
>> Dsic> 04/23/2005 23:59:59 Qb45c04ab008c9990 Skipping E-mail from IP
>> Dsic> xxx.xxx.xxx.xxx   ; whitelisted
>>
>> Dsic> Looking in the manual it indicates this
>> Dsic> "This option takes one parameter, ON, which indicates that Declude
Dsic> JunkMail
>> Dsic> should try to run whitelists before tests are run. If the E-mail is
>> Dsic> whitelisted, the tests should not be run. Note that [1] not all
Dsic> whitelists
>> Dsic> will be run this way (check the code to see which are run), in which
Dsic> case
>> Dsic> the E-mail will be whitelisted but the tests will be run, an "
>>
>> Dsic> I suspect the (check code to see which are run) is an internal
Dsic> comment and
>> Dsic> was suppose to indicate the circumstances under which prewhitelist
Dsic> does not
>> Dsic> kick in.
>>
>> Dsic> Darrell
>> Dsic> ---
>> Dsic> DLAnalyzer - Comprehensive Declude Junkmail and Virus reporting -
>> Dsic> http://www.invariantsystems.com
>>
>>
>> Dsic> - Original Message - 
>> Dsic> From: "Matt" <[EMAIL PROTECTED]>
>> Dsic> To: 
>> Dsic> Sent: Saturday, April 23, 2005 4:09 PM
>> Dsic> Subject: Re: [Declude.JunkMail] Tests Running when WhiteListed
>>
>>
>> >> If PREWHITELIST ON stopped working in 2.06, that would definitely be a
>> >> bummer.  Good E-mail being scanned takes the most processing power on
>> >> systems with SKIPIFWEIGHT settings and other similar mechanisms, and
>> >> whitelisting all AUTH traffic or things from one's address space is
>> >> fairly important if you want to save processing power.  Maybe the
Dsic> change
>> >> explains why some have reported a spike in CPU utilization???
>> >>
>> >> IMO, with the switch PREWHITELIST ON, processing of an E-mail should be
>> >> stopped and handled as a whitelisted item as soon as a condition is
>> >> met.  Understandably some conditions are met much sooner than others
Dsic> and
>> >> not all whitelisting used to work like that, but it would be nice if it
>> Dsic> did.
>> >>
>> >> Matt
>> >>
>> >>
>> >>
>> >> Don Brown wrote:
>> >>
>> >> >The below log entries tend to indicate that tests, including
>> >> >filter tests, are running, when the mail is whitelisted. Below are
>> >> >snips (in order) from the Global.cfg.  PreWhiteList is ON.
>> >> >
>> >> >This apparently started with the 2.X upgrade.  According to the logs
>> >> >before the upgrade, the below whitelist was preventing tests from
>> >> >running - in 2.x the test are obviously running.
>> >> >
>> >> >04/23/2005 14:27:06 QA1881154025C35BA BADHEADERS:6 SPAMHEADERS:6
>> Dsic> FILT-HELO:30 .  Total weight = 42.
>> >> >04/23/2005 14:27:06 QA1881154025C35BA E-mail whitelisted -
Dsic> automatically
>> Dsic> passing all spam tests [88.88.88.0/88]
>> >> >04/23/2005 14:27:06 QA1881154025C35BA Subject: subject
>> >> >04/23/2005 14:27:06 QA1881154025C35BA From: [EMAIL PROTECTED] To:
Dsic> [EMAIL PROTECTED]
>> Dsic> IP: 88.88.88.89 ID:
>> >> >04/23/2005 14:27:06 QA1881154025C35BA Action(s) taken for
Dsic> [EMAIL PROTECTED]
>> Dsic> = WHITELISTED [LAST ACTION=WHITELISTED]
>> >> >
>> >> >Snips from the Global.cfg
>> >> ># WHITELIST AUTH automatically whitelists authenticated senders (for
>> Dsic> IMail v8 and later).
>> >> >WHITELIST   AUTH
>> >> ># Whitelist all entries in users Imail address book
>> >> >AUTOWHITELIST   ON
>> >> ># Automatically bypass spam tests for E-mail from whitelisted IPs or
>> Dsic> whitelisted return addresses.
>> >> >PREWHITELISTON
>> >> ># Per Domain Whitelist Files -
>> >> \Imail\Declude\example.com\whitelist.txt
>> >> >DOMAINWHITELISTSON
>> >> >WHITELIST   IP  88.88.88.0/88

Re: [Declude.JunkMail] Tests Running when WhiteListed

2005-04-23 Thread Don Brown 
O.K.  Where do you have that whitelisted IP address configured?  Is it
a line item in the global config. like mine was or is it elsewhere?

The line item white list entries and all of the other items i
previously listed from the global.cfg, appear long before any tests
are configured in the global.cfg.



Saturday, April 23, 2005, 3:19:11 PM, Darrell ([EMAIL PROTECTED]) <[EMAIL 
PROTECTED]> wrote:
Dsic> PREWHITELIST ON is working on 2.0.6 for me.

Dsic> 04/23/2005 23:59:59 Qb45c04ab008c9990 Skipping E-mail from IP
Dsic> xxx.xxx.xxx.xxx   ; whitelisted

Dsic> Looking in the manual it indicates this
Dsic> "This option takes one parameter, ON, which indicates that Declude 
JunkMail
Dsic> should try to run whitelists before tests are run. If the E-mail is
Dsic> whitelisted, the tests should not be run. Note that [1] not all whitelists
Dsic> will be run this way (check the code to see which are run), in which case
Dsic> the E-mail will be whitelisted but the tests will be run, an "

Dsic> I suspect the (check code to see which are run) is an internal comment and
Dsic> was suppose to indicate the circumstances under which prewhitelist does 
not
Dsic> kick in.

Dsic> Darrell
Dsic> ---
Dsic> DLAnalyzer - Comprehensive Declude Junkmail and Virus reporting -
Dsic> http://www.invariantsystems.com


Dsic> - Original Message - 
Dsic> From: "Matt" <[EMAIL PROTECTED]>
Dsic> To: 
Dsic> Sent: Saturday, April 23, 2005 4:09 PM
Dsic> Subject: Re: [Declude.JunkMail] Tests Running when WhiteListed


>> If PREWHITELIST ON stopped working in 2.06, that would definitely be a
>> bummer.  Good E-mail being scanned takes the most processing power on
>> systems with SKIPIFWEIGHT settings and other similar mechanisms, and
>> whitelisting all AUTH traffic or things from one's address space is
>> fairly important if you want to save processing power.  Maybe the change
>> explains why some have reported a spike in CPU utilization???
>>
>> IMO, with the switch PREWHITELIST ON, processing of an E-mail should be
>> stopped and handled as a whitelisted item as soon as a condition is
>> met.  Understandably some conditions are met much sooner than others and
>> not all whitelisting used to work like that, but it would be nice if it
Dsic> did.
>>
>> Matt
>>
>>
>>
>> Don Brown wrote:
>>
>> >The below log entries tend to indicate that tests, including
>> >filter tests, are running, when the mail is whitelisted. Below are
>> >snips (in order) from the Global.cfg.  PreWhiteList is ON.
>> >
>> >This apparently started with the 2.X upgrade.  According to the logs
>> >before the upgrade, the below whitelist was preventing tests from
>> >running - in 2.x the test are obviously running.
>> >
>> >04/23/2005 14:27:06 QA1881154025C35BA BADHEADERS:6 SPAMHEADERS:6
Dsic> FILT-HELO:30 .  Total weight = 42.
>> >04/23/2005 14:27:06 QA1881154025C35BA E-mail whitelisted - automatically
Dsic> passing all spam tests [88.88.88.0/88]
>> >04/23/2005 14:27:06 QA1881154025C35BA Subject: subject
>> >04/23/2005 14:27:06 QA1881154025C35BA From: [EMAIL PROTECTED] To: [EMAIL 
>> >PROTECTED]
Dsic> IP: 88.88.88.89 ID:
>> >04/23/2005 14:27:06 QA1881154025C35BA Action(s) taken for [EMAIL PROTECTED]
Dsic> = WHITELISTED [LAST ACTION=WHITELISTED]
>> >
>> >Snips from the Global.cfg
>> ># WHITELIST AUTH automatically whitelists authenticated senders (for
Dsic> IMail v8 and later).
>> >WHITELIST   AUTH
>> ># Whitelist all entries in users Imail address book
>> >AUTOWHITELIST   ON
>> ># Automatically bypass spam tests for E-mail from whitelisted IPs or
Dsic> whitelisted return addresses.
>> >PREWHITELISTON
>> ># Per Domain Whitelist Files -
>> \Imail\Declude\example.com\whitelist.txt
>> >DOMAINWHITELISTSON
>> >WHITELIST   IP  88.88.88.0/88   # Anything from Our
Dsic> Address Space
>> >
>> >
>> >
>> >
>> >Don Brown - Dallas, Texas USA Internet Concepts, Inc.
>> >[EMAIL PROTECTED]   http://www.inetconcepts.net
>> >(972) 788-2364Fax: (972) 788-5049
>> >
>> >
>> >---
>> >This E-mail came from the Declude.JunkMail mailing list.  To
>> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> >type "unsubscribe Declude.JunkMail".  The archives can be found
>> >at http://www.mail-archive.com.
>> >
>> >
>> >
>> >
>>
>> -- 
>> =
>> MailPure custom filters for Declude JunkMail Pro.
>> http://www.mailpure.com/software/
>> =
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>>

Dsic> ---
Dsic> This E-mail came from the Declude.JunkMail mailing list.  To
Dsic> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
Dsic> type "unsubscribe Declude.JunkMail".  The archives can be found
Dsi

Re: [Declude.JunkMail] Tests Running when WhiteListed

2005-04-23 Thread Darrell \([EMAIL PROTECTED]) 
PREWHITELIST ON is working on 2.0.6 for me.

04/23/2005 23:59:59 Qb45c04ab008c9990 Skipping E-mail from IP
xxx.xxx.xxx.xxx   ; whitelisted

Looking in the manual it indicates this
"This option takes one parameter, ON, which indicates that Declude JunkMail
should try to run whitelists before tests are run. If the E-mail is
whitelisted, the tests should not be run. Note that [1] not all whitelists
will be run this way (check the code to see which are run), in which case
the E-mail will be whitelisted but the tests will be run, an "

I suspect the (check code to see which are run) is an internal comment and
was suppose to indicate the circumstances under which prewhitelist does not
kick in.

Darrell
---
DLAnalyzer - Comprehensive Declude Junkmail and Virus reporting -
http://www.invariantsystems.com


- Original Message - 
From: "Matt" <[EMAIL PROTECTED]>
To: 
Sent: Saturday, April 23, 2005 4:09 PM
Subject: Re: [Declude.JunkMail] Tests Running when WhiteListed


> If PREWHITELIST ON stopped working in 2.06, that would definitely be a
> bummer.  Good E-mail being scanned takes the most processing power on
> systems with SKIPIFWEIGHT settings and other similar mechanisms, and
> whitelisting all AUTH traffic or things from one's address space is
> fairly important if you want to save processing power.  Maybe the change
> explains why some have reported a spike in CPU utilization???
>
> IMO, with the switch PREWHITELIST ON, processing of an E-mail should be
> stopped and handled as a whitelisted item as soon as a condition is
> met.  Understandably some conditions are met much sooner than others and
> not all whitelisting used to work like that, but it would be nice if it
did.
>
> Matt
>
>
>
> Don Brown wrote:
>
> >The below log entries tend to indicate that tests, including
> >filter tests, are running, when the mail is whitelisted. Below are
> >snips (in order) from the Global.cfg.  PreWhiteList is ON.
> >
> >This apparently started with the 2.X upgrade.  According to the logs
> >before the upgrade, the below whitelist was preventing tests from
> >running - in 2.x the test are obviously running.
> >
> >04/23/2005 14:27:06 QA1881154025C35BA BADHEADERS:6 SPAMHEADERS:6
FILT-HELO:30 .  Total weight = 42.
> >04/23/2005 14:27:06 QA1881154025C35BA E-mail whitelisted - automatically
passing all spam tests [88.88.88.0/88]
> >04/23/2005 14:27:06 QA1881154025C35BA Subject: subject
> >04/23/2005 14:27:06 QA1881154025C35BA From: [EMAIL PROTECTED] To: [EMAIL 
> >PROTECTED]
IP: 88.88.88.89 ID:
> >04/23/2005 14:27:06 QA1881154025C35BA Action(s) taken for [EMAIL PROTECTED]
= WHITELISTED [LAST ACTION=WHITELISTED]
> >
> >Snips from the Global.cfg
> ># WHITELIST AUTH automatically whitelists authenticated senders (for
IMail v8 and later).
> >WHITELIST   AUTH
> ># Whitelist all entries in users Imail address book
> >AUTOWHITELIST   ON
> ># Automatically bypass spam tests for E-mail from whitelisted IPs or
whitelisted return addresses.
> >PREWHITELISTON
> ># Per Domain Whitelist Files - \Imail\Declude\example.com\whitelist.txt
> >DOMAINWHITELISTSON
> >WHITELIST   IP  88.88.88.0/88   # Anything from Our
Address Space
> >
> >
> >
> >
> >Don Brown - Dallas, Texas USA Internet Concepts, Inc.
> >[EMAIL PROTECTED]   http://www.inetconcepts.net
> >(972) 788-2364Fax: (972) 788-5049
> >
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
> >
> >
> >
> >
>
> -- 
> =
> MailPure custom filters for Declude JunkMail Pro.
> http://www.mailpure.com/software/
> =
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Tests Running when WhiteListed

2005-04-23 Thread Matt 
If PREWHITELIST ON stopped working in 2.06, that would definitely be a 
bummer.  Good E-mail being scanned takes the most processing power on 
systems with SKIPIFWEIGHT settings and other similar mechanisms, and 
whitelisting all AUTH traffic or things from one's address space is 
fairly important if you want to save processing power.  Maybe the change 
explains why some have reported a spike in CPU utilization???

IMO, with the switch PREWHITELIST ON, processing of an E-mail should be 
stopped and handled as a whitelisted item as soon as a condition is 
met.  Understandably some conditions are met much sooner than others and 
not all whitelisting used to work like that, but it would be nice if it did.

Matt

Don Brown wrote:
The below log entries tend to indicate that tests, including
filter tests, are running, when the mail is whitelisted. Below are
snips (in order) from the Global.cfg.  PreWhiteList is ON.
This apparently started with the 2.X upgrade.  According to the logs
before the upgrade, the below whitelist was preventing tests from
running - in 2.x the test are obviously running.
04/23/2005 14:27:06 QA1881154025C35BA BADHEADERS:6 SPAMHEADERS:6 FILT-HELO:30 . 
 Total weight = 42.
04/23/2005 14:27:06 QA1881154025C35BA E-mail whitelisted - automatically 
passing all spam tests [88.88.88.0/88]
04/23/2005 14:27:06 QA1881154025C35BA Subject: subject
04/23/2005 14:27:06 QA1881154025C35BA From: [EMAIL PROTECTED] To: [EMAIL 
PROTECTED]  IP: 88.88.88.89 ID:
04/23/2005 14:27:06 QA1881154025C35BA Action(s) taken for [EMAIL PROTECTED] = 
WHITELISTED [LAST ACTION=WHITELISTED]
Snips from the Global.cfg
# WHITELIST AUTH automatically whitelists authenticated senders (for IMail v8 
and later).
WHITELIST   AUTH
# Whitelist all entries in users Imail address book
AUTOWHITELIST   ON
# Automatically bypass spam tests for E-mail from whitelisted IPs or 
whitelisted return addresses.
PREWHITELISTON
# Per Domain Whitelist Files - \Imail\Declude\example.com\whitelist.txt
DOMAINWHITELISTSON
WHITELIST   IP  88.88.88.0/88   # Anything from Our Address 
Space


Don Brown - Dallas, Texas USA Internet Concepts, Inc.
[EMAIL PROTECTED]   http://www.inetconcepts.net
(972) 788-2364Fax: (972) 788-5049

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
 

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Tests Running when WhiteListed

2005-04-23 Thread Don Brown 
The below log entries tend to indicate that tests, including
filter tests, are running, when the mail is whitelisted. Below are
snips (in order) from the Global.cfg.  PreWhiteList is ON.

This apparently started with the 2.X upgrade.  According to the logs
before the upgrade, the below whitelist was preventing tests from
running - in 2.x the test are obviously running.

04/23/2005 14:27:06 QA1881154025C35BA BADHEADERS:6 SPAMHEADERS:6 FILT-HELO:30 . 
 Total weight = 42.
04/23/2005 14:27:06 QA1881154025C35BA E-mail whitelisted - automatically 
passing all spam tests [88.88.88.0/88]
04/23/2005 14:27:06 QA1881154025C35BA Subject: subject
04/23/2005 14:27:06 QA1881154025C35BA From: [EMAIL PROTECTED] To: [EMAIL 
PROTECTED]  IP: 88.88.88.89 ID:
04/23/2005 14:27:06 QA1881154025C35BA Action(s) taken for [EMAIL PROTECTED] = 
WHITELISTED [LAST ACTION=WHITELISTED]

Snips from the Global.cfg
# WHITELIST AUTH automatically whitelists authenticated senders (for IMail v8 
and later).
WHITELIST   AUTH
# Whitelist all entries in users Imail address book
AUTOWHITELIST   ON
# Automatically bypass spam tests for E-mail from whitelisted IPs or 
whitelisted return addresses.
PREWHITELISTON
# Per Domain Whitelist Files - \Imail\Declude\example.com\whitelist.txt
DOMAINWHITELISTSON
WHITELIST   IP  88.88.88.0/88   # Anything from Our Address 
Space




Don Brown - Dallas, Texas USA Internet Concepts, Inc.
[EMAIL PROTECTED]   http://www.inetconcepts.net
(972) 788-2364Fax: (972) 788-5049


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SMD Files

2005-04-23 Thread Darrell \([EMAIL PROTECTED]) 



Not saying this is your problem - but...  If 
you have applied the KB 893066 patch from the latest round of MS Patches you may 
want to look into that.  We have seen substantial issues with this patch 
internally and externally.
 
Darrell
---
invURIBL - Intelligent URI filtering plug-in for Declude.  Stops 85% 
of theSPAM with the default configuration.  Try it for free - http://www.invariantsystems.com
- Original Message - 

  From: 
  Kyle Fisher 

  To: Declude.JunkMail@declude.com 
  
  Sent: Saturday, April 23, 2005 2:40 
  AM
  Subject: RE: [Declude.JunkMail] SMD 
  Files
  
  
  Ok thanks John.  
  Why do you think this just started happening the past 3 days I went from about 
  200 spool files to 1000 during the day and then 2 days later there are all of 
  those left over files.
   
  Do you mean the SMTP 
  session from the client.  I have had some complaints (for about two 
  weeks) from clients (connected by T1) saying they are getting SMTP errors 
  occasionally.  They  have there client set to check mail every 5 
  minutes and throughout the day they get SMTP connection 
  errors.
   
  I mean I really don’t 
  know I am just searching at this point, but thanks for the 
  info
   
  Kyle
   
  
  
  
  
  From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of John Tolmachoff 
  (Lists)Sent: Saturday, April 
  23, 2005 12:28 AMTo: 
  Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] SMD 
  Files
   
  T files are 
  incomplete Q files, where by some how the SMTP session was not completed. They 
  along with the associated D file can be deleted. The reason it looks like they 
  have already been sent is that the sending server/user upon disconnection of 
  the SMTP session the resent the message in full.
   
  
  John 
  T
  eServices For 
  You
   
  
  -Original 
  Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Kyle 
  FisherSent: Friday, April 
  22, 2005 2:49 PMTo: 
  Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] SMD 
  Files
   
  Looking at some of 
  these it looks like they have already been sent and it is trying to resend 
  them again.  Also in some of these it is going to [EMAIL PROTECTED] 
  
   
  
  
  
  
  From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Kyle 
  FisherSent: Friday, April 
  22, 2005 3:50 PMTo: 
  Declude.JunkMail@declude.comSubject: [Declude.JunkMail] SMD 
  Files
   
  I am trying to find the article 
  that explains the build up of Txx.smd and Dxx.smd files in the spool 
  directory.  The past few days I have quite a few of these hanging around 
  in the spool directory.
   
  Here is a sample of what’s in the 
  files.  Some are from my local clients and some or from other mail 
  servers.
   
  Kyle
   
  Imail 
  8.15
  2.0.6 Junkmail and 
  Antivirus
  3.16b 
  F-Prot
  Message Sniffer 
  2.3
   
  D03bc03690136cf5a.SMD
   
  Received: from gwmsrm42 
  [172.16.52.2] by esc5.net with ESMTP
    (SMTPD32-8.15) id 
  A3BC3690136; Thu, 21 Apr 2005 14:49:16 -0500
   
   
  T03bc03690136cf5a.SMD
   
  QD:\IMail\spool\D03bc03690136cf5a.SMD
  Hesc5.net
  I03bc03690136cf5a
  X1
  WE:\IMail
  E0,
  R<[EMAIL PROTECTED]>
  S<[EMAIL PROTECTED]>
  NRCPT TO: 
  <[EMAIL PROTECTED]>
  R<[EMAIL PROTECTED]>
   

Re: [Declude.JunkMail] SMD Files

2005-04-23 Thread Julio Cesar Porcel 
Title: Message



Thanks to help me.  Greetings of 
Bolivia

  - Original Message - 
  From: 
  Adolfo Justiniano 
  
  To: Declude.JunkMail@declude.com 
  
  Sent: Friday, April 22, 2005 7:38 
PM
  Subject: RE: [Declude.JunkMail] SMD 
  Files
  
  Hello Julio,
   
  Before version 2 messages held by the hold action were placed in the 
  spam folder under spool.
   
  Since version 2 you could specify the path using HOLD 
   [path],  you could even specify the date: HOLD %DATE% or both HOLD 
  [Path]%DATE%
   
  Thank you Sandy for correcting him, I believe it was his first post. 
  Julio is an old friend who manages the servers of a local University 
  (Santa Cruz, Bolivia)
  
  Adolfo JustinianoSanta Cruz BBSe-mail: 
  [EMAIL PROTECTED]http://www.scbbs.net 
  
   
   
  

-Original Message-From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Julio Cesar 
PorcelSent: Friday, April 22, 2005 6:15 PMTo: 
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] SMD 
Files
Hello As they estan somebody that could help 
me.  Need some commando just as VIRDIR of Declude antivirus in 
Junkmail

  - Original Message - 
  From: 
  Kyle Fisher 
  
  To: Declude.JunkMail@declude.com 
  
  Sent: Friday, April 22, 2005 5:49 
  PM
  Subject: RE: [Declude.JunkMail] SMD 
  Files
  
  
  Looking at some 
  of these it looks like they have already been sent and it is trying to 
  resend them again.  Also in some of these it is going to [EMAIL PROTECTED] 
  
   
  
  
  
  
  From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Kyle FisherSent: Friday, April 22, 2005 3:50 
  PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] SMD 
  Files
   
  I am trying to find the 
  article that explains the build up of Txx.smd and Dxx.smd files in 
  the spool directory.  The past few days I have quite a few of these 
  hanging around in the spool directory.
   
  Here is a sample of what’s in 
  the files.  Some are from my local clients and some or from other 
  mail servers.
   
  Kyle
   
  Imail 
  8.15
  2.0.6 Junkmail and 
  Antivirus
  3.16b 
  F-Prot
  Message Sniffer 
  2.3
   
  D03bc03690136cf5a.SMD
   
  Received: from gwmsrm42 
  [172.16.52.2] by esc5.net with ESMTP
    (SMTPD32-8.15) id 
  A3BC3690136; Thu, 21 Apr 2005 14:49:16 -0500
   
   
  T03bc03690136cf5a.SMD
   
  QD:\IMail\spool\D03bc03690136cf5a.SMD
  Hesc5.net
  I03bc03690136cf5a
  X1
  WE:\IMail
  E0,
  R<[EMAIL PROTECTED]>
  S<[EMAIL PROTECTED]>
  NRCPT TO: 
  <[EMAIL PROTECTED]>
  R<[EMAIL PROTECTED]>
   

Re: [Declude.JunkMail] SMD Files

2005-04-23 Thread Don Brown 
SMTP is a chatty protocol and it's likely that connectivity problems
will show up with SMTP and POP, before they are detected with most
other protocols.  These connection issues could easily be the client's
problem, due to a faulty T-1 connection, i.e. dirty bandwidth, a
failing local loop (SBC is famous for using anything for a bridge tap
in our venue), etc.

The left over T files, however, point to the problem being on your
end.

Check your router for CRC, Framing and other data comm errors as
well as interface resets and lost carrier. Most routers have counters
you can display.  In my experience, that's the most likely cause of
the problem.  If the router is clean, then start eliminating the other
possibilities on the circuit to your mail server.

Ipswitch will tell you to replace your NIC with a high dollar 3COM
card. (I think Tech support reps gets that tattooed on the back of
their hand, as a pre-requisite to being hired.)  That's more likely to
be a rabbit trail, which frees up a tech support line and engineer.

There's no silver bullet, unfortunately.  You just need to start
eliminating possibilities, starting with the most likely and followed
by the simple-stupid things like even patch cords.

HTH

Thanks,


Saturday, April 23, 2005, 1:40:53 AM, Kyle Fisher <[EMAIL PROTECTED]> wrote:

  
  
KF> Ok thanks John.  Why do you think this just started happening
KF> the past 3 days I went from about 200 spool files to 1000 during
KF> the day and then 2 days later there are all of those left over
KF> files.
  
KF>  
  
KF> Do you mean the SMTP session from the client.  I have had
KF> some complaints (for about two weeks) from clients (connected by
KF> T1) saying they are getting SMTP errors occasionally.  They  have
KF> there client set to check mail every 5 minutes and throughout the
KF> day they get SMTP connection errors.
  
KF>  
  
KF> I mean I really don’t know I am just searching at this point, but thanks 
for the info
  
KF>  
  
KF> Kyle
  
KF>  
  
  
  

  
  
KF> From: [EMAIL PROTECTED]
KF> [mailto:[EMAIL PROTECTED] On Behalf Of John
KF> Tolmachoff (Lists)
KF> Sent: Saturday, April 23, 2005 12:28 AM
KF> To:Declude.JunkMail@declude.com
KF> Subject: RE: [Declude.JunkMail] SMD Files
  
  
KF>  
  
KF> T files are incomplete Q files, where by some how the SMTP
KF> session was not completed. They along with the associated D file
KF> can be deleted. The reason it looks like they have already been
KF> sent is that the sending server/user upon disconnection of the
KF> SMTP session the resent the message in full.
  
KF>  
  
  
KF> John T
  
KF> eServices For You
  
  
KF>  
  
  
KF> -Original Message-
KF> From: [EMAIL PROTECTED]
KF> [mailto:[EMAIL PROTECTED] On Behalf Of Kyle
KF> Fisher
KF> Sent: Friday, April 22, 2005 2:49 PM
KF> To:Declude.JunkMail@declude.com
KF> Subject: RE: [Declude.JunkMail] SMD Files
  
KF>  
  
KF> Looking at some of these it looks like they have already been
KF> sent and it is trying to resend them again.  Also in some of these
KF> it is going to [EMAIL PROTECTED]
  
KF>  
  
  
  

  
  
KF> From: [EMAIL PROTECTED]
KF> [mailto:[EMAIL PROTECTED] On Behalf Of Kyle
KF> Fisher
KF> Sent: Friday, April 22, 2005 3:50 PM
KF> To:Declude.JunkMail@declude.com
KF> Subject: [Declude.JunkMail] SMD Files
  
  
KF>  
  
KF> I am trying to find the article that explains the build up of
KF> Txx.smd and Dxx.smd files in the spool directory.  The
KF> past few days I have quite a few of these hanging around in the
KF> spool directory.
  
KF>  
  
KF> Here is a sample of what’s in the files.  Some are from my
KF> local clients and some or from other mail servers.
  
KF>  
  
KF> Kyle
  
KF>  
  
KF> Imail 8.15
  
KF> 2.0.6 Junkmail and Antivirus
  
KF> 3.16b F-Prot
  
KF> Message Sniffer 2.3
  
KF>  
  
KF> D03bc03690136cf5a.SMD
  
KF>  
  
KF> Received: from gwmsrm42 [172.16.52.2] by esc5.net with ESMTP
  
KF>   (SMTPD32-8.15) id A3BC3690136; Thu, 21 Apr 2005 14:49:16 -0500
  
KF>  
  
KF>  
  
KF> T03bc03690136cf5a.SMD
  
KF>  
  
KF> QD:\IMail\spool\D03bc03690136cf5a.SMD
  
KF> Hesc5.net
  
KF> I03bc03690136cf5a
  
KF> X1
  
KF> WE:\IMail
  
KF> E0,
  
KF> R<[EMAIL PROTECTED]>
  
KF> S<[EMAIL PROTECTED]>
  
KF> NRCPT TO: <[EMAIL PROTECTED]>
  
KF> R<[EMAIL PROTECTED]>
  
KF>  
  
  
  





Don Brown - Dallas, Texas USA Internet Concepts, Inc.
[EMAIL PROTECTED]   http://www.inetconcepts.net
(972) 788-2364Fax: (972) 788-5049


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SMD Files

2005-04-23 Thread John Tolmachoff \(Lists\) 








Having the clients check for new mail
every 10 minutes is better than 5 minutes.

 

Sounds like you need to start analyzing
the logs for a sudden jump in the amount of outgoing messages.

 

You should also analyze the logs for
error messages.

 



John T

eServices For You



 



-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher
Sent: Friday, April
 22, 2005 11:41 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail]
SMD Files

 

Ok thanks John.  Why do you think
this just started happening the past 3 days I went from about 200 spool files
to 1000 during the day and then 2 days later there are all of those left over
files.

 

Do you mean the SMTP session from the
client.  I have had some complaints (for about two weeks) from clients
(connected by T1) saying they are getting SMTP errors occasionally.  They
 have there client set to check mail every 5 minutes and throughout the
day they get SMTP connection errors.

 

I mean I really don’t know I am just
searching at this point, but thanks for the info

 

Kyle

 









From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)
Sent: Saturday, April
 23, 2005 12:28 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail]
SMD Files



 

T files are incomplete Q files, where by
some how the SMTP session was not completed. They along with the associated D
file can be deleted. The reason it looks like they have already been sent is
that the sending server/user upon disconnection of the SMTP session the resent
the message in full.

 



John T

eServices For You



 



-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher
Sent: Friday, April
 22, 2005 2:49 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail]
SMD Files

 

Looking at some of these it looks like
they have already been sent and it is trying to resend them again.  Also
in some of these it is going to [EMAIL PROTECTED]


 









From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher
Sent: Friday, April
 22, 2005 3:50 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] SMD
Files



 

I am trying to find the article that explains the build up
of Txx.smd and Dxx.smd files in the spool directory.  The past few
days I have quite a few of these hanging around in the spool directory.

 

Here is a sample of what’s in the files.  Some
are from my local clients and some or from other mail servers.

 

Kyle

 

Imail 8.15

2.0.6 Junkmail and Antivirus

3.16b F-Prot

Message Sniffer 2.3

 

D03bc03690136cf5a.SMD

 

Received: from gwmsrm42 [172.16.52.2] by esc5.net with ESMTP

  (SMTPD32-8.15) id A3BC3690136; Thu, 21 Apr 2005 14:49:16 -0500

 

 

T03bc03690136cf5a.SMD

 

QD:\IMail\spool\D03bc03690136cf5a.SMD

Hesc5.net

I03bc03690136cf5a

X1

WE:\IMail

E0,

R<[EMAIL PROTECTED]>

S<[EMAIL PROTECTED]>

NRCPT TO: <[EMAIL PROTECTED]>

R<[EMAIL PROTECTED]>

 

Re: [Declude.JunkMail] Off Topic - Content Filter Suggestions

2005-04-23 Thread Sanford Whiteman 
> We may be taking on a large account which requires content filtering
> for  students.  I'm  looking  for a content filter system that would
> provide  "hands  off"  updating  similar  to  Pete's awesome Sniffer
> Product.

After  significant  time  spent dealing with, and hating on, eSafe and
WebWasher (both standalone and w/Squid), we now recommend WebSense for
content  filtering.  Can't  say  definitively  whether  it's  the best
around, but IMO it's the best of the three and a deserved leader.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
  http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases!
  
http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/
  
http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.