Re: [sniffer] Sniffer Resources
How does AVAFTERJM help? Unless you had JunkMail delete the message it would seem that it has to be scanned for viruses either way. This is more appropriate on the Declude list - but with that said you are correct in order for it to make a major impact you need to have actions that either hold, delete, or bounce for this to make a huge difference. I don't know which uses more processor time... Virus or SPAM scanning. If you use a bunch of tests it probably takes more horsepower to scan for SPAM than viruses. If that's the case then it would see like you would want to virus scan FIRST. Any message deleted by the virus scanner don't need to be scanned for SPAM. Couple of things to keep in mind. One such thing is virus scanner - if you use Mcafee it is VERY resource intensive so this helps alot. The other thing which complements the first point is that most normal servers have approx 95%+ spam volume and if you don't have to virus scan 95% of mail than it saves a lot of resources. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [sniffer] Sniffer Resources
Joe, using the AVAFTERJM ON Directive in the Declude virus.cfg means that virus scanning is only done on messages that have made it through the spam detection, the idea being that if it's not going to be delivered to a mailbox, then the job is done. For most mailhosts, that makes sense because they have a good deal of clean messages, a great deal of spam, and relatively few viruses. Rather than drag out further details on this, I'd refer further conversation to the archives for Declude.JunkMail or Declude.Virus but I appreciate that Richard cross-posted to clean up this thread. Andrew 8) > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Joe Wolf > / Internet Specialists, LLC > Sent: Thursday, September 08, 2005 9:54 AM > To: sniffer@SortMonster.com > Subject: Re: [sniffer] Sniffer Resources > > How does AVAFTERJM help? Unless you had JunkMail delete the > message it would seem that it has to be scanned for viruses > either way. > > I don't know which uses more processor time... Virus or SPAM > scanning. If you use a bunch of tests it probably takes more > horsepower to scan for SPAM than viruses. If that's the case > then it would see like you would want to virus scan FIRST. > Any message deleted by the virus scanner don't need to be > scanned for SPAM. > > Maybe I'm way off base? I'm sure not an expert on this! > > -Joe > - Original Message - > From: "Richard Farris" <[EMAIL PROTECTED]> > To: > Sent: Thursday, September 08, 2005 11:48 AM > Subject: Re: [sniffer] Sniffer Resources > > > > It was suggested that I put AVAFTERJM in my Declude > configuration and that > > has made a huge difference...I have my old server back...I > hope this does > > not cause other problems..we will continue to monitor this.. > > > > Richard Farris > > Ethixs Online > > 1.270.247. Office > > 1.800.548.3877 Tech Support > > "Crossroads to a Cleaner Internet" > > > > - Original Message - > > From: "Richard Farris" <[EMAIL PROTECTED]> > > To: > > Sent: Tuesday, September 06, 2005 10:07 AM > > Subject: [sniffer] Sniffer Resources > > > > > >> When I turn off sniffer my server acts normally on > rescources..but when I > >> turn it on it goes to 100% and stays there most of the > time...I have > >> tried updating the sniffer and rebooting the server but does not > >> help...it has been doing this for about a month...has > anyone else seen > >> this..if not what can I do to resolve it..right now I have > sniffer turned > >> off so I can just send mail thru the server.. > >> > >> Richard Farris > >> Ethixs Online > >> 1.270.247. Office > >> 1.800.548.3877 Tech Support > >> "Crossroads to a Cleaner Internet" > >> > >> - Original Message - > >> From: "Pete McNeil" <[EMAIL PROTECTED]> > >> To: "Andy Schmidt" > >> Sent: Monday, September 05, 2005 9:43 AM > >> Subject: Re: [sniffer] Integration with today's new ORF version: > >> > >> > >>> On Monday, September 5, 2005, 9:26:38 AM, Andy wrote: > >>> > >>> AS> http://www.vamsoft.com/orf/agentdefs.asp > >>> AS> > >>> AS> It says to contact vendor. Here I am . > >>> > >>> Yes indeed. > >>> > >>> How may I help you? > >>> > >>> _M > >>> > >>> > >>> > >>> This E-Mail came from the Message Sniffer mailing list. > For information > >>> and (un)subscription instructions go to > >>> http://www.sortmonster.com/MessageSniffer/Help/Help.html > >>> > >>> > >> > >> > >> This E-Mail came from the Message Sniffer mailing list. > For information > >> and (un)subscription instructions go to > >> http://www.sortmonster.com/MessageSniffer/Help/Help.html > >> > >> > > > > > > This E-Mail came from the Message Sniffer mailing list. For > information > > and (un)subscription instructions go to > > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Sniffer Resources
How does AVAFTERJM help? Unless you had JunkMail delete the message it would seem that it has to be scanned for viruses either way. I don't know which uses more processor time... Virus or SPAM scanning. If you use a bunch of tests it probably takes more horsepower to scan for SPAM than viruses. If that's the case then it would see like you would want to virus scan FIRST. Any message deleted by the virus scanner don't need to be scanned for SPAM. Maybe I'm way off base? I'm sure not an expert on this! -Joe - Original Message - From: "Richard Farris" <[EMAIL PROTECTED]> To: Sent: Thursday, September 08, 2005 11:48 AM Subject: Re: [sniffer] Sniffer Resources It was suggested that I put AVAFTERJM in my Declude configuration and that has made a huge difference...I have my old server back...I hope this does not cause other problems..we will continue to monitor this.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet" - Original Message - From: "Richard Farris" <[EMAIL PROTECTED]> To: Sent: Tuesday, September 06, 2005 10:07 AM Subject: [sniffer] Sniffer Resources When I turn off sniffer my server acts normally on rescources..but when I turn it on it goes to 100% and stays there most of the time...I have tried updating the sniffer and rebooting the server but does not help...it has been doing this for about a month...has anyone else seen this..if not what can I do to resolve it..right now I have sniffer turned off so I can just send mail thru the server.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet" - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Andy Schmidt" Sent: Monday, September 05, 2005 9:43 AM Subject: Re: [sniffer] Integration with today's new ORF version: On Monday, September 5, 2005, 9:26:38 AM, Andy wrote: AS> http://www.vamsoft.com/orf/agentdefs.asp AS> AS> It says to contact vendor. Here I am . Yes indeed. How may I help you? _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Sniffer Resources
It was suggested that I put AVAFTERJM in my Declude configuration and that has made a huge difference...I have my old server back...I hope this does not cause other problems..we will continue to monitor this.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet" - Original Message - From: "Richard Farris" <[EMAIL PROTECTED]> To: Sent: Tuesday, September 06, 2005 10:07 AM Subject: [sniffer] Sniffer Resources When I turn off sniffer my server acts normally on rescources..but when I turn it on it goes to 100% and stays there most of the time...I have tried updating the sniffer and rebooting the server but does not help...it has been doing this for about a month...has anyone else seen this..if not what can I do to resolve it..right now I have sniffer turned off so I can just send mail thru the server.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet" - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Andy Schmidt" Sent: Monday, September 05, 2005 9:43 AM Subject: Re: [sniffer] Integration with today's new ORF version: On Monday, September 5, 2005, 9:26:38 AM, Andy wrote: AS> http://www.vamsoft.com/orf/agentdefs.asp AS> AS> It says to contact vendor. Here I am . Yes indeed. How may I help you? _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re[2]: [sniffer] Sniffer Resources
SBL30856 I'm coding rules now. _M On Wednesday, September 7, 2005, 10:52:58 AM, Richard wrote: RF> Much of the spam I am getting is coming from here RF> Yipes Communications, Inc. YIPES-BLK7 (NET-66-17-128-0-1) RF> 66.17.128.0 - 66.17.255.255 RF> Leasing World, LLC YIPS-A06172005 (NET-66-17-180-0-1) RF> 66.17.180.0 - 66.17.183.255 RF> Is anyone else seeing this...I have blocked in IMAIL all the IPs for Leasing RF> World.. RF> Richard Farris RF> Ethixs Online RF> 1.270.247. Office RF> 1.800.548.3877 Tech Support RF> "Crossroads to a Cleaner Internet" RF> - Original Message - RF> From: "Richard Farris" <[EMAIL PROTECTED]> RF> To: RF> Sent: Tuesday, September 06, 2005 10:07 AM RF> Subject: [sniffer] Sniffer Resources >> When I turn off sniffer my server acts normally on rescources..but when I >> turn it on it goes to 100% and stays there most of the time...I have tried >> updating the sniffer and rebooting the server but does not help...it has >> been doing this for about a month...has anyone else seen this..if not what >> can I do to resolve it..right now I have sniffer turned off so I can just >> send mail thru the server.. >> >> Richard Farris >> Ethixs Online >> 1.270.247. Office >> 1.800.548.3877 Tech Support >> "Crossroads to a Cleaner Internet" >> >> - Original Message - >> From: "Pete McNeil" <[EMAIL PROTECTED]> >> To: "Andy Schmidt" >> Sent: Monday, September 05, 2005 9:43 AM >> Subject: Re: [sniffer] Integration with today's new ORF version: >> >> >>> On Monday, September 5, 2005, 9:26:38 AM, Andy wrote: >>> >>> AS> http://www.vamsoft.com/orf/agentdefs.asp >>> AS> >>> AS> It says to contact vendor. Here I am . >>> >>> Yes indeed. >>> >>> How may I help you? >>> >>> _M >>> >>> >>> >>> This E-Mail came from the Message Sniffer mailing list. For information >>> and (un)subscription instructions go to >>> http://www.sortmonster.com/MessageSniffer/Help/Help.html >>> >>> >> >> >> This E-Mail came from the Message Sniffer mailing list. For information >> and (un)subscription instructions go to >> http://www.sortmonster.com/MessageSniffer/Help/Help.html >> >> RF> This E-Mail came from the Message Sniffer mailing list. For RF> information and (un)subscription instructions go to RF> http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Sniffer Resources
Much of the spam I am getting is coming from here Yipes Communications, Inc. YIPES-BLK7 (NET-66-17-128-0-1) 66.17.128.0 - 66.17.255.255 Leasing World, LLC YIPS-A06172005 (NET-66-17-180-0-1) 66.17.180.0 - 66.17.183.255 Is anyone else seeing this...I have blocked in IMAIL all the IPs for Leasing World.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet" - Original Message - From: "Richard Farris" <[EMAIL PROTECTED]> To: Sent: Tuesday, September 06, 2005 10:07 AM Subject: [sniffer] Sniffer Resources When I turn off sniffer my server acts normally on rescources..but when I turn it on it goes to 100% and stays there most of the time...I have tried updating the sniffer and rebooting the server but does not help...it has been doing this for about a month...has anyone else seen this..if not what can I do to resolve it..right now I have sniffer turned off so I can just send mail thru the server.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet" - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Andy Schmidt" Sent: Monday, September 05, 2005 9:43 AM Subject: Re: [sniffer] Integration with today's new ORF version: On Monday, September 5, 2005, 9:26:38 AM, Andy wrote: AS> http://www.vamsoft.com/orf/agentdefs.asp AS> AS> It says to contact vendor. Here I am . Yes indeed. How may I help you? _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [sniffer] Sniffer Resources
Richard, are you rotating your sniffer logs daily? I had the same experience a very log time ago, and found that without rotating the logs, appending to a monster text file was soaking up a lot of cpu and disk on my server. Bill Landry worked with a lot of people here to make his download script generic enough for everyone's use. Bundled with that is a script for rotating your logs and uploading them back to SortMonster so that your system provides feedback on rule strengths. You can find more information about the logs here: http://www.messagesniffer.com/Support/TechDetails/logFiles.jsp And the user submitted scripts section is here: http://www.messagesniffer.com/Support/submittedScripts.jsp In particular, you would want to download: http://www.messagesniffer.com/Support/UserScripts/ImailSnifferUpdateTool s.zip And then edit the cmd files to provide your executable name and auth key in the variables supplied. And then schedule the rotate/update script, e.g. At 10:23PM /every:m,t,w,th,f,sa,su c:\messagesniffer\snfupd.cmd I hope that helps somebody, Andrew 8) > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris > Sent: Tuesday, September 06, 2005 8:07 AM > To: sniffer@SortMonster.com > Subject: [sniffer] Sniffer Resources > > When I turn off sniffer my server acts normally on > rescources..but when I turn it on it goes to 100% and stays > there most of the time...I have tried updating the sniffer > and rebooting the server but does not help...it has been > doing this for about a month...has anyone else seen this..if > not what can I do to resolve it..right now I have sniffer > turned off so I can just send mail thru the server.. > > Richard Farris > Ethixs Online > 1.270.247. Office > 1.800.548.3877 Tech Support > "Crossroads to a Cleaner Internet" > > - Original Message - > From: "Pete McNeil" <[EMAIL PROTECTED]> > To: "Andy Schmidt" > Sent: Monday, September 05, 2005 9:43 AM > Subject: Re: [sniffer] Integration with today's new ORF version: > > > > On Monday, September 5, 2005, 9:26:38 AM, Andy wrote: > > > > AS> http://www.vamsoft.com/orf/agentdefs.asp > > AS> > > AS> It says to contact vendor. Here I am . > > > > Yes indeed. > > > > How may I help you? > > > > _M > > > > > > > > This E-Mail came from the Message Sniffer mailing list. For > information > > and (un)subscription instructions go to > > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Sniffer Resources
What do the logs say? What's the average time to process a message? Darin. - Original Message - From: "Richard Farris" <[EMAIL PROTECTED]> To: Sent: Tuesday, September 06, 2005 11:07 AM Subject: [sniffer] Sniffer Resources When I turn off sniffer my server acts normally on rescources..but when I turn it on it goes to 100% and stays there most of the time...I have tried updating the sniffer and rebooting the server but does not help...it has been doing this for about a month...has anyone else seen this..if not what can I do to resolve it..right now I have sniffer turned off so I can just send mail thru the server.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet" - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Andy Schmidt" Sent: Monday, September 05, 2005 9:43 AM Subject: Re: [sniffer] Integration with today's new ORF version: > On Monday, September 5, 2005, 9:26:38 AM, Andy wrote: > > AS> http://www.vamsoft.com/orf/agentdefs.asp > AS> > AS> It says to contact vendor. Here I am . > > Yes indeed. > > How may I help you? > > _M > > > > This E-Mail came from the Message Sniffer mailing list. For information > and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
[sniffer] Sniffer Resources
When I turn off sniffer my server acts normally on rescources..but when I turn it on it goes to 100% and stays there most of the time...I have tried updating the sniffer and rebooting the server but does not help...it has been doing this for about a month...has anyone else seen this..if not what can I do to resolve it..right now I have sniffer turned off so I can just send mail thru the server.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet" - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Andy Schmidt" Sent: Monday, September 05, 2005 9:43 AM Subject: Re: [sniffer] Integration with today's new ORF version: On Monday, September 5, 2005, 9:26:38 AM, Andy wrote: AS> http://www.vamsoft.com/orf/agentdefs.asp AS> AS> It says to contact vendor. Here I am . Yes indeed. How may I help you? _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
