RE: [Declude.JunkMail] Declude in front of exchange servers.
We just set up a large client who uses Exchange and set our server up as a gateway as
described by ipswitch.
It now has been 18 hours and we have prevent 100 items of Spam going to them and
trapped 5 virus occurrences (all KLEZ)
The client is very happy with having Spam removed as he knows the difference it will
make in productivity
Declude SPAM and Virus are very worthwhile
Thank you Scott for your speedy and informative responses
Harry Vanderzand
inTown Internet
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Johnson, Mike
Sent: Thursday, May 16, 2002 11:05 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Declude in front of exchange servers.
Has anyone used declude (with iMail) infront of exchange servers to filter mail? How
well does this option work?
I~
I~ II~
)_) )_) )_)
)___))___))___)\
)))_)\\
_III\\\__
-\ Venture Computer /-
^^^ \ Systems / ^ ^^
^ ^ ^^^
^^^^^
Michael Johnson, MCSE
(507) 252-5944
[EMAIL PROTECTED]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
winmail.dat
[Declude.JunkMail] Is there a content test available yet?
Is there a test to can mark an item as spam based on a string match in the message. There is some spam that repeatedly comes from different hotmail addresses but the message is identical. A content spam would allow me to get rid of it Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Is there a content test available yet?
Thank you What test is it and does it put a lot more load on the system? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, April 02, 2003 4:50 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Is there a content test available yet? Is there a test to can mark an item as spam based on a string match in the message. There is some spam that repeatedly comes from different hotmail addresses but the message is identical. A content spam would allow me to get rid of it Yes -- with Declude JunkMail Pro, you can set up a filter, that will let you check various parts of the E-mail (such as the body) for specific content. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] headers indicate both failed and not failed????
Can anyone tell me what is happening with the following headers? It indicates that tests failed yet at the end it says that test failed is NOINE thanks Received: from SMTP32-FWD by intown.net (SMTP32) id A062012F3; Fri, 30 May 2003 03:12:59 -0400 Received: from mail.escapees.com [207.70.132.66] by intown.net with ESMTP (SMTPD32-8.00) id A46EE000D0; Fri, 30 May 2003 03:12:46 -0400 Received: from SMTP32-FWD by mail.escapees.com (SMTP32) id A03D42CC5; Fri, 30 May 2003 02:06:10 -0500 Received: from compuserve.com [68.58.200.135] by mail.escapees.com (SMTPD32-8.00) id A2DF4E30272; Fri, 30 May 2003 02:06:07 -0500 Date: Fri, 30 May 2003 06:17:29 + From: Hailey [EMAIL PROTECTED] Subject: [SPAM WARNING]Lrosenberg, This XXX area is like no other, real explicit sex as NEVER been seen like this before!!! To: Lrosenberg [EMAIL PROTECTED] References: [EMAIL PROTECTED] In-Reply-To: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_L4GFK710_L0GFLCB7_6AD17CB X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?68.58.200.135 X-RBL-Warning: WEIGHT10: Weight of 13 reaches or exceeds the limit of 10. X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=68.58.200.135 X-Declude-Sender: [EMAIL PROTECTED] [68.58.200.135] X-Note: This E-mail was scanned by Declude. X-Spam-Tests-Failed: SPAMCOP, WEIGHT10, WEIGHTWARN, DSBL X-Note: This E-mail was sent from pcp02799235pcs.goosck01.sc.comcast.net ([68.58.200.135]). X-Declude-Sender: [EMAIL PROTECTED] [207.70.132.66] X-Declude-Spoolname: D046e00e000d0aec7.SMD X-Note: Tests Failed: None Status: U X-UIDL: 354131753 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] headers indicate both failed and not failed????
That makes sense thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, May 30, 2003 9:10 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] headers indicate both failed and not failed Can anyone tell me what is happening with the following headers? It indicates that tests failed yet at the end it says that test failed is NOINE Received: from mail.escapees.com [207.70.132.66] by intown.net with ESMTP (SMTPD32-8.00) id A46EE000D0; Fri, 30 May 2003 03:12:46 -0400 Received: from compuserve.com [68.58.200.135] by mail.escapees.com (SMTPD32-8.00) id A2DF4E30272; Fri, 30 May 2003 02:06:07 -0500 It looks like the E-mail passed through 2 IMail servers, yours and mail.escapees.com. X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?68.58.200.135 X-RBL-Warning: WEIGHT10: Weight of 13 reaches or exceeds the limit of 10. X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=68.58.200.135 X-Declude-Sender: [EMAIL PROTECTED] [68.58.200.135] X-Note: This E-mail was scanned by Declude. X-Spam-Tests-Failed: SPAMCOP, WEIGHT10, WEIGHTWARN, DSBL These are the headers that their Declude JunkMail added, and: X-Note: This E-mail was sent from pcp02799235pcs.goosck01.sc.comcast.net ([68.58.200.135]). X-Declude-Sender: [EMAIL PROTECTED] [207.70.132.66] X-Declude-Spoolname: D046e00e000d0aec7.SMD X-Note: Tests Failed: None These are the ones that your Declude JunkMail added. Since the server that sent you the E-mail (207.70.132.66) is not listed in any spam databases, it didn't fail any tests on your server. This is a problem inherent in E-mail forwarded from one server to another. One option in this case would be to add a line IPBYPASS 207.70.132.66 to your \IMail\Declude\global.cfg file, which will let Declude JunkMail see the IP address that actually sent the E-mail (so it will fail the SPAMCOP and DSBL tests on your server). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Filter wuestio
Is there a way to put a copy of the string that matched the filter test into the headers? thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DSBL Tests - results
Is it possible to have declude do a test on the following: HEADERS 20 CONTAINSX-IMAIL-SPAM-STATISTICS: 1. I have tried this but do cannot get it working. Is this put into the headers after declude is finished? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Tuesday, June 10, 2003 4:51 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] DSBL Tests - results If you want IMail to do these tests then simply create a filter file and add it to your Global statement. FILTER-HEADER-XMAIL filter C:\IMail\Declude\IMail_Filter_Header_XHeader.txt x 0 0 Our header file: IMail_Filter_Header_XHeader.txt has the following entries: == HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-BRAZIL HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-BROADWING HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-CN-KR HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-CW HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-INFLOW HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-JAPAN HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-KOREA HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-LEVEL3 HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-YIPES HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BLARS HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (DELINK HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (DSBL HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (DSBLALL HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (fiveten HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (INTERSIL HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (KUNDENSERVER HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (NJABL HEADERS 9 CONTAINS X-IMAIL-SPAM-DNSBL: (ORDB HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (SORBS-HTTP HEADERS 10 CONTAINS X-IMAIL-SPAM-DNSBL: (SpamCop HEADERS 8 CONTAINS X-IMAIL-SPAM-DNSBL: (SPAMHAUS HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (WIREHUB-DNSBL HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (ybl HEADERS 8 CONTAINS X-IMAIL-SPAM-VALFROM: HEADERS 5 CONTAINS X-IMAIL-SPAM-VALHELO: HEADERS 12 CONTAINSX-IMAIL-SPAM-VALREVDNS Hope this helps. Remember that the text search we do is based on our definitions. For example (WIREHUB-DNSBL is what we are calling the test in IMail. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Tuesday, June 10, 2003 4:20 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] DSBL Tests - results After I and these checks into the Antispam part of IMAIL 8 what needs to be done to have Delude know they have failed. - Original Message - From: Kami mailto:[EMAIL PROTECTED] Razvan To: [EMAIL PROTECTED] Sent: Tuesday, June 10, 2003 2:32 PM Subject: [Declude.JunkMail] DSBL Tests - results Hi; Just reporting on a finding to-date. We have included all of the ip4r tests on the Declude's site in the IMail 8 IP4r spam section. Since May 18 the following are the only tests that are triggered. We just ran a script on spam log file and the following unique tests are identified. BHOLE-CN-KR:*:cn-kr.blackholes.us BHOLE-CYPERCON:*:cybercon.blackholes.us WIREHUB-DYNA:*:dynablock.easynet.nl BHOLE-CHINA:*:china.blackholes.us WIREHUB-DNSBL:*:blackholes.easynet.nl BHOLE-SKYNETWEB:*:skynetweb.blackholes.us SORBS-HTTP:*:dnsbl.sorbs.net BHOLE-KOREA:*:korea.blackholes.us ybl:*:ybl.megacity.org BHOLE-CW:*:cw.blackholes.us COMPU:*:blackhole.compu.net BLARS:*:block.blars.org DSBL:*:list.dsbl.org NJABL:*:dnsbl.njabl.org SpamCop:*:bl.spamcop.net fiveten:*:blackholes.five-ten-sg.com BHOLE-VERIO:*:verio.blackholes.us DSBLALL:*:unconfirmed.dsbl.org We are not counting how many of each, I guess we can add that easily. For now the above are the results of almost 3 weeks. Regards, Kami --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
[Declude.JunkMail] filter HTML source code
Title: Message Is there a way to filter the HTML source code of an e-mail. If there is then I can filter out more. thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2
RE: [Declude.JunkMail] filter HTML source code
Title: Message with html many are just putting an image in the e-mail. If I can filter on the underlying url then I could stop these kinds of spam. Or is there another way? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus GuflerSent: Friday, July 25, 2003 9:03 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] filter HTML source code Harry What do you want to filter out? Markus -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Friday, July 25, 2003 2:55 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] filter HTML source code Is there a way to filter the HTML source code of an e-mail. If there is then I can filter out more. thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2
RE: [Declude.JunkMail] filter HTML source code
Title: Message any ideas on this from anyone? I want to know if I can filter the html source code the same way the body, headers etc., can be filtered. That way when the e-mail just consists of a clickable image then I could check for offending spam web sites in the html source code Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Friday, July 25, 2003 11:06 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] filter HTML source code with html many are just putting an image in the e-mail. If I can filter on the underlying url then I could stop these kinds of spam. Or is there another way? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus GuflerSent: Friday, July 25, 2003 9:03 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] filter HTML source code Harry What do you want to filter out? Markus -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Friday, July 25, 2003 2:55 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] filter HTML source code Is there a way to filter the HTML source code of an e-mail. If there is then I can filter out more. thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2
RE: [Declude.JunkMail] filter HTML source code
Great. That is straight forward Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, July 25, 2003 4:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] filter HTML source code any ideas on this from anyone? I want to know if I can filter the html source code the same way the body, headers etc., can be filtered. That way when the e-mail just consists of a clickable image then I could check for offending spam web sites in the html source code The Declude JunkMail filters will work fine with HTML source code. So if the HTML source has 'IMG SRC=http://www.example.com/pic.jpg;', you could use: BODY 0 CONTAINS http://www.example.com/pic.jpg BODY 0 CONTAINS .example.com BODY 0 CONTAINS IMG SRC=http://www.example.com; ... -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] scrambled url in source of e-mail
Title: Message How does one deal with scrambles source in the e-mail. For example I find the following address: www.%3982%30%37.biz I like to us the address in my filter file but am not sure if the scrambled form will work as I assume there must be a translation going on when this code gets processed thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark SmithSent: Thursday, September 04, 2003 8:43 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Placing Weight in Header Duuuh.. Why didn't I think of that. FWIW, if you just put Weight: %WEIGHT% in the header then you might be breaking RFC's. There should be an X- before your "Weight"linewhich will denote a comment line. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net WebmasterSent: Thursday, September 04, 2003 8:25 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Placing Weight in Header we use , in our global.cfg file, XINHEADERWeight: %WEIGHT% so you could out in yours: XINHEADERX-DECLDUE-WEIGHT:%WEIGHT% Sincerely,Randy ArmbrechtGlobal Web Solutions, Inc.804-346-5300 ext. 1877-800-GLOBAL (4562) ext. 1http://globalweb.net -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark SmithSent: Thursday, September 04, 2003 7:39 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Placing Weight in Header Is there any way to place the total weight in the SMTP header? Something like: X-DECLUDE-WEIGHT: yyy
[Declude.JunkMail] entry in log but not in header
Title: Message I am trying to understand why the headers have no indication of being scanned by declude yet I do see an entry in the declude logs. Anyone know of a reason? thank you 03/08/2004 07:50:59 Q6c210a5f00cceb07 Tests failed [weight=4]: REVDNS=WARN CATCHALLMAILS=IGNORE\ Received: from SMTP32-FWD by intown.net (SMTP32) id A04F401D6; Mon, 8 Mar 2004 07:51:00 -0500Received: from mail.finred.net.mx [82.166.2.58] by intown.net (SMTPD32-8.05) id AC21A5F00CC; Mon, 08 Mar 2004 07:50:41 -0500Received: (from [EMAIL PROTECTED]) by mail.finred.net.mx (sccrmhc13) with ESMTP id J87Gz002357269 for [EMAIL PROTECTED]; Mon, 8 Mar 2004 12:38:57 + (GMT) (envelope-from www)Message-ID: [EMAIL PROTECTED]From: "Charlsie Paul" [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: Custom Logo DesignDate: Mon, 8 Mar 2004 12:38:57 + (GMT)X-AntiAbuse: This header was added to track abuse, please include it with any abuse reportX-AntiAbuse: Primary Hostname - mail.finred.net.mxX-AntiAbuse: Original Domain - mail.finred.net.mxX-AntiAbuse: Originator/Caller UID/GID - [80 80] / [80 80]X-AntiAbuse: Sender Address Domain -MIME-Version: 1.0Content-Type: multipart/alternative; boundary="=_NextPart_000_0222_01C3C64F.FBD71A00" Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2519-741-1222
RE: [Declude.JunkMail] entry in log but not in header
Is there a way to fix this or catch it as spam? I am running declude 178i15 and imail 8.05HF1 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, March 08, 2004 9:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] entry in log but not in header I am trying to understand why the headers have no indication of being scanned by declude yet I do see an entry in the declude logs. Anyone know of a reason? The key here is the end of the headers: X-AntiAbuse: Sender Address Domain - MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0222_01C3C64F.FBD71A00 There are 2 things that I notice here. First is that there are no IMail headers, either (X-RCPT-To:, X-UIDL). The second is that this E-mail appears to contain the Blank Folding vulnerability (the last line of the headers contains just a single space). So the E-mail is not RFC-compliant. That blank folding is most likely what is causing the problems. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] entry in log but not in header
Is there a way to fix this or catch it as spam? I am running declude 178i15 and imail 8.05HF1 Declude Virus should automatically block this, as it appears to contain a mailserver AV vulnerability. That is what I thought. Can you think of any reason why it did not catch it? The log entry for the virus scan follows: 03/08/2004 07:50:50 Q6c210a5f00cceb07 MIME file: [text/html][7bit; Length=2931 Checksum=241661] 03/08/2004 07:50:50 Q6c210a5f00cceb07 Scanned: Virus Free [Prescan OK][MIME: 2 4314] You might want to set up a filter in Declude JunkMail for custom logo in the subject, which would block this one. It seems that these custom logo people aren't doing anything to try to hide the fact that they are selling custom logos, which makes it relatively easy to block them. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] entry in log but not in header
Declude Virus should automatically block this, as it appears to contain a mailserver AV vulnerability. That is what I thought. Can you think of any reason why it did not catch it? What version of Declude are you running (\IMail\Declude -diag from a command prompt will show you)? V178i15 Do you have a line BANCRVIRUSES OFF in the \IMail\Declude\virus.cfg file? Yes I do -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] entry in log but not in header
Thank you very much Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, March 10, 2004 9:36 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] entry in log but not in header Do you have a line BANCRVIRUSES OFF in the \IMail\Declude\virus.cfg file? Yes I do That is why the vulnerabilities are not being caught -- that line disables all vulnerability detection in Declude Virus (which is not recommended). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Detecting disguised url's in headers
IE this url: //205.159.%372.%32%30/mort/ obviously gets translated and I could do so also. It would take a lot of extra time. I copy the url out of headers of spam that gets through and put it into my filter file. These are bothersome however. Is there a way that we could just mark these kind of mails as spam? I think it would be just spammers that do this. thanks Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Detecting disguised url's in headers
Where is this set in imail? Is it antispam of imail as we do not use it. Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason Sent: Friday, March 19, 2004 1:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Detecting disguised url's in headers We created an Imail rule to block these. Here is what we use: (http\://\d\d\.|http\://\d\d\d\.):spambox This seems to work very well. Jason -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Friday, March 19, 2004 12:30 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Detecting disguised url's in headers IE this url: //205.159.%372.%32%30/mort/ obviously gets translated and I could do so also. It would take a lot of extra time. I copy the url out of headers of spam that gets through and put it into my filter file. These are bothersome however. Is there a way that we could just mark these kind of mails as spam? I think it would be just spammers that do this. thanks Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [AUTOMATED NOTE: Your mail server [66.140.194.140] is missing a reverse DNS entry. All Internet hosts are required to have a reverse DNS entry. The missing reverse DNS entry will cause your mail to be treated as spam on some servers, such as AOL.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Detecting disguised url's in headers
I am not sure if my request here is being understood. I would not want to mark all messages with an IP in the url as spam. Only those messages that use %nnn%nnn%nnn etc. When you view source of an html message you can see this kind of coding. As in this case: //205.159.%372.%32%30/mort/ We always do a view source and take the url out of the source and then blacklist that, for those messages that were no caught by anti-spam at the time. I do not know what that process is called and have only ever seen it in source code of certain spam e-mail Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason Sent: Friday, March 19, 2004 1:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Detecting disguised url's in headers We created an Imail rule to block these. Here is what we use: (http\://\d\d\.|http\://\d\d\d\.):spambox This seems to work very well. Jason -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Friday, March 19, 2004 12:30 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Detecting disguised url's in headers IE this url: //205.159.%372.%32%30/mort/ obviously gets translated and I could do so also. It would take a lot of extra time. I copy the url out of headers of spam that gets through and put it into my filter file. These are bothersome however. Is there a way that we could just mark these kind of mails as spam? I think it would be just spammers that do this. thanks Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [AUTOMATED NOTE: Your mail server [66.140.194.140] is missing a reverse DNS entry. All Internet hosts are required to have a reverse DNS entry. The missing reverse DNS entry will cause your mail to be treated as spam on some servers, such as AOL.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DNS
Whenever I have to bring my primary dns server down a lot of spam gets through. It appears that declude is only using one DNS server. Is there a way for it to use my secondary DNS when the primary is down? thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Some declude.exe process do not end unless the server is rebooted
I find I need to reboot the server every once in a while to clear up declude processes. Especially if I want to apply and interim release. Is there anything I should do to prevent this? Thank you Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Some declude.exe process do not end unless the server is rebooted
But I do have instances of declude process staying alive and they do not get released unless I reboot! That is my issue. After I reboot I run an update script to copy an new release. My concern is these instances that accumulate. After a week or so there are about 5 -6 instances that do not get released Harry Vanderzand inTown Internet Computer Services -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, June 15, 2004 1:55 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Some declude.exe process do not end unless the server is rebooted Declude.exe instances fire once for each email, they don't stay resident. Instead of rebooting the server, stop your IMail SMTP and Queue services so that no mail is being processed, which means declude.exe instances won't be run. Then you can do whatever maintenance you require, and restart the services. Or how about a little script that persistently tries to copy the file, e.g. copycopy.cmd: if == %1 goto quit :mulligan @copy /y %1 declude.exe @if errorlevel 1 goto mulligan @echo New build of declude is now active! :quit --- e.g. copycopy.cmd c:\temp\declude.exe Andrew 8) -Original Message- From: Harry Vanderzand [mailto:[EMAIL PROTECTED] Sent: Tuesday, June 15, 2004 8:48 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Some declude.exe process do not end unless the server is rebooted I find I need to reboot the server every once in a while to clear up declude processes. Especially if I want to apply and interim release. Is there anything I should do to prevent this? Thank you Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Some declude.exe process do not end unless the server is rebooted
This has happened for quite some time Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, June 15, 2004 5:02 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Some declude.exe process do not end unless the server is rebooted But I do have instances of declude process staying alive and they do not get released unless I reboot! ... After a week or so there are about 5 -6 instances that do not get released Are you saying that this has been happening with a number of different versions of Declude? There have been a couple cases in the past where this could happen, but I'm not aware of any known issues with Declude 1.79 or higher that could cause this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SURBL issue
Title: Message My surbl setup has been running fine up till 1:00 am this morning my setup is: SURBL filter d:\IMail\Declude\surbl\surbl.txt x 200 In the log file I now get: Tue 09/07/2004 5:15p Update failed [conversion error] Nothing has changed in my setup and the log file has successful entries for a very long time until now Anyone have any ideas? thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2519-741-1222Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection- Computer hardware sales and service- Experienced website developers
RE: [Declude.JunkMail] SURBL issue
Following is my surbl settings, can you see anything wrong there?:
rem --- Settings (see explanation above): ---
set v_path=D:\IMail\Declude\SURBL
set v_limit=3000
set v_maxweight=20
set v_skipweight=20
set v_url=http://www.surbl.org/sc.surbl.org.rbldns
set v_exclude=test.surbl.org test.sc.surbl.org
surbl-org-permanent-test-point.com 2.0.0.127
Harry Vanderzand
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Tuesday, September 07, 2004 5:46 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] SURBL issue
It's working ok here just tried 2 minutes ago:
Tue 09/07/2004 4:41p Update successful [983 entries]
If it was a one time only thing, maybe you caught a bad
download or there was something bad in the zone.
A conversion error implies something wrong here:
rem --- Convert line breaks from LF to CRLF (or exit if
conversion failed): --- if exist todos.exe todos
surbl.rbldns.tmp for /f tokens=* %%c in ('findstr /r $
surbl.rbldns.tmp') do set v_result=ok if not
%v_result%==ok (set v_result=conversion error) (goto :s_end)
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 09/07/04 04:35PM
My surbl setup has been running fine up till 1:00 am this morning
my setup is:
SURBL filter d:\IMail\Declude\surbl\surbl.txt x 20 0
In the log file I now get:
Tue 09/07/2004 5:15p Update failed [conversion error]
Nothing has changed in my setup and the log file has
successful entries for a very long time until now
Anyone have any ideas?
thank you
Harry Vanderzand
inTown Internet Computer Services
11 Belmont Ave. W.
Kitchener, ON
N2M 1L2
519-741-1222
Did you know we offer:
- Province wide dial-up and high speed internet access
- Web accessible email with anti-spam\antivirus protection
- Computer hardware sales and service
- Experienced website developers
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be
found at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
[Declude.JunkMail] Test needed along with sniffer
I am testing sniffer right now and wonder if I need to run all the other tests along side it. I am trying to reduce my daily workload of analyzing the spamtrap and hope that sniffer and surbl will do this. Do I even need surbl? Any advice in this matter would be greatly appreciated. Thanks in advance Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test needed along with sniffer
I am getting service timeouts due mostly to all the declude instances of traffic volume I handle about 2 messages a day, most of them during business hours I find that I accumulate declude processes that have consumed up to a minute of cpu time only to be idle and just sit there This also causes accumulated memory to be consumed I have been rebooting this server about twice a week I have also been spending time everyday adding to my filter files The server is a dual Xeon 2.4Ghz, 533 frontside bus with an Intel SATA raid card running Raid 10 It has about 100 small web site that do not get much traffic My goal is to reduce management time of the machine and to stabilize it so the need to reboot it is lessened I am prepared to put in a dual Xeon 3.4GH, etc but also want to make sure that I do not overkill Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Wednesday, September 08, 2004 11:22 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Test needed along with sniffer I am testing sniffer right now and wonder if I need to run all the other tests along side it. I am trying to reduce my daily workload of analyzing the spamtrap and hope that sniffer and surbl will do this. Do I even need surbl? Do you have so much workload on your mailserver that you need to downsize your spam-filter to one or two tests? Maybe http://www2.spamchk.com/public.htm will give you some answer. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test needed along with sniffer
Title: Message thank you Matt, I am running 179i16 so I may have another issue at hand here I have 42k myfilter file with every entry set to anywhere which essentially does a similar thing that surbl is doing. I mine the web info from them manually everyday. I do it on my own account as my account attracts a tremendous amount of spam I guess because it has been around for 10 years. Whatever gets through to it after declude has been going into my filter file I have surbl running with its 35k file I have today eliminated my filter file and will likely eliminate surbl once I get the full version of sniffer going. So far I see no more going through as it is likely that surbl has been better at that process than me. I am starting to realize that these body filters are expensive in cpu cycles I will share what I learn from all this I appreciate your assistance. Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2519-741-1222Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection- Computer hardware sales and service- Experienced website developers -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Wednesday, September 08, 2004 3:56 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Test needed along with snifferHarry,Sniffer is a great addition to any Declude setup, however your issues are not due to just simply the size of your processors. We run a dual 1 GHz PIII system with RAID 5 and 5x10K Cheetahs, and we've managed to exceed 90,000 messages a day with dual virus scanners, and we could handle a bit more still. My thought is that you are either running a ton of BODY filters, a very slow virus scanner/scanners, or you are experiencing some form of I/O limitation. The idle processes also suggest that maybe there is an issue and an upgrade to a more recent version of Declude such as 1.79 or an interim release thereafter would be a good idea and most around here run them.You should be able to minimally do 10 times your current volume, so keep looking and keep describing your environment and a solution will likely come along.MattHarry Vanderzand wrote: I am getting service timeouts due mostly to all the declude instances of traffic volume I handle about 2 messages a day, most of them during business hours I find that I accumulate declude processes that have consumed up to a minute of cpu time only to be idle and just sit there This also causes accumulated memory to be consumed I have been rebooting this server about twice a week I have also been spending time everyday adding to my filter files The server is a dual Xeon 2.4Ghz, 533 frontside bus with an Intel SATA raid card running Raid 10 It has about 100 small web site that do not get much traffic My goal is to reduce management time of the machine and to stabilize it so the need to reboot it is lessened I am prepared to put in a dual Xeon 3.4GH, etc but also want to make sure that I do not overkill Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Markus Gufler Sent: Wednesday, September 08, 2004 11:22 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Test needed along with sniffer I am testing sniffer right now and wonder if I need to run all the other tests along side it. I am trying to reduce my daily workload of analyzing the "spamtrap" and hope that sniffer and surbl will do this. Do I even need surbl? Do you have so much workload on your mailserver that you need to downsize your spam-filter to one or two tests? Maybe http://www2.spamchk.com/public.htm will give you some answer. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] Test needed along with sniffer
Thank you very much. I will absorb this and share what I learn -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Wednesday, September 08, 2004 2:00 PM To: Harry Vanderzand Cc: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Test needed along with sniffer On Wednesday, September 8, 2004, 11:13:18 AM, Harry wrote: HV I am testing sniffer right now and wonder if I need to run all the HV other tests along side it. Well, you can probably get by without the other tests, but since you have Declude it would be MUCH better if you keep the other tests in place. Declude's strength is that it allows you to aggregate a variety of tests for greater accuracy. Sniffer is very, very good, but you will certainly see some benefit by using it along with other tests. HV I am trying to reduce my daily workload of analyzing the spamtrap HV and hope that sniffer and surbl will do this. Sniffer is perfect for that - particularly if you share your spamtrap data with us. Put another way, if you allow us to use your spamtrap then we will be taking over this work for you. All we need is POP3 account information and some details on how your spamtrap was formed so that we can properly classify it in our SPHUD (Spam Processing Heads Up Display). HV Do I even need surbl? Probably not. One of the AI elements in our robots crossreferences incoming spamtrap data with SURBL and other tests. More often than not we have the domain tagged before we see it in SURBL, and if we don't we grab it quickly. HV Any advice in this matter would be greatly appreciated. I recommend reviewing the Spam Test Quality Analysis: http://www2.spamchk.com/public.html You can use this to help tune your Declude configuration. I recommend applying the forumula: W = (a^2)100 Where (W) is the individual test weight (magnitude) based on test accuracy and (a) is the accuracy measured in the analysis (SA = spam-test accuracy, HA = ham-test accuracy). [ Regarding (magnitude), ham tests generate negative weights and spam tests generate positive weights. W will always be a positive value, so if you use an HA value for (a) then you will want to apply a negative W as your weight in Declude. ] For example, SNIFFER SA = 0.95, so W = ((0.95)^2)*100 = 90.25, Weight = 90. FIVETEN-SRC SA = 0.59, so W = ((0.59)^2)*100 = 34.81, Weight = 35. NOLEGITCONTENT HA=0.38, so W = ((0.38)^2)*100 = 14.44, Weight = -14 -- This test is measured when the test does not fail, so -14 must go in second weight column, not the first. If you use this analysis you should have your hold weight at or about 100. If you set your hold weight lower than 100, you will capture more spam at the risk of more false positives. If you set your hold weight higher than 100 you will have fewer false positives and more spam. !! This is research in progress - these formulas appear to work very well in preliminary testing. If you are already happy with your weighting system then you should probably stick with that until this theory has been tested further. !! We are developing a utility to do this work automatically. In the mean time, you can go through your test weights manually. You shouldn't have to do this frequently. Hope this helps, _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test needed along with sniffer
Thank you, I will try the report out. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of support Sent: Wednesday, September 08, 2004 4:06 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Test needed along with sniffer Harry, We have a utility to let you know how well a specific test does in our log parser (DLAnalyzer). The test is called the Test Breakdown Summary Report. Essentially you can pick a certain test(s) and see which other tests fail along with them. This report has helped us eliminate tests that performed the same as other tests. For example you can configure the report to summarize messages that failed Sniffer. It will than show you what other tests failed on messages that also failed Sniffer. You can get more granular by even excluding tests. For example: Show me which tests were triggered in conjunction with Sniffer, but did not fail XBL. Below is the link for a sample output from this report. http://www.invariantsystems.com/dlanalyzer/testsamples/TestSum maryBreakdownR eport.html In the above report you can see that out of all messages that failed the weight30 test 85% of them also failed SPAMCOP and 63% failed XBL.. Darrell -- -- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Harry Vanderzand writes: I am testing sniffer right now and wonder if I need to run all the other tests along side it. I am trying to reduce my daily workload of analyzing the spamtrap and hope that sniffer and surbl will do this. Do I even need surbl? Any advice in this matter would be greatly appreciated. Thanks in advance Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SMTP relay question
I have client who relay their mail thorough me As I am filtering their incoming mail for spam I have always assumed that I am filtering their outgoing mail also. Is the outgoing mail checked for spam automatically or is there a setting for that? I have just taken on another client with this setup and want to be confident in this Any help will be appreciated Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SMTP relay question
Just went through the manual on this and there is not much explanation I see the section in global.cfg for outgoing. It looks the same as the junkmail filters for users and domains. Is this section applicable to all outgoing mail? Can outgoing mail be filtered by domain? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, February 01, 2005 12:22 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] SMTP relay question If you have JM Pro and have the outgoing actions defined in your Global.CFG, then yes. Darin. - Original Message - From: Harry Vanderzand [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, February 01, 2005 12:17 PM Subject: [Declude.JunkMail] SMTP relay question I have client who relay their mail thorough me As I am filtering their incoming mail for spam I have always assumed that I am filtering their outgoing mail also. Is the outgoing mail checked for spam automatically or is there a setting for that? I have just taken on another client with this setup and want to be confident in this Any help will be appreciated Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Mailbox stats
Does anyone have any simple software to analyze the imail logs and for a domain give stats one number of mails in and out and a list of where mails are coming from and going to?. I have a customer asking for these kind of stats and I suspect there is something out there. Would rather not spend a lot of time and effort to achieve it however. Thanks Harry Vanderzand inTown Internet Computer Services --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Possible imail\declude issue
I have a complaint from a clinet of missing e-mails that have a record in his database but the e-mail was never received. Upon checking the logs I find entries as follows: 05:16 15:52 SMTPD(018600DC) [216.16.233.16] MAIL FROM: [EMAIL PROTECTED] 05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED] 05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED] When they should look like: 05:16 15:52 SMTPD(018600DC) [216.16.233.16] MAIL FROM: [EMAIL PROTECTED] 05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED] 05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED] 05:16 15:52 SMTPD(018600DC) [216.16.233.16] D:\IMail\spool\Df9e2018600dcce43.SMD 1604 The spool line is missing I cannot find any other clues as too what is happening here. Anybody have any ideas? We run i-mail 8.05, imail v1.82 and sniffer Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Sunday, May 15, 2005 11:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] German political spam I cloned the subject lines and added them in this format to help combat the bounces: BODY 150 CONTAINS SUBJECT: (marcus's subjects) - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, May 15, 2005 11:41 AM Subject: RE: [Declude.JunkMail] German political spam Ok, I've added all subject line patterns (my, Marc's Nicks and both Spamassassin cf-files) to one declude filter file. Please note that I've commented out h eise.de and s piegel.de body filter files and also that I usa a weight of 200. Markus --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Possible imail\declude issue
216.16.233.16 is a web site sending out orders to the mail server. There was a period of a day and a half when these orders were not received. In checking the log I found that there was a missing log. Any idea what may have caused it? Normally it all works fine Yes, John is right in correcting me. This would seem to indicate that the message wasn't fully received. Try tracerouting to 216.16.233.16 in order to see if something is dropping packets. It should automatically resend after a period of time if this is a normal mail server.MattJohn Tolmachoff (Lists) wrote: Incorrect. The missing line of the SMTPD log is a missing line, meaning either something interrupted the session or the lines are missing. Declude knows nothing of the message until after Imail SMTP service has received it in its entirety. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of MattSent: Monday, May 16, 2005 1:17 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Possible imail\declude issue Harry,That's what happens when Declude blocks an E-mail with an action like HOLD or DELETE, or it gets blocked or deleted in Declude Virus. You need to check your JunkMail and Virus logs to determine what happened.MattHarry Vanderzand wrote: I have a complaint from a clinet of missing e-mails that have a record inhis database but the e-mail was never received.Upon checking the logs I find entries as follows:05:16 15:52 SMTPD(018600DC) [216.16.233.16] MAIL FROM: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]When they should look like:05:16 15:52 SMTPD(018600DC) [216.16.233.16] MAIL FROM: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16]D:\IMail\spool\Df9e2018600dcce43.SMD 1604The spool line is missingI cannot find any other clues as too what is happening here.Anybody have any ideas?We run i-mail 8.05, imail v1.82 and snifferHarry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott FisherSent: Sunday, May 15, 2005 11:30 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] German political spamI cloned the subject lines and added them in this format to help combat thebounces:BODY 150 CONTAINS SUBJECT: (marcus's subjects)- Original Message -From: "Markus Gufler" [EMAIL PROTECTED]To: Declude.JunkMail@declude.comSent: Sunday, May 15, 2005 11:41 AMSubject: RE: [Declude.JunkMail] German political spam Ok, I've added all subject line patterns (my, Marc's Nicks and bothSpamassassin cf-files) to one declude filter file.Please note that I've commented out "h eise.de" and "s piegel.de" body filter files and also that I usa a weight of 200.Markus ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. -- =MailPure custom filters for Declude JunkMail Pro.http://www.mailpure.com/software/=-- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] Possible imail\declude issue
sorry I mistyped my last reply. an entry in the log is missing as per the example below Does that indicate the sender aborted the submission of the mail or what. I am trying to figure out why that happens It is like it is nor getting spooled or queued. What can cause this thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Tuesday, May 17, 2005 1:05 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Possible imail\declude issue Harry,The only thing that I know of that could delete a log in a normal setup would be manually configuring IMail's built in ISplCln.exe. http://support.ipswitch.com/kb/IM-19990629-DM06.htmAndrew posted some comments just a few days ago about a bug in an older versions of this: http://www.mail-archive.com/declude.junkmail@declude.com/msg22444.htmlIf you don't have this scheduled to run, then it isn't the issue.MattHarry Vanderzand wrote: 216.16.233.16 is a web site sending out orders to the mail server. There was a period of a day and a half when these orders were not received. In checking the log I found that there was a missing log. Any idea what may have caused it? Normally it all works fine Yes, John is right in correcting me. This would seem to indicate that the message wasn't fully received. Try tracerouting to 216.16.233.16 in order to see if something is dropping packets. It should automatically resend after a period of time if this is a normal mail server.MattJohn Tolmachoff (Lists) wrote: Incorrect. The missing line of the SMTPD log is a missing line, meaning either something interrupted the session or the lines are missing. Declude knows nothing of the message until after Imail SMTP service has received it in its entirety. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of MattSent: Monday, May 16, 2005 1:17 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Possible imail\declude issue Harry,That's what happens when Declude blocks an E-mail with an action like HOLD or DELETE, or it gets blocked or deleted in Declude Virus. You need to check your JunkMail and Virus logs to determine what happened.MattHarry Vanderzand wrote: I have a complaint from a clinet of missing e-mails that have a record inhis database but the e-mail was never received.Upon checking the logs I find entries as follows:05:16 15:52 SMTPD(018600DC) [216.16.233.16] MAIL FROM: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]When they should look like:05:16 15:52 SMTPD(018600DC) [216.16.233.16] MAIL FROM: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16]D:\IMail\spool\Df9e2018600dcce43.SMD 1604The spool line is missingI cannot find any other clues as too what is happening here.Anybody have any ideas?We run i-mail 8.05, imail v1.82 and snifferHarry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott FisherSent: Sunday, May 15, 2005 11:30 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] German political spamI cloned the subject lines and added them in this format to help combat thebounces:BODY 150 CONTAINS SUBJECT: (marcus's subjects)- Original Message -From: "Markus Gufler" [EMAIL PROTECTED]To: Declude.JunkMail@declude.comSent: Sunday, May 15, 2005 11:41 AMSubject: RE: [Declude.JunkMail] German political spam Ok, I've added all subject line patterns (my, Marc's Nicks and bothSpamassassin cf-files) to one declude filter file.Please note that I've commented out "h eise.de" and "s piegel.de" body filter files and also that I usa a weight of 200.Markus ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The a
[Declude.JunkMail] 3.05 upgrade
I have followed the following steps: Stop the Imail SMTP service Stop the Imail Queue Manager service. rename declude.exe to declude.old Perform the upgrade. Make sure the DecludeProc service is started. (it was not) Restart the Imail SMTP and Queue Manager service. Decludeproc service was not running and the mail accumulated in the proc directory. Had to revert back to the 2.06.16 version. My Imail is 8.05 What is going wrong here. This seemed really simple. Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] 3.05 upgrade
I had missed the cfg file creation. Got a call from Declude to assist me. Support was excellent and they got me going right away! Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)Sent: Monday, September 26, 2005 5:28 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05 upgrade Did you create the file declude.cfg in the imail\declude folder per instructions on the down load site? Look at the Windows Event log, any Decludeproc stops noted? John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Monday, September 26, 2005 2:24 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] 3.05 upgrade I have followed the following steps: Stop the Imail SMTP service Stop the Imail Queue Manager service. rename declude.exe to declude.old Perform the upgrade. Make sure the DecludeProc service is started. (it was not) Restart the Imail SMTP and Queue Manager service. Decludeproc service was not running and the mail accumulated in the proc directory. Had to revert back to the 2.06.16 version. My Imail is 8.05 What is going wrong here. This seemed really simple. Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
[Declude.JunkMail] 3.05.5 issues
I find that since being on the new version that more spam is slipping through. We have imail v8.05, declude and sniffer on win 2000 server dual xeon 3.4Ghz with 2Gb ram. Threads are set to 50 with no other setting in declude.cfg Any advice you can give me to tighten it to where we had it before? I have had several clients complaining Other than changing from V2.06.16 to 3.05 nothing else has changed on the server thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] 3.05.5 issues
thank you I was under the understanding given me by David from Declude that it was appropriate given the amount of power my hardware has. What would you recommend for my hardware? Thanks John, I always appreciate your active involvement in the list Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 12:11 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Your threads is way too high, and I suspect that there are time outs occurring and not all scanning is being done. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 6:17 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] 3.05.5 issues I find that since being on the new version that more spam is slipping through. We have imail v8.05, declude and sniffer on win 2000 server dual xeon 3.4Ghz with 2Gb ram. Threads are set to 50 with no other setting in declude.cfg Any advice you can give me to tighten it to where we had it before? I have had several clients complaining Other than changing from V2.06.16 to 3.05 nothing else has changed on the server thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] 3.05.5 issues
when I did that the machine get much busier so I set it back Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David BarkerSent: Tuesday, October 04, 2005 12:28 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Harrymake sure you are running message Sniffer in persistent mode. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 12:27 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues thank you I was under the understanding given me by David from Declude that it was appropriate given the amount of power my hardware has. What would you recommend for my hardware? Thanks John, I always appreciate your active involvement in the list Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 12:11 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Your threads is way too high, and I suspect that there are time outs occurring and not all scanning is being done. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 6:17 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] 3.05.5 issues I find that since being on the new version that more spam is slipping through. We have imail v8.05, declude and sniffer on win 2000 server dual xeon 3.4Ghz with 2Gb ram. Threads are set to 50 with no other setting in declude.cfg Any advice you can give me to tighten it to where we had it before? I have had several clients complaining Other than changing from V2.06.16 to 3.05 nothing else has changed on the server thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] 3.05.5 issues
I have got it down to 15 and tried to set sniffer back to persistent mode again However I find that with sniffer in persistent mode as David suggested, the proc directory starts back logging. which means the system is not keeping up with the flow of mail. Within 20 minutes I had 1400 files in the proc directory. I stopped the sniffer service and now it is gradually catching up. Any more suggestions as to what can get tuned? I appreciate the assistance Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 1:06 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Trial and error is best. Set it to some thing like 20 and watch what happens. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 9:27 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues thank you I was under the understanding given me by David from Declude that it was appropriate given the amount of power my hardware has. What would you recommend for my hardware? Thanks John, I always appreciate your active involvement in the list Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 12:11 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Your threads is way too high, and I suspect that there are time outs occurring and not all scanning is being done. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 6:17 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] 3.05.5 issues I find that since being on the new version that more spam is slipping through. We have imail v8.05, declude and sniffer on win 2000 server dual xeon 3.4Ghz with 2Gb ram. Threads are set to 50 with no other setting in declude.cfg Any advice you can give me to tighten it to where we had it before? I have had several clients complaining Other than changing from V2.06.16 to 3.05 nothing else has changed on the server thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [sniffer] [Declude.JunkMail] 3.05.5 issues
Thanks I will heed that advice Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 2:38 PMTo: Declude.JunkMail@declude.comSubject: FW: [sniffer] [Declude.JunkMail] 3.05.5 issues Did not notice the post I was responding to was sent to 2 lists. It is always best not to send a post to 2 lists at the same time. Create separate posts. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 11:07 AMTo: sniffer@SortMonster.comSubject: RE: [sniffer] [Declude.JunkMail] 3.05.5 issues Work on one thing at a time. Leave Sniffer in persistent mode and work on the threads. You have it at 15 now, and things are backing up. Turn it up to say 25 and see what happens. Also, are you running an heavy resource filters such as body filters? John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 10:45 AMTo: Declude.JunkMail@declude.comCc: sniffer@SortMonster.comSubject: RE: [sniffer] [Declude.JunkMail] 3.05.5 issues I have got it down to 15 and tried to set sniffer back to persistent mode again However I find that with sniffer in persistent mode as David suggested, the proc directory starts back logging. which means the system is not keeping up with the flow of mail. Within 20 minutes I had 1400 files in the proc directory. I stopped the sniffer service and now it is gradually catching up. Any more suggestions as to what can get tuned? I appreciate the assistance Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 1:06 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Trial and error is best. Set it to some thing like 20 and watch what happens. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 9:27 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues thank you I was under the understanding given me by David from Declude that it was appropriate given the amount of power my hardware has. What would you recommend for my hardware? Thanks John, I always appreciate your active involvement in the list Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 12:11 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Your threads is way too high, and I suspect that there are time outs occurring and not all scanning is being done. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 6:17 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] 3.05.5 issues I find that since being on the new version that more spam is slipping through. We have imail v8.05, declude and sniffer on win 2000 server dual xeon 3.4Ghz with 2Gb ram. Threads are set to 50 with no other setting in declude.cfg Any advice you can give me to tighten it to where we had it before? I have had several clients complaining Other than changing from V2.06.16 to 3.05 nothing else has changed on the server thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] 3.05.5 issues
Could you please tell me where one can find the archives? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin CoxSent: Tuesday, October 04, 2005 1:59 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] 3.05.5 issues Check the sniffer archives for the past month for a recent discussion of proper setup of sniffer in persistent mode. If it's not set up properly it will time out, which would result in the backup you saw. Darin. - Original Message - From: Harry Vanderzand To: Declude.JunkMail@declude.com Cc: sniffer@SortMonster.com Sent: Tuesday, October 04, 2005 1:45 PM Subject: RE: [Declude.JunkMail] 3.05.5 issues I have got it down to 15 and tried to set sniffer back to persistent mode again However I find that with sniffer in persistent mode as David suggested, the proc directory starts back logging. which means the system is not keeping up with the flow of mail. Within 20 minutes I had 1400 files in the proc directory. I stopped the sniffer service and now it is gradually catching up. Any more suggestions as to what can get tuned? I appreciate the assistance Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 1:06 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Trial and error is best. Set it to some thing like 20 and watch what happens. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 9:27 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues thank you I was under the understanding given me by David from Declude that it was appropriate given the amount of power my hardware has. What would you recommend for my hardware? Thanks John, I always appreciate your active involvement in the list Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 12:11 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Your threads is way too high, and I suspect that there are time outs occurring and not all scanning is being done. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 6:17 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] 3.05.5 issues I find that since being on the new version that more spam is slipping through. We have imail v8.05, declude and sniffer on win 2000 server dual xeon 3.4Ghz with 2Gb ram. Threads are set to 50 with no other setting in declude.cfg Any advice you can give me to tighten it to where we had it before? I have had several clients complaining Other than changing from V2.06.16 to 3.05 nothing else has changed on the server thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
[Declude.JunkMail] declude 3.05.5, Invuribl sniffer
=false / add key=URI_Senderbase_Magnitude_Threshold value=50 / add key=URI_Senderbase_Magnitude_Weight value=0 / !--Enables the checking of the remote mail servers IP address against Senderbase -- !--If the remote mail servers IP addresses daily magnitude exceeds the monthly magnitude -- !-- by the defined threshold the defined weight will be added (Beta 4)-- add key=Enable_RemoteMailServer_Senderbase_Magnitude_Check value=false / add key=RemoteMailServer_Senderbase_Magnitude_Threshold value=50 / add key=RemoteMailServer_Senderbase_Magnitude_Weight value=0 / /appSettings /configuration DECLUDE.CFG threads 20 waitformail 500 waitforthreads 1500 waitbetweenthreads 100 concatetelogsthreshold 10 concatetelogs Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] declude 3.05.5, Invuribl sniffer
Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Tuesday, October 11, 2005 11:15 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] declude 3.05.5, Invuribl sniffer A couple of quick suggestions: You are double-scoring here: SBL ip4rsbl-xbl.spamhaus.org * 28 0 SPAMHAUS ip4r sbl.spamhaus.org 127.0.0.2 25 0 The XBL wholly incorporates data from three highly-trusted DNSBL sources: - the CBL (Composite Block List) from cbl.abuseat.org - the BOPM (Blitzed Open Proxy Monitor) from opm.blitzed.org - the NJABL open proxy IPs list from www.njabl.org. and MAILPOLICE-BLOCK incorporates both of the mailpolice lists block.rhs.mailpolice.com - consolidated list of bulk-senders, pornographic, and fraud sites one less DNS call - Original Message - From: Harry Vanderzand [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, October 11, 2005 8:58 AM Subject: [Declude.JunkMail] declude 3.05.5, Invuribl sniffer I think I have finally got my server improved to the point where it is running smoothly and spam is getting caught to the level I have been used to. (If not better) It has been a combination of find the right declude.cfg settings for my hardware (dual xeon 3.4 ...) and also implementing Invuribl to catch this new wave of SPAM that came out at the same time we were all switching to 3.05.5. I set up the trial of invuribl and found it a worthwhile addition so I will be acquiring a licence. As Invuribl takes care of some of the tests that pre-existed in my global.cfg I would not mind seeing a global.cfg file that has been tuned for invuribl and sniffer. Sniffer is NOT running in persistent mode as that I cannot get going (everything starts backlogging) As I know many of you are into this tuning exercise I will include my varies setup files, global.cfg followed by invuribl.exe.config and declude.cfg. Any tuning assistance will be greatly appreciated. Thank you GLOBAL.CFG: # # Declude JunkMail configuration file # PIDDEBUG OFF CODE # The in the LOGFILE option gets replaced with the month/date with v1.11 and higher LOGFILE declude\dec.log LOGLEVELLOW HOP 0 #HOPHIGH 1 LOG_OK NONE # # Below are some advanced options # STOPPROCESSINGONFIRSTDELETEON CONSOLE OFF HIDETESTS CATCHALLMAILS IPNOTINMX NOLEGITCONTENT XSENDER ON XSPOOLNAME ON XINHEADER X-Note: Total spam weight of this E-mail is %WEIGHT%. XINHEADER X-Note: Spam Tests Failed: %TESTSFAILEDWITHWEIGHTS% XINHEADER X-Note: REMOTEIP: %REMOTEIP% XINHEADER X-Note: REVDNS: %REVDNS% XINHEADER X-Note: FROM: %MAILFROM% XINHEADER X-Note: TO: %RECIPHOST% XINHEADER X-Spam-Tests-Failed: %TESTSFAILED% [%WEIGHT%] XOUTHEADER X-Spam-Tests-Failed: %TESTSFAILED% [%WEIGHT%] #XINHEADER X-Country-Chain: %COUNTRYCHAIN% #XOUTHEADER X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. #IPBYPASS 127.0.0.1 #XOUTHEADER Organization: inTown Internet #WHITELIST HABEAS WHITELIST AUTH # # Definitions of the tests to use (do not edit unless you know what you are doing). # These must come before the actions. # # First is the name of the check, then the type of check (ip4r is a DNS lookup using # the reverse of the IP address). # # For type ip4r, 'matchstring' is the string to look for, or * for anything. # SPFFAIL spffail x x 3 0 AHBL ip4r dnsbl.ahbl.org * 5 0 DSBL ip4r list.dsbl.org * 8 0 ORDB ip4r relays.ordb.org * 5 0 SBL ip4rsbl-xbl.spamhaus.org * 28 0 SBBLip4rsbbl.they.com 127.0.0.240 SOLID ip4rdnsbl.solid.net 127.0.0.250 EASYNET-PROXIES ip4r proxies.blackholes.easynet.nl 127.0.0.2 7 0 SORBS-HTTP ip4r dnsbl.sorbs.net 127.0.0.2 8 0 SORBS-SOCKS ip4r dnsbl.sorbs.net 127.0.0.3 8 0 SORBS-MISC ip4r dnsbl.sorbs.net 127.0.0.4 8 0 SORBS-SMTP ip4r dnsbl.sorbs.net 127.0.0.5 7 0 SORBS-SPAM ip4r dnsbl.sorbs.net 127.0.0.6 7 0 SORBS-WEB ip4r dnsbl.sorbs.net 127.0.0.7 7 0 SORBS-BLOCK ip4r dnsbl.sorbs.net 127.0.0.8 7 0 SORBS-ZOMBIE ip4r dnsbl.sorbs.net 127.0.0.9 7 0 SORBS-DUHL ip4r dnsbl.sorbs.net 127.0.0.10 3 0 BONDEDSENDER ip4r query.bondedsender.org 127.0.0.10 -20 0 BOGUSMX rhsbl bogusmx.rfc-ignorant.org 127.0.0.8 50 DSBLMULTI ip4rmultihop.dsbl.org127.0.0.240 NJABL-DYNABLOCK ip4rdynablock.njabl.org 127.0.0.3 8 0 NJABL-RELAYS ip4rdnsbl.njabl.org 127.0.0.2 7 0 NJABL-DUL ip4rdnsbl.njabl.org 127.0.0.3 5 0N NJABL-MULTI ip4rdnsbl.njabl.org 127.0.0.5 7 0
RE: [Declude.JunkMail] Wondering about Declude 3.x
I see links for decludeproc3059.exe on the page Any clues as to how to install it? I execute it and nothing happens Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, October 20, 2005 12:44 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Wondering about Declude 3.x Yes the only change is the decludeproc.exe although in the full install now it has all the new configs and both SM and IM versions. I will put the links on the upgrade page for just the decludeproc.exe for SM and IM David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, October 20, 2005 12:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Wondering about Declude 3.x Will there be an update version or just a full install? The file looks to be 6 MB, and I bet the only change is the decludeproc.exe? - Original Message - From: David Barker [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, October 19, 2005 2:38 PM Subject: RE: [Declude.JunkMail] Wondering about Declude 3.x Planning to post 3.0.5.9 tomorrow. Fixes include COUNTRY and MAILFROM, improved installer, autoreview directory option, error directory for files not able to be moved, smartermail forward issue resolved etc. In general we have been pleased with the results - of the outstanding issues these seem to be isolated to a specific customer environments, and we are currently working to try replicate these. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, October 19, 2005 3:25 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Wondering about Declude 3.x I appreciate the others sharing their experiences, but I was also hoping that someone from Declude could comment on the current state, any known issues, and what the plans are related to bugs and/or tweaks to the newly introduced code. Thanks, Matt Matt wrote: Since things have been quite for some time, I just wanted to check up on what is happening with 3.x. The last that I heard, there were several people having issues with multi-processor systems. The thread settings also concern me in the way that they are being implemented. It appears from reports that these can greatly affect the performance of a system (and therefore it's stability/ability), and knowing how variable E-mail can be, I'm not sure that this is something that I would want to have hard coded on my system. I would hope that there would be another way to go about this. Right now I'm on 2.0.6.16 and have been for some time, but as bugs arise, and bug fixes are released, I would like to have the peace of mind to upgrade to the latest code, but I'm not sure that I have that yet. I know that the folks at Declude have been working long and hard at this for sometime now, and I don't want to disrespect that hard work, but I would appreciate an update on where things are, and where they are going as far as the service issues go. Thanks, Matt --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: New DNS Server
I appreciate this also I tried to run it but I do not have a boot file as my server is using the registry Is there a way to accommodate that? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave DohertySent: Thursday, October 20, 2005 3:21 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] OT: New DNS Server Hi Evans- I have a working script you can grab at http://skywaves.net/utils/dns_autosecondary.txt. Change a couple of vairables, save it, call it from the task scheduler, and you're done. Instructions are included. All are welcome to use it. -DaveDoherty Skywaves, Inc. - Original Message - From: Evans Martin To: Declude.JunkMail@declude.com Sent: Thursday, October 20, 2005 1:14 AM Subject: [Declude.JunkMail] OT: New DNS Server Im running Windows 2003 and MS DNS on my primary name server. Now I need to slave another server to it. What is the quickest way to transfer all of the domains from my old server to my new one and change them all from master to slave zones? Thanks, Evans Martin --- Evans L. MartinAIM: martek01http://www.martek.net [EMAIL PROTECTED]Fax: 615-523-1679Mobile: 615-533-0197
RE: [Declude.JunkMail] 30511 problem
Dual Xeon 3.4Ghz 2GB ram imail 8.05 declude, sniffer invurbl The issue is that without changing anything other than going to 3.05.11 this occurs It appears that processing has changed If I could get some idea from Declude about this. Maybe I have to change my declude.cfg? It currently is threads 20 waitformail 500 waitforthreads 1500 waitbetweenthreads 100 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent: Monday, October 24, 2005 1:30 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Interesting ... .11 is working for me better than any previous version -- proc and work are quickly cleared. What process is jumping the CPU up so high? Decludeproc or the anti-virus scanner(s) or something else? How about some more info (CPU, RAM, declude.cfg contents, do you run AVAFTERJM?, that kind of thing.) John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Monday, October 24, 2005 12:10 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] 30511 problem When I switch from 3.05.9 to 3.05.11 CPU usage goes up considerably and mail gets processed much slower and starts to backlog. I have had to switch back to 3.05.9 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 30511 problem
It works better but also changes the behaviour somewhat. The way I had it, it continuously kept the proc directory empty because once threads were available it brought mail into the work directory Now it does start more threads as they are available. I like the behaviour the way it was Can this be achieved again? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Monday, October 24, 2005 1:55 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Harry, try commenting out #waitforthreads 1500 #waitbetweenthreads 100 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Monday, October 24, 2005 1:52 PM To: Declude.JunkMail@declude.com Cc: 'Technical Support' Subject: RE: [Declude.JunkMail] 30511 problem Dual Xeon 3.4Ghz 2GB ram imail 8.05 declude, sniffer invurbl The issue is that without changing anything other than going to 3.05.11 this occurs It appears that processing has changed If I could get some idea from Declude about this. Maybe I have to change my declude.cfg? It currently is threads 20 waitformail 500 waitforthreads 1500 waitbetweenthreads 100 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent: Monday, October 24, 2005 1:30 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Interesting ... .11 is working for me better than any previous version -- proc and work are quickly cleared. What process is jumping the CPU up so high? Decludeproc or the anti-virus scanner(s) or something else? How about some more info (CPU, RAM, declude.cfg contents, do you run AVAFTERJM?, that kind of thing.) John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Monday, October 24, 2005 12:10 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] 30511 problem When I switch from 3.05.9 to 3.05.11 CPU usage goes up considerably and mail gets processed much slower and starts to backlog. I have had to switch back to 3.05.9 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 30511 problem
You would think but remember that all I did was change from V9 to V11 and behaviour changed. Threads @ 150 just does not work. It took a long time of experimenting with settings to reach 25 which worked well Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent: Monday, October 24, 2005 4:36 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Someone correct me, but with 3.4GHz couldn't you try THREADS 150 and back down from there if needed? Wouldn't that help some? From http://www.declude.com/Articles.asp?ID=167 Performance can vary due to server configuration, CPU load, available memory, email traffic, the suggested THREADS is 25 per 1 GHZ CPU. To find peak performance increase your threads so that your CPU usage bounces to the 100% mark and down again. If your CPU is pegged at 100% try reduce the threads by increments of 5 each time till you see the desired result. John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Monday, October 24, 2005 3:00 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem It works better but also changes the behaviour somewhat. The way I had it, it continuously kept the proc directory empty because once threads were available it brought mail into the work directory Now it does start more threads as they are available. I like the behaviour the way it was Can this be achieved again? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Monday, October 24, 2005 1:55 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Harry, try commenting out #waitforthreads 1500 #waitbetweenthreads 100 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Monday, October 24, 2005 1:52 PM To: Declude.JunkMail@declude.com Cc: 'Technical Support' Subject: RE: [Declude.JunkMail] 30511 problem Dual Xeon 3.4Ghz 2GB ram imail 8.05 declude, sniffer invurbl The issue is that without changing anything other than going to 3.05.11 this occurs It appears that processing has changed If I could get some idea from Declude about this. Maybe I have to change my declude.cfg? It currently is threads 20 waitformail 500 waitforthreads 1500 waitbetweenthreads 100 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent: Monday, October 24, 2005 1:30 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Interesting ... .11 is working for me better than any previous version -- proc and work are quickly cleared. What process is jumping the CPU up so high? Decludeproc or the anti-virus scanner(s) or something else? How about some more info (CPU, RAM, declude.cfg contents, do you run AVAFTERJM?, that kind of thing.) John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Monday, October 24, 2005 12:10 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] 30511 problem When I switch from 3.05.9 to 3.05.11 CPU usage goes up considerably and mail gets processed much slower and starts to backlog. I have had to switch back to 3.05.9 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
RE: [Declude.JunkMail] 30511 problem
I guess I can start retuning all over again but I am concerned about why this is occurring Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Monday, October 24, 2005 4:40 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Yes, again the ideal is that the CPU usage bounces, So you could start at 150 then if it pegged at 100% CPU try 125 etc. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent: Monday, October 24, 2005 4:36 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Someone correct me, but with 3.4GHz couldn't you try THREADS 150 and back down from there if needed? Wouldn't that help some? From http://www.declude.com/Articles.asp?ID=167 Performance can vary due to server configuration, CPU load, available memory, email traffic, the suggested THREADS is 25 per 1 GHZ CPU. To find peak performance increase your threads so that your CPU usage bounces to the 100% mark and down again. If your CPU is pegged at 100% try reduce the threads by increments of 5 each time till you see the desired result. John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Monday, October 24, 2005 3:00 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem It works better but also changes the behaviour somewhat. The way I had it, it continuously kept the proc directory empty because once threads were available it brought mail into the work directory Now it does start more threads as they are available. I like the behaviour the way it was Can this be achieved again? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Monday, October 24, 2005 1:55 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Harry, try commenting out #waitforthreads 1500 #waitbetweenthreads 100 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Monday, October 24, 2005 1:52 PM To: Declude.JunkMail@declude.com Cc: 'Technical Support' Subject: RE: [Declude.JunkMail] 30511 problem Dual Xeon 3.4Ghz 2GB ram imail 8.05 declude, sniffer invurbl The issue is that without changing anything other than going to 3.05.11 this occurs It appears that processing has changed If I could get some idea from Declude about this. Maybe I have to change my declude.cfg? It currently is threads 20 waitformail 500 waitforthreads 1500 waitbetweenthreads 100 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent: Monday, October 24, 2005 1:30 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Interesting ... .11 is working for me better than any previous version -- proc and work are quickly cleared. What process is jumping the CPU up so high? Decludeproc or the anti-virus scanner(s) or something else? How about some more info (CPU, RAM, declude.cfg contents, do you run AVAFTERJM?, that kind of thing.) John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Monday, October 24, 2005 12:10 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] 30511 problem When I switch from 3.05.9 to 3.05.11 CPU usage goes up considerably and mail gets processed much slower and starts to backlog. I have had to switch back to 3.05.9 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail
RE: [Declude.JunkMail] 30511 problem
It seems to me that something changed in the code If all I do is change from V9 to V11 and I see a noticeable difference, then it has to be caused by a change in the code from V9 to V11. No other hardware or software was changed!!! I have gotten direction to change settings, however that in no way addresses the point I am making. I have not seen that addressed. Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Tuesday, October 25, 2005 2:33 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Okay, I'm watching these discussions - as I'm still truly scared of upgrading Declude. I just can't figure out the logic behind all the CPU consumption and why certain process parameters are suspected to have detrimental effects. Please verify my thinking: A machine that needs to process a given amount of mail will require a certain number of instructions, which are reflected in the total CPU usage. If several messages come in almost simultaneously, then I can either process them right away using parallel processes, causing a short spike in CPU use - or I can process them one by one, using up the same CPU time over time and causing a few seconds delay in mail delivery. Either way, the overall CPU consumption should be the same - just distributed differently. So - if the above is true, how do I explain the apparent inconsistency where users report that the CPU consumption is considerable higher than in the prior version? How can the various process settings make any difference - at worst it should spike quickly and then be idle? If the old Declude handled the amount of mail with moderate CPU use and without causing noticeable delays in mail delivery to the users - then I can't see how the same outcome suddenly should require x times the CPU resources, no matter how inefficient the process settings are? What is spending all this other CPU time on? Looping, looking for directory content? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net Webmaster Sent: Tuesday, October 25, 2005 10:13 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem I changed the THREADS to 75 and CPU wnet down to about avg 50%. I'll try WAITFORMAIL in just a bit. I also noticed in my spool folder I have a new folder called s that appeared with the time stamp of the new proc install. There is nothing in it; just a blank folder. I deleted it. Sincerely, Randy Armbrecht Global Web Solutions, Inc. 804-346-5300 x112 877-800-GLOBAL (4562) x112 http://globalweb.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, October 25, 2005 9:39 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Randy try changing WAITFORMAIL 1500 To WAITFORMAIL 500 See if that changes the delay. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net Webmaster Sent: Monday, October 24, 2005 7:16 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem We upgraded to 3.0.5.11 tonight - big difference in CPU in that it's way down from the 3.0.5.5 - but proc folder will accumulate approx 35-50 messages before it'll dump them to the work folder. Do not see any problems so far except for the second or two delay in this... We have in our declude.cfg: THREADS 50 WAITFORMAIL 1500 WAITFORTHREADS 1000 WAITBETWEENTHREADS1 Sincerely, Randy Armbrecht Global Web Solutions, Inc. 804-346-5300 x112 877-800-GLOBAL (4562) x112 http://globalweb.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Monday, October 24, 2005 1:52 PM To: Declude.JunkMail@declude.com Cc: 'Technical Support' Subject: RE: [Declude.JunkMail] 30511 problem Dual Xeon 3.4Ghz 2GB ram imail 8.05 declude, sniffer invurbl The issue is that without changing anything other than going to 3.05.11 this occurs It appears that processing has changed If I could get some idea from Declude about this. Maybe I have to change my declude.cfg? It currently is threads 20 waitformail 500 waitforthreads 1500 waitbetweenthreads 100 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent
RE: [Declude.JunkMail] 30511 problem
I have repeatedly switch back and forth between the two version (V9 and V11) I assure that I have changed nothing else and that cpu usage is higher on the V11 I watch V9 cpu usage I go from V9 to V11 and cpu usage increases Back to V9: it goes down Back to V11 it goes up. How else does one state this problem? It would make a lot of sense if Declude were to say that they have made a change in the code that would cause this, but that is not the case. Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, October 25, 2005 4:14 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Andy, don't be scared I can hold you hand :) How do I explain the apparent inconsistency where users report that the CPU consumption is considerable higher than in the prior version? First we need to confirm that it is decludeproc that has increased in CPU usage. So far I have not seen any real statistics for this other than what has been posted on the boards. But I am certainly trying to validate this information. How can the various process settings make any difference - at worst it should spike quickly and then be idle? Why do you think it should spike and then become idle ? What is spending all this other CPU time on? Looping, looking for directory content? Perhaps an incorrect assumption, Declude actually uses less CPU, between 3% and 20% on average. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Tuesday, October 25, 2005 2:33 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Okay, I'm watching these discussions - as I'm still truly scared of upgrading Declude. I just can't figure out the logic behind all the CPU consumption and why certain process parameters are suspected to have detrimental effects. Please verify my thinking: A machine that needs to process a given amount of mail will require a certain number of instructions, which are reflected in the total CPU usage. If several messages come in almost simultaneously, then I can either process them right away using parallel processes, causing a short spike in CPU use - or I can process them one by one, using up the same CPU time over time and causing a few seconds delay in mail delivery. Either way, the overall CPU consumption should be the same - just distributed differently. So - if the above is true, how do I explain the apparent inconsistency where users report that the CPU consumption is considerable higher than in the prior version? How can the various process settings make any difference - at worst it should spike quickly and then be idle? If the old Declude handled the amount of mail with moderate CPU use and without causing noticeable delays in mail delivery to the users - then I can't see how the same outcome suddenly should require x times the CPU resources, no matter how inefficient the process settings are? What is spending all this other CPU time on? Looping, looking for directory content? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net Webmaster Sent: Tuesday, October 25, 2005 10:13 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem I changed the THREADS to 75 and CPU wnet down to about avg 50%. I'll try WAITFORMAIL in just a bit. I also noticed in my spool folder I have a new folder called s that appeared with the time stamp of the new proc install. There is nothing in it; just a blank folder. I deleted it. Sincerely, Randy Armbrecht Global Web Solutions, Inc. 804-346-5300 x112 877-800-GLOBAL (4562) x112 http://globalweb.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, October 25, 2005 9:39 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Randy try changing WAITFORMAIL 1500 To WAITFORMAIL 500 See if that changes the delay. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net Webmaster Sent: Monday, October 24, 2005 7:16 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem We upgraded to 3.0.5.11 tonight - big difference in CPU in that it's way down from the 3.0.5.5 - but proc folder will accumulate approx 35-50 messages before it'll dump them to the work folder. Do not see any problems so far except for the second or two delay
[Declude.JunkMail] V3.05.14 issue
I was just checking my declude directories and found mail sitting in the review directory. 95 pieces with varying times since my update to 30514 yesterday. When I put them back into the proc directory the system slowed down and they ended up back in the review directory eventually. I then reverted to 30509, put the mail back into the proc directory and everything got processed fine. I then reverted back to 30514 and watched the flow of mail and again mail started collecting in the review directory. I have gone back to 30509 till there is a resolution for this Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] V3.05.14 issue
The problems I reported below in 3.05.14 are now corrected in 3.05.18 I installed it Saturday AM and it has run fine since then Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Tuesday, November 01, 2005 12:23 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] V3.05.14 issue I was just checking my declude directories and found mail sitting in the review directory. 95 pieces with varying times since my update to 30514 yesterday. When I put them back into the proc directory the system slowed down and they ended up back in the review directory eventually. I then reverted to 30509, put the mail back into the proc directory and everything got processed fine. I then reverted back to 30514 and watched the flow of mail and again mail started collecting in the review directory. I have gone back to 30509 till there is a resolution for this Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Cryptic URL in source
When the URL is hidden with cryptic characters in the source code of an e-mail it seems to me that it is obviously not a legitimate e-mail in that deception is being used. Is there not an easy way to stop e-mail where these practises are being used? I am running imail 8.21 and declude 3.05.18, the latest sniffer and Invuribl Assistance is appreciated Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Cryptic URL in source
Yes that would work. However I want a method that traps all mail that uses this deceptive practice. Is there no way to detect this trick? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Wednesday, November 09, 2005 5:28 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Cryptic URL in source No problem. BODY 500contains google.com/url?q= -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Glenn \ WCNet Sent: Wednesday, November 09, 2005 4:20 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Cryptic URL in source I've been getting reports of that from customers all day. G.Z. - Original Message - From: Harry Vanderzand [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, November 09, 2005 4:05 PM Subject: RE: [Declude.JunkMail] Cryptic URL in source Certainly Here is what you see in the e-mail http://intown.net/HwSbgXkc9vYP4qssBQS0AK6bumsUuatFHAdxX6IZ8vk0 Here is what is in the source: href=http://www.google.com/url?q=http://www.google.com/url?q=http://% 73%5 4% 41%09Nd%09%7aA.n%09e%74/%63%67i- b%09%69n%09/%70%6fch/%72e%09di%72.%63g%69?s= intown.nethttp://intown.net/HwSbgXkc9vYP4qssBQS0AK6bumsUuatFHAdxX6IZ 8vk0 / a Not that different from some of the phishing e-mails This has got to be detectable and should be cause for immediate deletion. Who has legitimate cause to hide their identity? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Wednesday, November 09, 2005 4:40 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Cryptic URL in source Do you have an example? - Original Message - From: Harry Vanderzand [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, November 09, 2005 10:18 AM Subject: RE: [Declude.JunkMail] Cryptic URL in source Any ideas on this? When the URL is hidden with cryptic characters in the source code of an e-mail it seems to me that it is obviously not a legitimate e-mail in that deception is being used. Is there not an easy way to stop e-mail where these practises are being used? I am running imail 8.21 and declude 3.05.18, the latest sniffer and Invuribl Assistance is appreciated Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] outgoing mail declude junkmail
Travis what you have there is the rule defined Now you need to have an action IE Weight10hold Weight20delete By the way you make it confusing by saying weight10 is a hold at 16. Why not call it weight16? That is still the difficulty with Declude. A whole language needs to be learned. It will be nice if this ever joins the GUI world Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Travis Sullivan Sent: Friday, November 18, 2005 1:05 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] outgoing mail declude junkmail WEIGHT10 weight x x 16 0 WEIGHT20 weight x x 20 0 That is what I have at the bottom of mine... 16 is my hold weight, 20 is delete. What do I use for outgoing mail actions? Travis - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:01 PM Subject: Re: [Declude.JunkMail] Imail 2006 standalone Yes, and those actions are defined in your global.cfg at the bottom. Darrell -- -- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Travis Sullivan writes: Okay, it was simple I didn't have any XOUTHEADER specified in the global.cfg so declude is scanning outgoing mail. but, i noticed the score was 17, one point above my hold weight... is there different actions for outgoing mail as in hold/delete? Travis - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 11:19 AM Subject: Re: [Declude.JunkMail] Imail 2006 standalone It's pretty simple. take all of the actions you have defined in your $default$.config and copy them to your global.cfg. Actions placed in the Global.cfg apply to outgoing scanning. Actions in the $default$.config apply to incoming scanning. Darin. - Original Message - From: Travis Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:03 PM Subject: Re: [Declude.JunkMail] Imail 2006 standalone I searched, not a lot to be honest, the archive, and manual, but couldn't find info on setting up outgoing mail scanning with declude pro 1.82. Does anyone have a primer or at least some notes to share with me? TIA Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] CBL:Fw: news
We have it blocked with the following tests X-Note: Total spam weight of this E-mail is 25.X-Note: Spam Tests Failed: SORBS-DUHL [4], NJABL-DYNABLOCK [9], FIVETEN-SPAM [5], CMDSPACE [7], WEIGHT10 [10], WEIGHT11 [11], WEIGHT12 [12], WEIGHT15 [15], WEIGHT19 [19] Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard FarrisSent: Tuesday, December 06, 2005 2:25 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] CBL:Fw: news Does anyone have an answer to filter these type emails? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet" - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 06, 2005 3:20 AM Subject: news
[Declude.JunkMail] Decludeproc terminating unexpectedly
I have a situation where the decludeproc service terminates unexpectedly. It restarts, but I am concerned in that the system is not stable. Several messages are left in the review directory when this happens. Shortly after one of the decludeproc restarts this morning the SMTP service stopped and did NOT restart. The event log had the following error: The description for Event ID ( 0 ) in Source ( SMTPd32 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: SMTPd32 error: 231, ERR 004 - Failed to create server Pipe.. This has happened a few times since going to imail V8.22 from 8.05. Should I install imail 2006? I have it but am holding off as I fear more problems if I am an early adopter. Any ideas? Imail V8.22, declude pro, sniffer, invuirbl Dual xeon 3.4Ghz, 2GB ram Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Decludeproc terminating unexpectedly
Sorry 3.05.22 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Tuesday, December 13, 2005 12:37 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Decludeproc terminating unexpectedly What version of Declude? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Tuesday, December 13, 2005 9:31 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Decludeproc terminating unexpectedly I have a situation where the decludeproc service terminates unexpectedly. It restarts, but I am concerned in that the system is not stable. Several messages are left in the review directory when this happens. Shortly after one of the decludeproc restarts this morning the SMTP service stopped and did NOT restart. The event log had the following error: The description for Event ID ( 0 ) in Source ( SMTPd32 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: SMTPd32 error: 231, ERR 004 - Failed to create server Pipe.. This has happened a few times since going to imail V8.22 from 8.05. Should I install imail 2006? I have it but am holding off as I fear more problems if I am an early adopter. Any ideas? Imail V8.22, declude pro, sniffer, invuirbl Dual xeon 3.4Ghz, 2GB ram Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] What can be done with undelivery receipts?
With the increase of undelivery receipts caused by spam using spoofed addresses of my clients, is there any way to more effectively catch those receipts? We are using imail 8.22 and the latest versions of declude pro, sniffer and invuribl Harry Vanderzand inTown Internet Computer Services 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Samuel J Stanaitis Sent: Wednesday, December 28, 2005 9:23 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] DSPAM with Declude? Good Morning, Folks I've had a recent onslaught of emails completely blowing past Declude. They're the typical winky improvement pill ads, coming from random sources, random names, random email addresses. First line of the email is a random URL, followed by cryptic spellings of the various winky pills. I've fed dozens to SpamAssassin with no luck. I've heard good reviews of DSPAM (dspam.nuclearelephant.com) and would like to incorporate it into Declude. Has anyone done this yet? I searched the archives and have had no luck. Any tips? Thanks, Sam Samuel J Stanaitis, Network Administrator Decorative Product Source, Inc. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SMTP failure
I get the following error about once a week since upgrading to V8.22 from 8.05. This error occurs twice in a row and then the SMTP service remains in a stopped state. I can manually restart it. The recovery settings for the service are set to restart. I have worked with Ipswitch on this issue and they have no answer for me. Apparently a more senior person is looking at it although I am not sure if that is true. Does anyone have any ideas as to the cause of this. The mail is down off course when this happens so It is rather irritating. Especially over the holiday time. System Log error: The description for Event ID ( 0 ) in Source ( SMTPd32 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: SMTPd32 error: 231, ERR 004 - Failed to create server Pipe.. Harry Vanderzand inTown Internet Computer Services 519-741-1222 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam leak?
Yes, I did Harry Vanderzand inTown Internet Computer Services 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Friday, January 13, 2006 8:48 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Spam leak? Ummm... Did anybody else get a piece of spam this morning with subject SPAMSPCE: that seems to have been relayed through Declude.com? -Dave Doherty Skywaves, Inc. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude v3 CPU usage and processing speed
I have a similar machine, generally running well My declude.cfg is: threads 75 waitformail 0 waitforthreads 25 waitbetweenthreads 100 winsockcleanup off Harry Vanderzand inTown Internet Computer Services 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Friday, January 13, 2006 10:11 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude v3 CPU usage and processing speed I have worked with customers with similar Dual-Xeon CPU setup and have seen processing of 1000+ emails per minute. We have two of this machines here. It has exactly the same config from the screw who hold the server in the rack up to each dot in the junkmail config file (except the license codes ;-) The first server seems processing messages faster then the second. On the second server the more I play with values the lower CPU-usage and processing goes. After each reboot of decludeproc it's going down a little bit. Neither a reboot solved the problem. When I block incomming SMTP-traffic on the second server it will process around 50 messages per minute by showing up an average CPU usage way below of 50% (currently 20%) 1. What is your THREADS in the Declude.cfg ? Everything from 5 up to 500 2. Are you running many large filters ? I've tried enabling und disabling many filters without any noticeable change. But large filters should create a large cpu-usage. 3. How many virus scanners are you running ? Usualy two but I've also disabled the second for testing without any result 4. Is hyperthreading turned ON or OFF ? Yes task manager is showing up 4 cpu's 5. Are you using any other Directives in your declude.cfg ? Beside THREADS I've currently in use WAITFORMAIL 5000 WINSOCKCLEANUP ON I've tried changing WAITFORMAIL up to 15000 ms as suggested by another v3 Admin and I've also tried adding WAITFORTHREADS1500 WAITBETWEENTHREADS 1 With values from 150 .. 1500 and 1 .. 1000 without any noticeable change in the task manager cpu usage. The number of queue files in the proc folder is going up and down (something between 1000 and 12000 files) The server is working and delivery messages but only with 50% of his power and speed. Netstat is showing around 100 ETSABLISHED connections and around 50 in TIME_WAIT The process list in the task manager is showing up around 50 entries Markus --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Sniffer in Persistent Mode using Windows Resource Kit Tools
I am confused with step 6 6. Next Add a Value and type this information Value Name:Application Data Type: REG_SZ (String) String: [full path of your sniffer installation]\snfrv2r3.exe xnk05x5vmipeaof7 persistent What is the Value name??? Thank you Harry Vanderzand inTown Internet Computer Services 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Panda Consulting S.A. Luis Alberto Arango Sent: Wednesday, January 18, 2006 7:15 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Sniffer in Persistent Mode using Windows Resource Kit Tools Here is another method to install sniffer in persistent mode. I just want to share it with you and others out there. I hope it is useful. I am not sure if there is information about how to install persistent mode using the windows resource kit tools in this list. So I decided to post it just in case. I have tested for a week and it works fine for me under Windows 2003 I switched to it, since RunSvcExe started to show some errors in my event viewer ==Sniffer in Persistent Mode Using Windows Resource Kit Tools== 1. Create a directory in C: called for example reskit c:\reskit 2. Place the following windows NT/2000/2003 windows resource kit files (they are free). Download the kit from microsoft.com instsrv.exe srvany.exe 3. Run the following command line c:\reskit\instsrv.exe Declude Sniffer c:\reskit\Srvany.exe that will set a service under the name Declude Sniffer 4. Open your registry and look for the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Declude Sniffer 5. Then add a key and name it Parameters 6. Next Add a Value and type this information Value Name:Application Data Type: REG_SZ (String) String: [full path of your sniffer installation]\snfrv2r3.exe xnk05x5vmipeaof7 persistent Note for licensed users: replace snfrv2re.exe with your licenced sniffer application name and xnk05x5vmipeaof7 with the licenced code. 7. In your Services Manager locate the service named Declude Sniffer and start it. 8. Set the Startup Type to Automatic. You are set to go. TO REMOVE THE SERVICE--- if you want to remove the service just type the following command line c:\reskit\instsrv.exe Declude Sniffer REMOVE -Luis Arango __ [Email scanned for viruses] [Email escaneado contra virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT - Server Watching.
Whatsup gold by ipswitch Harry Vanderzand inTown Internet Computer Services 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jerod M. Bennett Sent: Monday, January 23, 2006 2:25 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT - Server Watching. Hey, I know this is off topic, but I respect the knowledge and opinions of the people on this list. What software / services do you guys use to watch your servers for up/down status? -Jerry --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 3.0 / 4.0
Where do I find this information. I logged on the your site and don't see any on the my account page. I realize it must be obvious to you but it is not to me. Can you please let me know where this information is? Thank you Harry Vanderzand inTown Internet Computer Services 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Barry Simpson Sent: Sunday, February 12, 2006 10:22 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude 3.0 / 4.0 Each customer has a price on their host record which reflects their individual special price. This is confidential for each customer and I will not be posting details on a public forum. We are currently developing some documentation that should be published next week outlining changes and future strategy. As soon as this is available we will inform our customers. Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Sunday, February 12, 2006 10:03 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 3.0 / 4.0 I misspoke... switch SA for upgrade. Also, please answer the implicit questions at the end of the email as well. Thanks, Darin. - Original Message - From: Barry Simpson [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, February 12, 2006 9:54 AM Subject: RE: [Declude.JunkMail] Declude 3.0 / 4.0 Darin, The Service Agreement prices have not changed: JunkMail - $132.00 per year EVA - $132.00 per year HiJack - $45.00 per year Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Sunday, February 12, 2006 9:36 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 3.0 / 4.0 Hi David, What I was trying to get was an actual price matrix. For example, 1. What is the price of an SA when the existing customer has JM Pro and EVA Pro? 2. What is the price of an SA when the existing customer has JM Pro and EVA Standard? 3. What is the price of an SA when the existing customer has JM Pro and EVA Lite? 4. What is the price of an SA when the existing customer has JM Standard and EVA Pro? 5. What is the price of an SA when the existing customer has JM Standard and EVA Standard? 6. What is the price of an SA when the existing customer has JM Standard and EVA Lite? 7. What is the price of an SA when the existing customer has JM Lite and EVA Pro? 8. What is the price of an SA when the existing customer has JM Lite and EVA Standard? 9. What is the price of an SA when the existing customer has JM Lite and EVA Lite? 10. What is the price of an SA when the existing customer has JM Pro only? 11. What is the price of an SA when the existing customer has JM Standard only? 12. What is the price of an SA when the existing customer has JM Lite only? 13. What is the price of an SA when the existing customer has EVA Pro only? 14. What is the price of an SA when the existing customer has EVA Standard only? 15. What is the price of an SA when the existing customer has EVA Lite only? This could be easily displayed as a 4x4 price matrix. Posting it here, or perhaps posting a link to where it's posted on your website, will save you a lot of phone calls and time. I think a lot of the confusion stems from calling the upcoming release version 4. If the functionality will always remain the same between 3 and 4, then calling it a bundled service that is licensed differently than the separately purchased products would be much more clear than calling it a separate version. If the functionality is going to change between 3 and 4, then we need to know when and what, and how it affects previous customers. I know you've stated there is no major difference now, but everyone is concerned not just about now, but about the future functionality, costs, and direction of the product. Darin. - Original Message - From: David Barker [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, February 11, 2006 11:29 PM Subject: RE: [Declude.JunkMail] Declude 3.0 / 4.0 Darin, If you have JM Pro EVA PRO Hijack you can choose if you want to run version 3 or version 4 in either case the SA applies as in point 2. 2. Existing Customers prior to 8 Feb 06 CAN continue using the Service Agreement model. This mean you purchase a Annual Service agreement to ensure support and having access to new releases of Declude for that year. If your Service Agreement lapses you are still able to run Declude you will just not have access to support or new releases. If you do NOT have JM Pro EVA PRO Hijack and choose not to upgrade ... then you remain with version 3 as version 4 is licensed for JM Pro EVA PRO Hijack as I have explained
RE: [Declude.JunkMail] Declude 3.0 / 4.0
You guys go on and on. Have you actually talked to Declude? There are no changes for you if you do not want them. And Moving to V4 is easy. You must have a lot of time to waste, fret and worry. If you would only communicate with them. I realize there have been misunderstandings and some mail was not received by many. Give them a break. All your demand are not appropriate on this list. YI am amazed with the time you spend on conjecture and assumptions that just do not have any foundation. I have discussed and clarified things with Declude and am totally satisfied. The sky is not falling! Harry Vanderzand inTown Internet Computer Services 519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Sunday, February 12, 2006 3:10 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Declude 3.0 / 4.0 Barry,Before you publish your future strategy, you should take a lot more time to consider the willingness of your customers to come along. I have never heard of a similar piece of software that expires in this way, and effectively forces a customer to renew their license. The only things that are remotely close are Microsoft products which are sold a different way for volume licensing, but they offer these subscriptions at a price that is just a fraction of the full product price, they are generally considered to be discounted by the companies purchasing them, and the choice is optional to choose the subscription or the standard purchase. That is clearly not the case here.Declude is not a service, it's a piece of software, and I expect to pay for software the way that software is paid for. I will never pay an annual license to use such a piece of software. Never. Especially when that piece of software requires me to pay for multiple other products in order to have acceptable protection, and work many long hours in developing plug-ins to enhance functionality that doesn't exist in the product itself. The strength of Declude is it's flexibility as a framework, but not as a solution in itself. There is a major disconnect between your perception of the market, and what I an others on this end see.While this model might seem appealing to you, it is grossly uncompetitive, and it comes at an incredibly inopportune time. We as a community have been mostly understanding of the disruption associated with the change of ownership, but up to this point there has been only small advancements in the product that benefit us. With the exception of one piece of added functionality, I could still be using the same release that I was using two years ago when you took over the company. Whether or not it is apparent to you, it is very apparent to the majority of your customers that I communicate with that the product is lagging, and not it is being priced uncompetitively on top of that. People who are one day faced with the prospect of renewing a service agreement and feeling angry over not having used a single release in the previous year are now being faced with a choice between a dead-end product (non-annually licensed software), and upgrading to an annual license at a greatly increased price.The issues with development and price on their own aren't my only concerns. Since I see this as grossly uncompetitive, I also worry about whether or not Declude can be a going concern under these conditions, and a large part of my own business has been built on top of the functionality that the product offers. I don't perceive the possibility of success in this model, and I likewise don't believe that I can rely on Declude going forward as long as this is the model that you choose. As a business person, I must protect my own interests and find a suitable solution for my needs.It's not yet too late to rethink your licensing and other plans going forward, but I fear that you won't get very far before the damage can't be undone.MattBarry Simpson wrote: Each customer has a price on their host record which reflects their individual special price. This is confidential for each customer and I will not be posting details on a public forum. We are currently developing some documentation that should be published next week outlining changes and future strategy. As soon as this is available we will inform our customers. Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darin Cox Sent: Sunday, February 12, 2006 10:03 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 3.0 / 4.0 I misspoke... switch SA for upgrade. Also, please answer the implicit questions at the end of the email as well. Thanks, Darin. - Original Message - From: "Barry Simpson" [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, February 12, 2006 9:54 AM S
[Declude.JunkMail] Imail 2006.02a
Is any one on this version of Imail yet? How has the upgrade process been for you? I understand that there were a lot of issues at the beginning? Have the latest patches resolved them for you? I appreciate your feedback as we are trying to plan when we will take the plunge Thank you Harry Vanderzand inTown Internet Computer Services 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent: Friday, February 17, 2006 10:35 AM To: Declude.Virus@declude.com Subject: [Declude.Virus] Multiple ban notice eml's Is it possible to have two different bannotify messages (as in bannotify.eml and bannotify2.eml)? As postmaster I need to get notices on all held banned messages. But I want the second EML to use ONLYSENDIFRECIP and sent the notice to select recipients. If yes, this leads to the second question. Can us specify multiple ONLYSENDIFRECIP entries in EML? As in: ONLYSENDIFRECIP [EMAIL PROTECTED] ONLYSENDIFRECIP [EMAIL PROTECTED] ONLYSENDIFRECIP [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: %ALLRECIPS% Blah, blah ... Thanks, John --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Damaged Image Files
Title: Message Judgement is quick to pass for some around here. These are getting caught by my system X-Note: Spam Tests Failed: SBL [28], SORBS-DUHL [4], HELOBOGUS [3], SNIFFER [13] Harry Vanderzand inTown Internet Computer Services 519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of ErikSent: Tuesday, February 28, 2006 12:49 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Damaged Image Files The problem that we've seen this "spammer" is that the image is corrupted as you mentioned... and Declude is exiting; thus why it's being allowed to be delivered. "Smart" coding on the spammer... Not so smart on Declude. -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave BeckstromSent: Tuesday, February 28, 2006 6:41 PMTo: Declude.JunkMail@declude.comCc: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Damaged Image Files We’re getting the same. Also using Declude with smartermail. Because Declude doesn’t appear to be scanning the headers there is no way for us to stop them. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Evans MartinSent: Tuesday, February 28, 2006 12:38 AMTo: Declude.JunkMail@declude.comCc: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Damaged Image Files I’m getting a lot of messages that have only a graphic in them. The graphic appears to have been damaged as only about ½ of it displays. Declude has not modified the headers at all so I’m not sure if these are being scanned or not. I don’t know how it could be bypassing Declude. I have attached the .msg file. Anyone have any ideas what might be causing this? I’m running Declude 3.0.5.22 and SmarterMail 2.6. The header is as follows: Return-Path: [EMAIL PROTECTED] Tue Feb 28 00:24:32 2006 Received: from 225-65-10-72.planters.net [72.10.65.225] by matrix.martek.net with SMTP; Tue, 28 Feb 2006 00:24:32 -0600 Date: Tue, 28 Feb 2006 01:24:22 +0100 Return-path: [EMAIL PROTECTED] From: "Abrahams"[EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: C1alis 10 Pills 20 mg $89.95 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="ms020700070106060404020304" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Thanks, Evans Martin EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net PROGRAMMING: http://www.martekware.com iPlus Info Browser – IPB’s IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96
[Declude.JunkMail] changing decludeproc from 4.09.4 to 4.1
I have always done the updates by stopping the decludeproc service, putting the new decludeproc into place and then starting it. When I did this to move to 4.1 the end result was that decludeproc was started but nothing was being processed. When I reversed the steps and put 4.09.4 back everything was ok again. Has something changed here? Also is a full updated needed to get the new GUI? thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] changing decludeproc from 4.09.4 to 4.1
I am waiting for their response. How does one get the GUI? Maybe I am being obtuse here but I am not getting it. Your answer is the same that support gave me. I download decludeproc4.1 and install it.where does the dui come from if I do not need the full install? Harry Vanderzand inTown Internet Computer Services 519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David BarkerSent: Thursday, April 06, 2006 11:53 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] changing decludeproc from 4.09.4 to 4.1 1. Harry please contact support at declude regarding your issue of upgrading. 2. The GUI is independent of the install you do not need the full update. David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Thursday, April 06, 2006 11:49 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] changing decludeproc from 4.09.4 to 4.1 I have always done the updates by stopping the decludeproc service, putting the new decludeproc into place and then starting it. When I did this to move to 4.1 the end result was that decludeproc was started but nothing was being processed. When I reversed the steps and put 4.09.4 back everything was ok again. Has something changed here? Also is a full updated needed to get the new GUI? thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] changing decludeproc from 4.09.4 to 4.1
Thank you Harry Vanderzand inTown Internet Computer Services 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, April 06, 2006 12:19 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] changing decludeproc from 4.09.4 to 4.1 All downloads are available from the Declude My Account home page www.declude.com/login.asp the GUI download is titled Declude Graphical User Interface. And yes the answer is the same as support gave you because I was the person who answered you I could not figure out why you were posting the same question to the lists. :) If decludeproc 4.1 is not working for you phone us so we can help you get it running. I am not sure what you are doing incorrectly. David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Thursday, April 06, 2006 12:13 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] changing decludeproc from 4.09.4 to 4.1 I am waiting for their response. How does one get the GUI? Maybe I am being obtuse here but I am not getting it. Your answer is the same that support gave me. I download decludeproc4.1 and install it. where does the dui come from if I do not need the full install? Harry Vanderzand inTown Internet Computer Services 519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, April 06, 2006 11:53 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] changing decludeproc from 4.09.4 to 4.1 1. Harry please contact support at declude regarding your issue of upgrading. 2. The GUI is independent of the install you do not need the full update. David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Thursday, April 06, 2006 11:49 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] changing decludeproc from 4.09.4 to 4.1 I have always done the updates by stopping the decludeproc service, putting the new decludeproc into place and then starting it. When I did this to move to 4.1 the end result was that decludeproc was started but nothing was being processed. When I reversed the steps and put 4.09.4 back everything was ok again. Has something changed here? Also is a full updated needed to get the new GUI? thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Testing the Boards
PING Harry Vanderzand inTown Internet Computer Services 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, April 27, 2006 9:22 AM To: Declude.Virus@declude.com; Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Testing the Boards PING --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spam from spoofed addresses that are whitelisted
I currently have my client's source IP's and their domains whitlisted. I am realizing that spam is getting through. If I interpret the headers correctly the mail below is coming from 85.71.84.125, which is somewhere in the world. It was scanned by my server before being delivered to my clients mail server as I take care of the spam scanning. Since I have @myclientsdomain.com whitelisted it got through to them. The target domain was invalid, however their server processed the BCC's that were in that mail and delivered mail to those addresses one of those was [EMAIL PROTECTED]. I want to tighten that up but am afraid to upset the apple cart here and trap mail that I should not. I know in the past I was trapping mail from legitimate source at my client as some of their software formed mail that made it look like spam to my configuration Any guidance and help would be appreciated. I run imail 8.22 with declude 4.2.3, sniffer and invuribl Thank you Received: from ntserver.heartlandapp.com [72.1.199.42] by intown.net with ESMTP (SMTPD-8.22) id AE0003A0; Sun, 14 May 2006 14:59:12 -0400 Received: from intown.net ([216.16.233.12]) by ntserver.heartlandapp.com with Microsoft SMTPSVC(5.0.2195.6713); Sun, 14 May 2006 14:59:13 -0400 Received: from 792352B8 [85.71.84.125] by intown.net (SMTPD-8.22) id ADF103A0; Sun, 14 May 2006 14:58:57 -0400 Received: from 216.16.233.12 (localhost [127.0.0.1]) by 216.16.233.12 (iPlanet Messaging Server 5.2 HotFix 1.21 (built Sep 8 2003)) with ESMTP id [EMAIL PROTECTED] for [EMAIL PROTECTED]; Sun, 14 May 2006 12:02:33 -0800 Received: from [154.212.180.108] (Forwarded-For: [242.208.166.108]) by 216.16.233.12 (mshttpd); Sun, 14 May 2006 12:02:33 -0800 Date: Sun, 14 May 2006 12:02:33 -0800 From: "Ladonna Parr" [EMAIL PROTECTED] Subject: we offer degrees in less than 2 weeks Message-id: [EMAIL PROTECTED] MIME-version: 1.0 X-Mailer: iPlanet Messenger Express 5.2 HotFix 1.21 (built Sep 8 2003) Content-type: text/plain; charset=us-ascii Content-language: en Content-transfer-encoding: 7Bit Content-disposition: inline Priority: normal X-Declude-Sender: [EMAIL PROTECTED] [85.71.84.125] X-Declude-Spoolname: D7dec00379dd0.smd X-Spam-Tests-Failed: Whitelisted [0] Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 14 May 2006 18:59:13.0629 (UTC) FILETIME=[7DCA10D0:01C67788] X-Declude-Sender: [EMAIL PROTECTED] [72.1.199.42] X-Declude-Spoolname: D7e0001e29de4.smd X-Note: Total spam weight of this E-mail is 0. X-Note: Spam Tests Failed: Whitelisted X-Note: REMOTEIP: 72.1.199.42 X-Note: REVDNS: dsl-72-1-199.042.tel-ott.com X-Note: FROM: [EMAIL PROTECTED] X-Note: TO:otherclient.com X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: john@otherclient.com Status: U X-UIDL: 428962690 X-IMail-ThreadID: 7e0001e29de4 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server
good perspective Harry Vanderzand inTown Internet Computer Services 519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert E. SpivackSent: Wednesday, May 31, 2006 7:01 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server Lets start at the high-level: What question are you trying to answer? e.g: Are the developers spending enough time doing the work they should be doing? Are the developers doing things they should not be doing? Are the developers competent and performing their job properly? Are the developers hours spent working matching their timesheets/project sheets? Etc. There are different solutions depending upon your objectives. Note: Personally, for outsourcing I pay based on a project or deliverable so tracking time/usage is of no interest to me. I pay for a certain result and dont care if it takes an hour or a week to do it. Also, I audit the quality of the finished product/code/service, I dont care about the tools/methods used to reach that goal. In your case: Since you have a virtual server environment, you can also audit at the host level. E.g. you can run SNMP tools and measure traffic (bps and total bytes in/out) on the virtual network ports of the virtual machine to see the activity level. You can see the protocol (http, http, netbios, smb, etc.) to see what type of activity is flowing through the machine. If you run the tool in a virtual machine on the same physical host, it can use packet capture to fully analyze the traffic and not just SNMP/WMI. You might consider re-writing your outsourcing contract. You really shouldnt have to police the project/micromanage it. Afterall, management of outsourcing is the hidden cost that can eat you alive and remove any cost benefits so why allow yourself to fall into that black hole? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran JovanovicSent: Wednesday, May 31, 2006 1:09 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server It is a dev/staging server running in a virtual server environment so I have to be a bit careful what I turn on or dont. I tried the auditing a file. Wow talk about generating Security Event Log records. I turned auditing on for two files bginfo.exe and its corresponding config.bgi file. Then I ran it to generate the background on file server. That simple little thing created 15 log entries. If we turn this on we are going to need something to parse the security log file as I can see that it is going to produce a HUGE amount traffic in there. Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Shaun MickeySent: Wednesday, May 31, 2006 3:34 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server You could also enable auditing in Windows to examine file level access, just r-click on any file/folder and select properties, click on the security tab then click advanced then click on the auditing tab. WARNING: auditing a lot of high-use files could strain the server That being said, your on a dev server so it should be alright, though I would keep the number of files youre auditing to a minimum or as small a group as possible Thanks, Shaun ---Shaun Mickey270net TechnologiesPhone: 301.663.6000 x28Fax: 301.663.4410www.270net.com "Internet/Technology Solutions for Business and Government"--- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin CoxSent: Wednesday, May 31, 2006 3:16 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server Source code activity would be best analyzed with Visual SourceSafe or another code control system. For watching use of the sites for testing, etc. just enable logging for the virtual webs and run reports on the web traffic. Darin. - Original Message - From: Goran Jovanovic To: Declude.JunkMail@declude.com Sent: Wednesday, May 31, 2006 2:35 PM Subject: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server Hi All, This is definitely an off topic question. I have a client that wants to monitor what their outsourced developers are doing. The development is taking place in IIS, .Net Application Server and SQL 2000. They want
[Declude.JunkMail] malformed message-id
I am having a problem where the message-id is malformed which trips upsome clients. see: Message-Id: 200606131300275.SM04448@X-Declude-Sender: [EMAIL PROTECTED] [216.16.233.16] Notice the the closing bracket is on a separate line. Thiscauses theheaders to become part of the body for some of my clients. Has anyone seen this before? Is it an imail issue or a declude issue? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] malformed message-id
Thanks Matt This message comes straight from a form submission on one of my servers. I think aspmail is being used. My programmer says that it can't be caused by that and is blaming the SMTP server it is submitted to, which is my imail server Harry Vanderzand inTown Internet Computer Services 519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Thursday, June 15, 2006 3:27 PMTo: declude.junkmail@declude.comSubject: Re: [Declude.JunkMail] malformed message-id Looks like an IMail inserted Message-Id header, so in part it is their problem. I suspect that the trigger though is the sender having an invalid HELO, which IMail is then mishandling. It could have also been a hickup unless it is repeatable with the same source.The HELO, MAIL FROM and RCPT TO should all have only US-ASCII printable characters (excluding space). Anything beyond that is invalid on it's own, and IMO, the MTA should issue a 5xx error when received indicating as much.MattHarry Vanderzand wrote: I am having a problem where the message-id is malformed which trips upsome clients. see: Message-Id: 200606131300275.SM04448@X-Declude-Sender: [EMAIL PROTECTED] [216.16.233.16] Notice the the closing bracket is on a separate line. Thiscauses theheaders to become part of the body for some of my clients. Has anyone seen this before? Is it an imail issue or a declude issue? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] malformed message-id
following is an excerpt of my imail log: This message is submitted directly to the imail server. None of my other servers run any SMTP server software. 06:13 13:00 SMTPD(ef2801f16207) [216.16.233.16] HELO06:13 13:00 SMTPD(ef2801f16207) [216.16.233.16] MAIL FROM:[EMAIL PROTECTED]06:13 13:00 SMTPD(ef2801f16207) [216.16.233.16] RCPT TO:[EMAIL PROTECTED]06:13 13:00 SMTPD(ef2801f16207) [216.16.233.16] RCPT TO:[EMAIL PROTECTED]06:13 13:00 SMTPD(ef2801f16207) [216.16.233.16] D:\IMail\spool\Def2801f16207.SMD 16252 Thanks for your assistance Harry Vanderzand inTown Internet Computer Services 519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Thursday, June 15, 2006 4:37 PMTo: declude.junkmail@declude.comSubject: Re: [Declude.JunkMail] malformed message-id Any connecting SMTP connection must submit a HELO or EHLO. I believe that IMail uses the HELO/EHLO name given as the part of the Message-ID after the @ symbol, but will only insert this if there is no Message-ID already present (which would also fail SPAMHEADERS in Declude unless LOOSENSPAMHEADERS ON is set). If there is an line break here, that data must be bad. If you look in your IMail log for the information about the session (and turn up the logging), you should be able to see the HELO/EHLO name given.FYI, this wouldn't be the first IIS plug-in that had RFC issues. Many have them. I can't say for sure 100% though that this is the case here due to circumstances, but I strongly suspect this is the trigger. If IMail acted properly, the message would have been rejected, and that's not a solution to your issues either, so the fix is likely best applied to your mailer.MattHarry Vanderzand wrote: Thanks Matt This message comes straight from a form submission on one of my servers. I think aspmail is being used. My programmer says that it can't be caused by that and is blaming the SMTP server it is submitted to, which is my imail server Harry Vanderzand inTown Internet Computer Services 519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of MattSent: Thursday, June 15, 2006 3:27 PMTo: declude.junkmail@declude.comSubject: Re: [Declude.JunkMail] malformed message-idLooks like an IMail inserted Message-Id header, so in part it is their problem. I suspect that the trigger though is the sender having an invalid HELO, which IMail is then mishandling. It could have also been a hickup unless it is repeatable with the same source.The HELO, MAIL FROM and RCPT TO should all have only US-ASCII printable characters (excluding space). Anything beyond that is invalid on it's own, and IMO, the MTA should issue a 5xx error when received indicating as much.MattHarry Vanderzand wrote: I am having a problem where the message-id is malformed which trips upsome clients. see: Message-Id: 200606131300275.SM04448@X-Declude-Sender: [EMAIL PROTECTED] [216.16.233.16] Notice the the closing bracket is on a separate line. Thiscauses theheaders to become part of the body for some of my clients. Has anyone seen this before? Is it an imail issue or a declude issue? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 4.3
Thanks David Is the global variable correction important enough to upgrade from 4.2.20? Harry Vanderzand inTown Internet Computer Services 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, July 19, 2006 9:24 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.3 Gary, 4.3 Release notes: Added CT and a Global variable being initialized more than once has been corrected. You are correct in your statement, if you do not want to join our Service Provide Program you can choose not too participate. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, July 18, 2006 7:21 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.3 Basically you are telling me to ignore the Add Commtouch part of your web page that shows up when I log in to my account. What I find particularly amusing is the line Restrictions apply to service providers. If there is anyone subscribed to this mailing list who is not a service provider, please raise your hand. Isn't it generally a good idea to have your product's pricing defined before you introduce the product? I'm sure that everyone here reading the list is extremely curious as to what the revenue share program really is, and when it does come out, unless you hear exclamations of What a Bargain coming off this list there won't be many of us joining that program. Other than the Commtouch add-on, are there any other features or reasons to upgrade to 4.3? Original Message From: David Barker [EMAIL PROTECTED] Sent: Tuesday, July 18, 2006 5:03 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.3 Gary, 1. Server Providers who use CommTouch as an add-in to Declude will be in violation of CommTouch's Terms of service. 2. Some of the benefits of CommTouch are Zero Hour virus protection and additional spam identifying technology such as Recurrent Pattern Detection Technology (RPD) recognized by key industry analysts as a leading technology in email outbreak detection. 3. We are in the process of defining the revenue share program and will provide the details to this when it is ready. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, July 18, 2006 4:09 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.3 So, that being said, under what conditions can a legacy customer use Commtouch? Since it would seem that Commtouch is being offered as an add-on, what are the benefits of having Commtouch? What does it do that Declude alone does not? And of course it would be nice if this revenue share program was spelled out somewhere. Original Message From: David Barker [EMAIL PROTECTED] Sent: Tuesday, July 18, 2006 3:57 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.3 There are restrictions on CommTouch being used by Service Providers we had to ensure that NEW customers (ie. Service Providers After 1 June 06) understand the licensing restrictions. Current Service Providers (ie. Before 1 June 06) are under no restrictions for using Declude; only the CommTouch add-in component. However we have managed to come to an agreement with CommTouch to enable our legacy customers (ie. Service Providers Before 1 June 06) to take advantage of CommTouch under a revenue share program, this program is not being forced onto legacy customers but will be an opportunity for us to help you increase revenues in your business, by providing you with new product like the Declude Gateway which would be independent of Imail/SmarterMail and will include CommTouch. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Tuesday, July 18, 2006 3:02 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.3 I guess we all missed the following paragraph in the license agreement: 3.2.6 sub-license, rent, sell, lease, distribute, or otherwise transfer the Licensed Program save as provided under this End-User License Agreement unless You obtain a separate License from Declude, Inc. for such purposes (for example, You may not embed the Licensed Program into another application and then distribute such to third parties unless You first acquire an OEM License from Declude, Inc.). As of June 1, 2006, ISP's and other service providers
RE: [Declude.JunkMail] Declude 4.3
Title: Message This has been a great thread to follow and I just want to add my two cents worth. At the moment the whole issue of spam filtering is quite complex. Declude's configuration requires constant tweaking it seams. That translates into labour. If Declude can somehow manage to reduce the amount of labour and skill involved that would be of great value It would not necessarily earn us more money, but it can earn us more time. Personally I would like to have Declude running and then just forget about it. Well maybe I would continue reading this list because it can be entertaining and educational. Regarding revenue sharing. I do charge for anti-spam and anti-virus services. I don't compete with the mayor service providers that offer it for free. As with others on this list I offer personalized quality service to my clients. I attract clients that understand and desire that. I have never advertised. It does work. WhileI recognize that there is value to anything that frees up my time, I do have to keep an eye on net income also I spend money on tools and consume my time. Any revenue sharing program with a third party will be compared against what I do now. If it's clear and fits in comparison to what I do now,then it will be attractive to me. If it also saves time that will make some difference Harry Vanderzand inTown Internet Computer Services 519-741-1222 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] ASSP
I am interested in this also. Maybe it can be on list? Harry Vanderzand inTown Internet Computer Services 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don Brown Sent: Tuesday, September 19, 2006 3:03 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] ASSP There were a couple of recent posts from folks who had recently implemented ASSP. We have to do the same due to the vulnerability in Imail 8.22. I'd appreciate any comments, suggestions, etc. OFF LIST, from those who have already fell in the holes, etc. Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Crisis after upgrade to 4.3.14 from 4.3.7
Last night at 8:11PM I upgraded from 4.3.7 to 4.3.14 From that point on we stopped catching all spam for these clients that have their own mail server. We just filter their mail for spam and pass it on. I just reverted back to 4.3.7 and now we are catching spam again for them We catch over 4000 spam messages per dayfor one of these clients alone so you can imagine their complaint this morning. Anyone know what would have caused this? Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Crisis after upgrade to 4.3.14 from 4.3.7
I am going to do the upgrade again this time putting the following commands in the cfg file: OUTBOUNDSCANNINGSPAMONINBOUNDSCANNINGSPAMON Obviously this should not have happened and it was unfortunate. I believe Declude is getting a message ready for everyone. I will let you know the results shortly to confirm that that was it Thanks for your responses Harry Vanderzand inTown Internet Computer Services 519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of chrisSent: Friday, September 29, 2006 10:08 AMTo: declude.junkmail@declude.comSubject: RE: [Declude.JunkMail] Crisis after upgrade to 4.3.14 from 4.3.7 Nick, I will definitely post these results, but I have yet to hear from harry, I believe the response from the first user is the solution!!! Chris Asaro Technical Support Engineer Declude Your Email security is our business 866.332.5833toll free978.499.2933office978.477.8930 e-fax[EMAIL PROTECTED]www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick HayerSent: Friday, September 29, 2006 9:55 AMTo: declude.junkmail@declude.comSubject: Re: [Declude.JunkMail] Crisis after upgrade to 4.3.14 from 4.3.7 Harry,Please post to the list the details - Thanks-Nickchris wrote: Harry Contact me off the list if you can, I would like to help Chris Asaro Technical Support Engineer Declude Your Email security is our business 866.332.5833toll free978.499.2933office978.477.8930 e-fax[EMAIL PROTECTED]www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Harry VanderzandSent: Friday, September 29, 2006 9:15 AMTo: declude.junkmail@declude.comSubject: [Declude.JunkMail] Crisis after upgrade to 4.3.14 from 4.3.7 Last night at 8:11PM I upgraded from 4.3.7 to 4.3.14 From that point on we stopped catching all spam for these clients that have their own mail server. We just filter their mail for spam and pass it on. I just reverted back to 4.3.7 and now we are catching spam again for them We catch over 4000 spam messages per dayfor one of these clients alone so you can imagine their complaint this morning. Anyone know what would have caused this? Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Max whitelists hit
When using the WHITELISTFILE option, does anyone have a way where a user can
maintain their own whitlist file possibly through the imail web interface?
Harry Vanderzand
inTown Internet Computer Services
519-741-1222
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of David Barker
Sent: Thursday, July 27, 2006 9:40 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Max whitelists hit
Sensitivity: Confidential
Yes, in the global.cfg there is a limit. If you need to have
unlimited whitelist entries, or if you need per-user or
per-domain whitelisting, you may find the WHITELISTFILE
option helpful.
To use this option, you need to add a line in the format
WHITELISTFILE D:\{MAILSERVER}\Declude\mywhitelist.txt to
the appropriate configuration file
(\{MAILSERVER}\Declude\$default$.JunkMail, or the
per-user/per-domain configuration file you wish to use the
whitelists with). The D:\{MAILSERVER}\Declude\mywhitelist.txt
file would then contain either one E-mail address
([EMAIL PROTECTED]) or domain (@example.com) or subdomain
(.example.com) per line. The whitelist files can have
unlimited entries in them.
Note that the file you use with the WHITELISTFILE option does
NOT use the same format as the WHITELIST entries in the
global.cfg file. Also, note that the WHITELISTFILE option
does not work in the global.cfg file.
David B
www.declude.com
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Craig Edmonds
Sent: Thursday, July 27, 2006 9:34 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Max whitelists hit
Importance: High
Sensitivity: Confidential
just found this in my declude log.
07/27/2006 15:28:25.221 qbf78048c0118c40b.smd WARNING: Max
whitelists hit.
Some whitelists will not be processed!
Is there a limit to the amount of domains you can put in the
whitelist?
Kindest Regards
Craig Edmonds
123 Marbella Internet
W: www.123marbella.com http://www.123marbella.com/ E :
[EMAIL PROTECTED]
http://i.msgtag.com/alaqebaugecbtfqn/xlkcihtsdEb/aom/yi.gif
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be
found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: SmarterMail's website
me neither Harry Vanderzand inTown Internet Computer Services 519-741-1222 _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Asaro Sent: Monday, December 04, 2006 12:54 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] OT: SmarterMail's website I cannot navigate to that address either.. Chris _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael Graveen Sent: Monday, December 04, 2006 12:40 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT: SmarterMail's website Is anyone else having trouble getting to SmarterMail's web site (www.smartertools.com http://www.smartertools.com/ )? I have been unable to access it since Sunday morning. Mike --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] \spool\charset directory
The spool\charset directory is filling up with thousands of e-mails per day. Can that be stopped? while still keeping the bancharset command? Harry Vanderzand inTown Internet Computer Services 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] \spool\charset directory
this is a test in declude.cfg and there is nowhere where I am setting up that directory. I guess it is by defaults. I just do not want to see 100s of thousands emails in a directory nor do I feel like personally managing it. I am not the greatest with scripts either. These kinds of controls I would like to see in Declude itself. In a gui interface by the way! Harry Vanderzand inTown Internet Computer Services 519-741-1222 _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, December 12, 2006 6:45 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] \spool\charset directory Harry, check your global.cfg and see if you have a test with a COPYTO action that copies the email to that spool\charset folder when the test is triggered. Then comment out that test and action. Andrew. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Tuesday, December 12, 2006 2:39 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] \spool\charset directory The spool\charset directory is filling up with thousands of e-mails per day. Can that be stopped? while still keeping the bancharset command? Harry Vanderzand inTown Internet Computer Services 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Imail 2006.1 and declude
I just upgraded from imail V8.22 to 2006.1 After the upgrade the load on my system is much heavier The system was running smoothly before the upgrade but now it is hitting 100% utilization consistently I am concerned because it is before 6am. What will happen during the day when my users are active? I am running on dual xeon 3.4Ghz with 2GB ram, windows 2000 server. Everything is at latest version and update level I am running sniffer, invuribl and fprot also sniffer is in persistent mode Any help or ideas would be appreciated declude.cfg: CODE xx threads 150 waitformail 500 waitforthreads 25 waitbetweenthreads 100 winsockcleanup OFF avgupdatefreqhrs 4 BANCHARSET iso-2022-jp BANCHARSET koi8-r AUTOREVIEW ON BLKLST ON Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail 2006.1 and declude
My message volume is about 40K per day I have resolved the issue. I noticed the persistent sniffer not being very persistent and realized that my code was changed yesterday. I had updated the automatic update routines and the global.cfg file but had forgotten to update the code in the registry for the persistent sniffer service. What a relief I am looking to see if I can tune the box better since I am in the mode now. I increased my threads in imail from 30 to 40 without seeing much of a hit. Right now I am seeing and average of around 40% utilization I would guess. Are there tools to measure this more accurately other than looking at task manager? Of course there are tools, I guess I mean to ask what you might use to measure performance and tune the server. Harry Vanderzand inTown Internet Computer Services 519-741-1222 _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, December 19, 2006 8:44 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Imail 2006.1 and declude threads 150 This is very high - even on a dual proc xeon (2.6) box - HT enabled - I am easily able to run with 40 threads processing 150K messages a day. What is your message volume? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Harry mailto:[EMAIL PROTECTED] Vanderzand To: declude.junkmail@declude.com Sent: Tuesday, December 19, 2006 5:54 AM Subject: [Declude.JunkMail] Imail 2006.1 and declude I just upgraded from imail V8.22 to 2006.1 After the upgrade the load on my system is much heavier The system was running smoothly before the upgrade but now it is hitting 100% utilization consistently I am concerned because it is before 6am. What will happen during the day when my users are active? I am running on dual xeon 3.4Ghz with 2GB ram, windows 2000 server. Everything is at latest version and update level I am running sniffer, invuribl and fprot also sniffer is in persistent mode Any help or ideas would be appreciated declude.cfg: CODE xx threads 150 waitformail 500 waitforthreads 25 waitbetweenthreads 100 winsockcleanup OFF avgupdatefreqhrs 4 BANCHARSET iso-2022-jp BANCHARSET koi8-r AUTOREVIEW ON BLKLST ON Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] problem after imail upgrade
I am getting the following error after having upgraded to imail 2006.1 421 #4.4.5 Too many connections from your host It is all from one domain, sympatico.ca, one of the largest providers in Canada It is for mail being delivered to my clients' mail box but then forwarded to a sypatico.ca address. What might cause this with 2006.1 when it did not occur in 8.22? All else seems to be working fine. Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Virus sneaking past Declude/AVG/F-PROT?
do you have avafterjm on? In that case if it is deemed as spam then virus scan will not run on it. Harry Vanderzand inTown Internet Computer Services 519-741-1222 _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of S.J.Stanaitis Sent: Friday, December 22, 2006 3:55 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Virus sneaking past Declude/AVG/F-PROT? I've got a single mailbox on my Imail server configured to get all the SPAM. It's then processed in TheBat! (Exciting, I know. Take a moment and revel.) Anyhow, my Symantec Antivirus is snagging a slew of Trojan.Dowiex!inf which it identifies as a low risk Trojan horse. I've got Declude 4 running both AVG and F-Prot and it snuck past. Anyone else seeing this? http://www.symantec.com/security_response/writeup.jsp?docid=2006-121817-5005 -99 Thanks, Sam SJ.Stanaitis - Network Administrator Decorative Product Source E-commerce Network --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] script to remove messages from mailbox
A while back someone published a script that would remove messages older than x days from a mail box file along with his set up of how he handles spam for his client in individual spam mailboxes. I cannot find it again and was wondering if someone could point me in the right direction. Thank you so much Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] roconner -can he be stopped???
Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] mailbox command
I have tried to route mail using the mailbox command instead of routeto I really like the feature as each user can check their own held spam. And by using mailbox spam it goes into a spam folder belonging to the user. Then I can keep these accounts trimmed by removing mail older than x days (thanks for the recent assistance in this command) There is one big problem however. If the account has forwarding set then the spam gets forwarded. I have clients that keep mail in their own account and also forward it to another account in their company. In this case the spam gets forwarded. Other clients have a copy of their mail forwarded to their blackberry also. Can anyone see an easy solution to this? I could setup a junkmail file for each user but that would be a huge undertaking Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] issue with spam to alias account
In sorting through my logs I just noticed that e-mail going to an alias was considered spam with last action = DELETE. Yet the spam got delivered to the three accounts that are listed in the alias. Is there a problem with spam handling when it is directed at an alias? Using imail 2006.1 and latest declude Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] issue with spam to alias account
I did further testing and found that I was not correct. Spam was being directed towards a sub mailbox that did not have a filter specified All is well Thanks Harry Vanderzand inTown Internet Computer Services 519-741-1222 _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Saturday, January 13, 2007 9:32 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] issue with spam to alias account In sorting through my logs I just noticed that e-mail going to an alias was considered spam with last action = DELETE. Yet the spam got delivered to the three accounts that are listed in the alias. Is there a problem with spam handling when it is directed at an alias? Using imail 2006.1 and latest declude Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
