[Declude.JunkMail] SMTP Slowdown
Hello, My apologies in advance for the length of this, but I want to be as through as possible the first time. The background: Dell Poweredge 6400, Imail 6.06 Windows 2000 Server, SP2 Quad Xeon 733 mhz Declude 1.60, running Virus and Junkmail McAfee 4.1.60, Dat file 4229 4GB Ram All drives ultra scsi, lvd, 10, rpm or better C: 2-18 gb, hardware raid 1, OS drive E: 18 gb Imail and Spool drive F: 2-36 gb hardware raid 1 for the main domain, +\- 15,000 accounts G: 2-18 gb hardware raid 1 for the hosted domains, +\- 100 domains, +\- 500 accounts total 375,000-400,000 messages per day On Friday last week, we installed SP3 and let Microsoft (from windowsupdates.microsoft.com) perform the required/recommended hot patches. Since that time, our customer base has been seeing an increasing number of smtp connect failures. We are seeing the same thing on our internal lan as well. Sometimes, it will fail in less than a second with Outlook/Outlook Express/Eudora reporting that the tcp/ip connection was unexpectedly terminated by the server. Other times, it will take 45-60 seconds for the error to occur. One time out of 5, it will send the message, but only after a 45-60 second wait. So far, we have: Reinstalled 2000, sp2, Imail, McAfee and Declude from fresh files, onto formatted drives, effectively undoing all of the changes that were made Friday. Changed from Intel Pro 100+ to Allied Telesyn Nics, and back Updated Nic drivers for the intels Stopped Declude totally Added MaxQueProc=30 Verified not a DOS attack Virus Scanned the entire system Changed network cables Changed ports on the switch Moved/Increased/Decreased the pagefile We have been though the Imail Knowledge base, the Declude list archives, and the Imail list archives. It seems that SMTPD32.exe is the issue, but we are not sure. Any assistance/advice will be greatly appreciated Thank you in advance for any assistance Bill Domain Mail Administrator --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SMTP Slowdown
1, with cpu load running between 25-35%, usually around 65-70%, with no issues. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Mark Smith Sent: Wednesday, October 23, 2002 9:22 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SMTP Slowdown Sounds like a SMTP loop or something. How many instances of SMTPD32.exe are running? -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com] On Behalf Of Bill Kaylor, Domain Mail Administrator Sent: Wednesday, October 23, 2002 9:14 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: [Declude.JunkMail] SMTP Slowdown Hello, My apologies in advance for the length of this, but I want to be as through as possible the first time. The background: Dell Poweredge 6400, Imail 6.06 Windows 2000 Server, SP2 Quad Xeon 733 mhz Declude 1.60, running Virus and Junkmail McAfee 4.1.60, Dat file 4229 4GB Ram All drives ultra scsi, lvd, 10, rpm or better C: 2-18 gb, hardware raid 1, OS drive E: 18 gb Imail and Spool drive F: 2-36 gb hardware raid 1 for the main domain, +\- 15,000 accounts G: 2-18 gb hardware raid 1 for the hosted domains, +\- 100 domains, +\- 500 accounts total 375,000-400,000 messages per day On Friday last week, we installed SP3 and let Microsoft (from windowsupdates.microsoft.com) perform the required/recommended hot patches. Since that time, our customer base has been seeing an increasing number of smtp connect failures. We are seeing the same thing on our internal lan as well. Sometimes, it will fail in less than a second with Outlook/Outlook Express/Eudora reporting that the tcp/ip connection was unexpectedly terminated by the server. Other times, it will take 45-60 seconds for the error to occur. One time out of 5, it will send the message, but only after a 45-60 second wait. So far, we have: Reinstalled 2000, sp2, Imail, McAfee and Declude from fresh files, onto formatted drives, effectively undoing all of the changes that were made Friday. Changed from Intel Pro 100+ to Allied Telesyn Nics, and back Updated Nic drivers for the intels Stopped Declude totally Added MaxQueProc=30 Verified not a DOS attack Virus Scanned the entire system Changed network cables Changed ports on the switch Moved/Increased/Decreased the pagefile We have been though the Imail Knowledge base, the Declude list archives, and the Imail list archives. It seems that SMTPD32.exe is the issue, but we are not sure. Any assistance/advice will be greatly appreciated Thank you in advance for any assistance Bill Domain Mail Administrator --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SMTP Slowdown
cpu util is between 25-35%, was around 65-70 before friday, and the server never had an issue. on access is disabled however. This is the first issue I have had with this server in over a year. btw, I never see more than 2-3 scan.exe in the processes at any one time, have the limit set to 15, and have even disabled declude totally, no change. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of R. Scott Perry Sent: Wednesday, October 23, 2002 9:29 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SMTP Slowdown My apologies in advance for the length of this, but I want to be as through as possible the first time. The background: 375,000-400,000 messages per day Virus scanning over 350,000 E-mails per day on one server will use a lot of CPU time. However, if it was working fine before with the same volume, then it should be able to work now. Is there any chance that you have an on-access virus scanner running in the background scanning files? That could be what is pushing the server to its limits. -Scott --- Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for IMail. http://www.declude.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist Request
That's what I did...using the address list, I give it a weight of -140, which is more than the total of ALL of my tests added together... Bill -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Charles Frolick Sent: Wednesday, September 18, 2002 11:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request I decided I will start using filter file to whitelist legitimate mailing lists from listservers that also support spammers, since they seem to be the bulk of my false positives. I am giving them all 0 weight in the list, but will give the whole test a very high negative weight. I currently only have a few examples, since I am not that aggressive yet in my weights, but I welcome any suggestions. This should allow everyone to be much more aggressive. Maybe a version of the filter test that is a whitelist wouldn't be a bad idea. The filter tests allow for more flexability than the standard whitelist, leaving in many cases less room for error. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mark Smith Sent: Wednesday, September 18, 2002 9:47 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request Rick, I completely agree with you. I don't like risking corruption to the global.cfg file through a ASP/CGI script error. Our idea is to turn up the weight tests and whitelist all of our customer base. The external whitelsit makes it easier to keep that update. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson Sent: Wednesday, September 18, 2002 10:33 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelist Request Hi Bob, There are a few reasons I want/need the whitelist separate. One being that it will be easy to push a copy of the whitelist via ftp to each relevant system instead of manually or programaticly attaching to each server and editing the global.cfg. Secondly the global.cfg file is basicly static infomation aside from the whitelist, so interfacing with it programaticly seems like wasted effort to me. I don't believe Scott intended the whitelist to be used as much as it is but unfortunately the amount of legit servers needing whitelisting is enough to make the whitelist an important feature of Declude. The level of modification will just be adding and removing white and black list entries as well as word and phrase filter lines. We can do this via the web and email. Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - - Original Message - From: Robert Shubert [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 17, 2002 5:57 PM Subject: Re: [Declude.JunkMail] Whitelist Request Rick, I too am planning to advance Declude administration to my users via a web application. Although I saw no reason why I couldn't programmaticaly change the global.cfg and other files. Could I ask your reasoning? Also, to what level of modification do you anticipate. The numerous options that declude allows for will make 100% remote editing quite a challange. Thanks for your input. Bob Rick Davidson wrote: Howdy Scott, Was wondering if you would consider creating a separate whitelist file for management purposes. Currently I have one customer with 4 Imail servers peered as a single domain across the country (US :-) I maintain master black lists and word filters on my workstation and use a batch file to FTP them to each server. Also, we are developing some web based management tools for Declude and would rather not have to programmaticly access the global.cfg file. Figured I would ask :-) Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned
