RE: [Declude.JunkMail] 2005 SpamHeaders - Fix -
Joshua, I don't know if this has been suggested, but to completely rule out the new Declude 1.82 as the culprit could you revert to your previous version of Declude, comment out the spamheaders test, and see if your CPU is still maxed. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joshua M. Hughes Sent: Wednesday, January 05, 2005 3:28 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix - John, It took me a while to get these stats. I reviewed the SMTP logs for 12/4, 12/5, 12/7, 12/8. I know the server was running fine during this week. Usage is as follows. 12/4 - 83,170 messages 12/5 - 82,065 messages 12/7 - 95,087 messages 12/8 - 95,730 messages I reviewed the SMTP logs for the 1/2, 1/3, 1/4. These are current and usage is as follows. 1/1 - 59,717 messages 1/2 - 63,795 messages 1/3 - 78,945 messages 1/4 - 79,410 messages It appears as if the beginning of last month, when we were running fine, had a lot more messages being delivered. The only things I see in the log disturbing for today are: [EMAIL PROTECTED] 4.63.108.6= 1130 messages = 1068 messages I have an ipfile that I have set to automatically delete anything from the ip 4.63.108.6 because they have been the top sender of the log for three days. However, this messages is still being processed. Matt, Average SMTP log size is between 102MB to 200MB. This appears normal. The drive that the logs were on wasn't severely fragmented however, I de-fragmented it anyway. The drive that the spool directory is on is 86% free but about 60% fragmented. This drive could be de-fragmented however, I'm worried about de-fragmenting while the CPU is at 100%. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, January 05, 2005 12:17 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix The CPU spike is probably do to sheer volume. What is the current volume of messages being processed? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Joshua M. Hughes Sent: Wednesday, January 05, 2005 8:22 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. Under the assumption this was caused by one of my few minor changes before the New Year I reversed all changes made the week before the New Year. Still the processor is maxed out. Any thoughts, any ideas? I don't want to go through and comment out each test one at a time to find which the offender is. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Tuesday, January 04, 2005 10:18 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix Hi, Scott, et.al, I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. I don't know if I'm getting his with a new wave of spam and the server's straining to keep up or if there might be something in the new Declude code which would cause the .EXE to not run as quickly or as efficiently as before. I'm not pointing fingers. I just wanted to know if there's been any possible performance changes because of the bug fix. If not I'll look somewhere else. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail
RE: [Declude.JunkMail] 2005 SpamHeaders - Fix
I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. Under the assumption this was caused by one of my few minor changes before the New Year I reversed all changes made the week before the New Year. Still the processor is maxed out. Any thoughts, any ideas? I don't want to go through and comment out each test one at a time to find which the offender is. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Tuesday, January 04, 2005 10:18 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix Hi, Scott, et.al, I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. I don't know if I'm getting his with a new wave of spam and the server's straining to keep up or if there might be something in the new Declude code which would cause the .EXE to not run as quickly or as efficiently as before. I'm not pointing fingers. I just wanted to know if there's been any possible performance changes because of the bug fix. If not I'll look somewhere else. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2005 SpamHeaders - Fix
I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. When you go to the Process tab in the Task Manager, and click on the CPU button, which process(es) are nearest to the top? Note that this should not be related to the SPAMHEADERS issue. Did you make any changes to the Declude configuration recently (such as adding filters, which can eat up CPU time, depending on what they do and how they are designed)? I don't want to go through and comment out each test one at a time to find which the offender is. If it does come to that, you can do it the binary way. First, comment out 1/2 the tests. If the problem continues, uncomment the ones you just commented out, and comment out 1/2 of the ones that you did not comment out (if the problem does not continue, do the opposite -- uncomment 1/2 of the ones that you commented out originally). If you have 30 tests, you'll only have to do this 5 times. The drawback is that during the few minutes you are doing this, spam is more likely to come through. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2005 SpamHeaders - Fix
The CPU spike is probably do to sheer volume. What is the current volume of messages being processed? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Joshua M. Hughes Sent: Wednesday, January 05, 2005 8:22 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. Under the assumption this was caused by one of my few minor changes before the New Year I reversed all changes made the week before the New Year. Still the processor is maxed out. Any thoughts, any ideas? I don't want to go through and comment out each test one at a time to find which the offender is. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Tuesday, January 04, 2005 10:18 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix Hi, Scott, et.al, I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. I don't know if I'm getting his with a new wave of spam and the server's straining to keep up or if there might be something in the new Declude code which would cause the .EXE to not run as quickly or as efficiently as before. I'm not pointing fingers. I just wanted to know if there's been any possible performance changes because of the bug fix. If not I'll look somewhere else. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 2005 SpamHeaders - Fix
Have you added a lot of filters? These tend to run up the CPU. Are you currently experiencing a dictionary attack? Are you still seeing a normal mail pattern? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Joshua M. Hughes writes: I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. Under the assumption this was caused by one of my few minor changes before the New Year I reversed all changes made the week before the New Year. Still the processor is maxed out. Any thoughts, any ideas? I don't want to go through and comment out each test one at a time to find which the offender is. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Tuesday, January 04, 2005 10:18 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix Hi, Scott, et.al, I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. I don't know if I'm getting his with a new wave of spam and the server's straining to keep up or if there might be something in the new Declude code which would cause the .EXE to not run as quickly or as efficiently as before. I'm not pointing fingers. I just wanted to know if there's been any possible performance changes because of the bug fix. If not I'll look somewhere else. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2005 SpamHeaders - Fix -
Sorted by CPU the system process is first and second is a toss up between declude, smtpd32, and queuemgr followed by as many as 16 simultaneous instances of declude with cpu between 1 and 4. The system is running at 45 to 60 and at times Declude shows up first between 45 and 60. When I change the delivery application to smtp32.exe the system process drops between 8 to 11 and finally the top of the list is the system idle process. No knew filters have been added. In the global.cfg file there was a whitelisted address and a whitelisted domain. For the whitelisted domain I created a folder in the imail\delcude Folder for that domain with a blank $default$.junkmail. For the one whitelisted address a I created a folder for that domain in the imail\declude folder with the $default$.junkmail copy not blank and created a blank user.junkmail file for that user. These changes have been reversed and still have not solved the issue. Does creating a domain folder with a blank $default$.junkamil file, as compared to whitelisting a domain in the global.cfg, use more processing power? Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, January 05, 2005 12:02 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. When you go to the Process tab in the Task Manager, and click on the CPU button, which process(es) are nearest to the top? Note that this should not be related to the SPAMHEADERS issue. Did you make any changes to the Declude configuration recently (such as adding filters, which can eat up CPU time, depending on what they do and how they are designed)? I don't want to go through and comment out each test one at a time to find which the offender is. If it does come to that, you can do it the binary way. First, comment out 1/2 the tests. If the problem continues, uncomment the ones you just commented out, and comment out 1/2 of the ones that you did not comment out (if the problem does not continue, do the opposite -- uncomment 1/2 of the ones that you commented out originally). If you have 30 tests, you'll only have to do this 5 times. The drawback is that during the few minutes you are doing this, spam is more likely to come through. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2005 SpamHeaders - Fix
I am currently seeing a normal mail pattern. The Imail Daily report actually reported slightly less smtp deliveries yesterday than normal. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, January 05, 2005 12:40 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix Have you added a lot of filters? These tend to run up the CPU. Are you currently experiencing a dictionary attack? Are you still seeing a normal mail pattern? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Joshua M. Hughes writes: I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. Under the assumption this was caused by one of my few minor changes before the New Year I reversed all changes made the week before the New Year. Still the processor is maxed out. Any thoughts, any ideas? I don't want to go through and comment out each test one at a time to find which the offender is. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Tuesday, January 04, 2005 10:18 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix Hi, Scott, et.al, I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. I don't know if I'm getting his with a new wave of spam and the server's straining to keep up or if there might be something in the new Declude code which would cause the .EXE to not run as quickly or as efficiently as before. I'm not pointing fingers. I just wanted to know if there's been any possible performance changes because of the bug fix. If not I'll look somewhere else. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2005 SpamHeaders - Fix -
Sorted by CPU the system process is first and second is a toss up between declude, smtpd32, and queuemgr followed by as many as 16 simultaneous instances of declude with cpu between 1 and 4. That normal indicates an above average volume of mail (or, in other words, the system is at full capacity). However, the fact that shutting off Declude lowers the CPU usage to 13-20% would indicate that Declude is using more CPU time than it normally should (which could be normal, depending on what filters you have set up). Does creating a domain folder with a blank $default$.junkamil file, as compared to whitelisting a domain in the global.cfg, use more processing power? No, both will use almost exactly the same amount of CPU time. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 2005 SpamHeaders - Fix -
It is normal to see Declude spike from time to time. If you are seeing a lot of Declude processes just sitting there in your task manager using very little to no CPU I would check to make sure your not using any RBL's that are old or just check in general that your DNS server is responding to RBL query's. Do you see anything out of the ordinary in your logs? Darrell Joshua M. Hughes writes: Sorted by CPU the system process is first and second is a toss up between declude, smtpd32, and queuemgr followed by as many as 16 simultaneous instances of declude with cpu between 1 and 4. The system is running at 45 to 60 and at times Declude shows up first between 45 and 60. When I change the delivery application to smtp32.exe the system process drops between 8 to 11 and finally the top of the list is the system idle process. No knew filters have been added. In the global.cfg file there was a whitelisted address and a whitelisted domain. For the whitelisted domain I created a folder in the imail\delcude Folder for that domain with a blank $default$.junkmail. For the one whitelisted address a I created a folder for that domain in the imail\declude folder with the $default$.junkmail copy not blank and created a blank user.junkmail file for that user. These changes have been reversed and still have not solved the issue. Does creating a domain folder with a blank $default$.junkamil file, as compared to whitelisting a domain in the global.cfg, use more processing power? Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, January 05, 2005 12:02 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. When you go to the Process tab in the Task Manager, and click on the CPU button, which process(es) are nearest to the top? Note that this should not be related to the SPAMHEADERS issue. Did you make any changes to the Declude configuration recently (such as adding filters, which can eat up CPU time, depending on what they do and how they are designed)? I don't want to go through and comment out each test one at a time to find which the offender is. If it does come to that, you can do it the binary way. First, comment out 1/2 the tests. If the problem continues, uncomment the ones you just commented out, and comment out 1/2 of the ones that you did not comment out (if the problem does not continue, do the opposite -- uncomment 1/2 of the ones that you commented out originally). If you have 30 tests, you'll only have to do this 5 times. The drawback is that during the few minutes you are doing this, spam is more likely to come through. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail
Re: [Declude.JunkMail] 2005 SpamHeaders - Fix
What about the size of the log files before and after. It would be helpful to post both the IMail and JunkMail log file sizes as this will give an idea about the volume. I'm not sure that the SMTP deliveries number reflects spam and viruses that Declude blocks. Another thing that would be helpful to know is what external tests you have configured in Declude (Sniffer, etc.). Note that it is expected that having Declude enabled will dramatically increase your CPU utilization. In short you are adding one or more virus scanners to the mix and also a ton of DNS lookups and other filters. Having CPU utilization increase without a change in volume (not yet ruled out) or the filters used however points to there being something wrong, but most likely not something wrong with Declude itself. Matt Joshua M. Hughes wrote: I am currently seeing a normal mail pattern. The Imail Daily report actually reported slightly less smtp deliveries yesterday than normal. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, January 05, 2005 12:40 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix Have you added a lot of filters? These tend to run up the CPU. Are you currently experiencing a dictionary attack? Are you still seeing a normal mail pattern? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Joshua M. Hughes writes: I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. Under the assumption this was caused by one of my few minor changes before the New Year I reversed all changes made the week before the New Year. Still the processor is maxed out. Any thoughts, any ideas? I don't want to go through and comment out each test one at a time to find which the offender is. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Geiser Sent: Tuesday, January 04, 2005 10:18 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix Hi, Scott, et.al, I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. I don't know if I'm getting his with a new wave of spam and the server's straining to keep up or if there might be something in the new Declude code which would cause the .EXE to not run as quickly or as efficiently as before. I'm not pointing fingers. I just wanted to know if there's been any possible performance changes because of the bug fix. If not I'll look somewhere else. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail
RE: [Declude.JunkMail] 2005 SpamHeaders - Fix -
Joshua, if I remember correctly, the IMail daily report shows you the number of messages inbound to your mailserver, but it does not show the number of recipients. You may be getting hit with a dictionary attack. Others on this list have seen this before in various guises. On my own mailserver, I've seen a large increase in the number of targeted addresses for each spam message. Declude will run through most (all?) of your configuration for each addressee on a message. Is your mailserver a gateway, or are the mailboxes local to that server? In other words, do you have envelope rejection? If the mailboxes are local, then you do have envelope rejection and you don't have to worry about extra processing time due to bogus addresses generated by the spammer. Then you're back to trying Scott's suggestion for doing a binary search for slow external tests or slow DNS tests. Oh, two other suggestions: Do a disk defrag, and check for swollen log sizes. On a busy server, adding a few lines of logging text to the end of a 30 MB file takes longer than you would want, and is exacerbated by a fragmented log file. Also, if you're using the SPF tests, check the size of your: c:\declude.log c:\spf.log c:\spf.none files, which will continuously grow. Because they do not have dated-based names, if you don't delete them, they will just get bigger. I'm now running v1.82 and those files are no longer being created. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joshua M. Hughes Sent: Wednesday, January 05, 2005 9:44 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix - Sorted by CPU the system process is first and second is a toss up between declude, smtpd32, and queuemgr followed by as many as 16 simultaneous instances of declude with cpu between 1 and 4. The system is running at 45 to 60 and at times Declude shows up first between 45 and 60. When I change the delivery application to smtp32.exe the system process drops between 8 to 11 and finally the top of the list is the system idle process. No knew filters have been added. In the global.cfg file there was a whitelisted address and a whitelisted domain. For the whitelisted domain I created a folder in the imail\delcude Folder for that domain with a blank $default$.junkmail. For the one whitelisted address a I created a folder for that domain in the imail\declude folder with the $default$.junkmail copy not blank and created a blank user.junkmail file for that user. These changes have been reversed and still have not solved the issue. Does creating a domain folder with a blank $default$.junkamil file, as compared to whitelisting a domain in the global.cfg, use more processing power? Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, January 05, 2005 12:02 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. When you go to the Process tab in the Task Manager, and click on the CPU button, which process(es) are nearest to the top? Note that this should not be related to the SPAMHEADERS issue. Did you make any changes to the Declude configuration recently (such as adding filters, which can eat up CPU time, depending on what they do and how they are designed)? I don't want to go through and comment out each test one at a time to find which the offender is. If it does come to that, you can do it the binary way. First, comment out 1/2 the tests. If the problem continues, uncomment the ones you just commented out, and comment out 1/2 of the ones that you did not comment out (if the problem does not continue, do the opposite -- uncomment 1/2 of the ones that you commented out originally). If you have 30 tests, you'll only have to do this 5 times. The drawback is that during the few minutes you are doing this, spam is more likely to come through. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask
RE: [Declude.JunkMail] 2005 SpamHeaders - Fix -
The mailboxes are local to the server. We're really not using many external tests unless you consider the several Filters an IPfile and a couple of fromfiles and spamdomains external. Other than that, all dns tests and predefined tests. I have not noticed a large increase in log file size. I looked at the log file size for both declude and smtp and they look pretty close to usual. Looks like I'm going to start the binary way... Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Wednesday, January 05, 2005 1:29 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix - Joshua, if I remember correctly, the IMail daily report shows you the number of messages inbound to your mailserver, but it does not show the number of recipients. You may be getting hit with a dictionary attack. Others on this list have seen this before in various guises. On my own mailserver, I've seen a large increase in the number of targeted addresses for each spam message. Declude will run through most (all?) of your configuration for each addressee on a message. Is your mailserver a gateway, or are the mailboxes local to that server? In other words, do you have envelope rejection? If the mailboxes are local, then you do have envelope rejection and you don't have to worry about extra processing time due to bogus addresses generated by the spammer. Then you're back to trying Scott's suggestion for doing a binary search for slow external tests or slow DNS tests. Oh, two other suggestions: Do a disk defrag, and check for swollen log sizes. On a busy server, adding a few lines of logging text to the end of a 30 MB file takes longer than you would want, and is exacerbated by a fragmented log file. Also, if you're using the SPF tests, check the size of your: c:\declude.log c:\spf.log c:\spf.none files, which will continuously grow. Because they do not have dated-based names, if you don't delete them, they will just get bigger. I'm now running v1.82 and those files are no longer being created. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joshua M. Hughes Sent: Wednesday, January 05, 2005 9:44 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix - Sorted by CPU the system process is first and second is a toss up between declude, smtpd32, and queuemgr followed by as many as 16 simultaneous instances of declude with cpu between 1 and 4. The system is running at 45 to 60 and at times Declude shows up first between 45 and 60. When I change the delivery application to smtp32.exe the system process drops between 8 to 11 and finally the top of the list is the system idle process. No knew filters have been added. In the global.cfg file there was a whitelisted address and a whitelisted domain. For the whitelisted domain I created a folder in the imail\delcude Folder for that domain with a blank $default$.junkmail. For the one whitelisted address a I created a folder for that domain in the imail\declude folder with the $default$.junkmail copy not blank and created a blank user.junkmail file for that user. These changes have been reversed and still have not solved the issue. Does creating a domain folder with a blank $default$.junkamil file, as compared to whitelisting a domain in the global.cfg, use more processing power? Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, January 05, 2005 12:02 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. When you go to the Process tab in the Task Manager, and click on the CPU button, which process(es) are nearest to the top? Note that this should not be related to the SPAMHEADERS issue. Did you make any changes to the Declude configuration recently (such as adding filters, which can eat up CPU time, depending on what they do and how they are designed)? I don't want to go through and comment out each test one at a time to find which the offender is. If it does come to that, you can do
Re: [Declude.JunkMail] 2005 SpamHeaders - Fix -
That would rule out an increase in volume, and also the potential of a bug with an external test. So if in fact no other changes were made as far as filters go, I would look at your system next (make absolutely sure that this is correct). Check the fragmentation on all partitions and defrag everything (multiple times until almost perfect). The way that IMail and Declude logs creates massively fragmented files, and even if you have a lot of disk space left over, the entire partition might be filled with fragments causing excessive slowdowns. If you are running RAID 5 or some sort of mirror, make sure that you aren't down a drive because that can cause similar slowdowns. Please also post the standard size of your IMail log just to give an impression of the volume that you are doing. Matt Joshua M. Hughes wrote: The mailboxes are local to the server. We're really not using many external tests unless you consider the several Filters an IPfile and a couple of fromfiles and spamdomains external. Other than that, all dns tests and predefined tests. I have not noticed a large increase in log file size. I looked at the log file size for both declude and smtp and they look pretty close to usual. Looks like I'm going to start the "binary way"... Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, Andrew Sent: Wednesday, January 05, 2005 1:29 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix - Joshua, if I remember correctly, the IMail daily report shows you the number of messages inbound to your mailserver, but it does not show the number of recipients. You may be getting hit with a "dictionary attack". Others on this list have seen this before in various guises. On my own mailserver, I've seen a large increase in the number of targeted addresses for each spam message. Declude will run through most (all?) of your configuration for each addressee on a message. Is your mailserver a gateway, or are the mailboxes local to that server? In other words, do you have envelope rejection? If the mailboxes are local, then you do have envelope rejection and you don't have to worry about extra processing time due to bogus addresses generated by the spammer. Then you're back to trying Scott's suggestion for doing a "binary search" for slow external tests or slow DNS tests. Oh, two other suggestions: Do a disk defrag, and check for swollen log sizes. On a busy server, adding a few lines of logging text to the end of a 30 MB file takes longer than you would want, and is exacerbated by a fragmented log file. Also, if you're using the SPF tests, check the size of your: c:\declude.log c:\spf.log c:\spf.none files, which will continuously grow. Because they do not have dated-based names, if you don't delete them, they will just get bigger. I'm now running v1.82 and those files are no longer being created. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Joshua M. Hughes Sent: Wednesday, January 05, 2005 9:44 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix - Sorted by CPU the system process is first and second is a toss up between declude, smtpd32, and queuemgr followed by as many as 16 simultaneous instances of declude with cpu between 1 and 4. The system is running at 45 to 60 and at times Declude shows up first between 45 and 60. When I change the delivery application to smtp32.exe the system process drops between 8 to 11 and finally the top of the list is the system idle process. No knew filters have been added. In the global.cfg file there was a whitelisted address and a whitelisted domain. For the whitelisted domain I created a folder in the imail\delcude Folder for that domain with a blank $default$.junkmail. For the one whitelisted address a I created a folder for that domain in the imail\declude folder with the $default$.junkmail "copy not blank" and created a blank user.junkmail file for that user. These changes have been reversed and still have not solved the issue. Does creating a domain folder with a blank $default$.junkamil file, as compared to whitelisting a domain in the global.cfg, use more processing power? Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Wednesday, January 05, 2005 12:02 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is st
RE: [Declude.JunkMail] 2005 SpamHeaders - Fix -
John, It took me a while to get these stats. I reviewed the SMTP logs for 12/4, 12/5, 12/7, 12/8. I know the server was running fine during this week. Usage is as follows. 12/4 - 83,170 messages 12/5 - 82,065 messages 12/7 - 95,087 messages 12/8 - 95,730 messages I reviewed the SMTP logs for the 1/2, 1/3, 1/4. These are current and usage is as follows. 1/1 - 59,717 messages 1/2 - 63,795 messages 1/3 - 78,945 messages 1/4 - 79,410 messages It appears as if the beginning of last month, when we were running fine, had a lot more messages being delivered. The only things I see in the log disturbing for today are: [EMAIL PROTECTED] 4.63.108.6= 1130 messages = 1068 messages I have an ipfile that I have set to automatically delete anything from the ip 4.63.108.6 because they have been the top sender of the log for three days. However, this messages is still being processed. Matt, Average SMTP log size is between 102MB to 200MB. This appears normal. The drive that the logs were on wasn't severely fragmented however, I de-fragmented it anyway. The drive that the spool directory is on is 86% free but about 60% fragmented. This drive could be de-fragmented however, I'm worried about de-fragmenting while the CPU is at 100%. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, January 05, 2005 12:17 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix The CPU spike is probably do to sheer volume. What is the current volume of messages being processed? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Joshua M. Hughes Sent: Wednesday, January 05, 2005 8:22 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. Under the assumption this was caused by one of my few minor changes before the New Year I reversed all changes made the week before the New Year. Still the processor is maxed out. Any thoughts, any ideas? I don't want to go through and comment out each test one at a time to find which the offender is. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Tuesday, January 04, 2005 10:18 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix Hi, Scott, et.al, I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. I don't know if I'm getting his with a new wave of spam and the server's straining to keep up or if there might be something in the new Declude code which would cause the .EXE to not run as quickly or as efficiently as before. I'm not pointing fingers. I just wanted to know if there's been any possible performance changes because of the bug fix. If not I'll look somewhere else. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com
Re: [Declude.JunkMail] 2005 SpamHeaders - Fix -
A 200 MB normal IMail log file (not set to verbose or debug) would correspond to more than 200,000 messages on my system. I don't log POP3 stuff though, so that might also explain the difference. Please zip up yesterday's Declude JunkMail log and post it to a Web site somewhere and send me the link off-list and I will stats on it to determine how many messages that Declude processed. I'm still suspecting volume might be the issue, and it is generally the most likely culprit and deserves extra attention. It could be that you have a customer bulk-mailing through your server. People get a copy of Microsoft Office these days and set up their own newsletters using their provider's SMTP server. I don't believe that 60% fragmentation would cause a significant slowdown, though you would get slightly better performance when defraged, so do that regularly and as soon as it makes sense. Just to keep one step ahead, why don't you indicate which virus scanners you are running (with versions) and confirm your settings in Declude Virus for "PRESCAN" being ON or OFF. Matt Joshua M. Hughes wrote: John, It took me a while to get these stats. I reviewed the SMTP logs for 12/4, 12/5, 12/7, 12/8. I know the server was running fine during this week. Usage is as follows. 12/4 - 83,170 messages 12/5 - 82,065 messages 12/7 - 95,087 messages 12/8 - 95,730 messages I reviewed the SMTP logs for the 1/2, 1/3, 1/4. These are current and usage is as follows. 1/1 - 59,717 messages 1/2 - 63,795 messages 1/3 - 78,945 messages 1/4 - 79,410 messages It appears as if the beginning of last month, when we were running fine, had a lot more messages being delivered. The only things I see in the log disturbing for today are: [EMAIL PROTECTED] 4.63.108.6 = 1130 messages = 1068 messages I have an ipfile that I have set to automatically delete anything from the ip 4.63.108.6 because they have been the top sender of the log for three days. However, this messages is still being processed. Matt, Average SMTP log size is between 102MB to 200MB. This appears normal. The drive that the logs were on wasn't severely fragmented however, I de-fragmented it anyway. The drive that the spool directory is on is 86% free but about 60% fragmented. This drive could be de-fragmented however, I'm worried about de-fragmenting while the CPU is at 100%. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, January 05, 2005 12:17 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix The CPU spike is probably do to sheer volume. What is the current volume of messages being processed? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED]] On Behalf Of Joshua M. Hughes Sent: Wednesday, January 05, 2005 8:22 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. Under the assumption this was caused by one of my few minor changes before the New Year I reversed all changes made the week before the New Year. Still the processor is maxed out. Any thoughts, any ideas? I don't want to go through and comment out each test one at a time to find which the offender is. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Geiser Sent: Tuesday, January 04, 2005 10:18 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix Hi, Scott, et.al, I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. I don't know if I'm getting his with a new wave of spam and the server's straining to keep up or if there might be something in the new Declude code which would cause the .EXE to not run as quickly or as efficiently as before. I'm not pointing fingers. I just wanted to know if there'
Re: [Declude.JunkMail] 2005 SpamHeaders - Fix -
Joshua- How many files do you have in your spool? Anytime I've had this problem there has been a corresponding increase in the spool contents. I agree with Matt that it may well be a user sending high volumes of SMTP traffic through your server. It doesn't have to be a lot of messages, but if they are very large that can cause problems. We have a bunch of employment and temp agencies, and they cause us trouble sometimes because they tend to send large attachments. Also look for a dictionary attack against a domain with a nobody alias. -Dave Doherty Skywaves, inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 2005 SpamHeaders - Fix
This appears to be working as desired. Thanks! Matt Barry Simpson wrote: All of the input and suggestions as to how issues like this could be handled has been noted and I thank you for your input We will be posting the updated, fixed .exe on our site tomorrow. For those who have current service agreements please feel free to download it now from the following link. For those who are running an older system without a Service Agreement please email us your version and contact details to [EMAIL PROTECTED] and we will arrange an alternative version. http://www.declude.com/version/182/declude.zip 1. Replace current declude.exe with this declude executable 2. At command prompt go to your IMail Directory 3. Type Declude and enter - it should show version 1.82 Barry --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 2005 SpamHeaders - Fix
I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. Were you running v1.81 before, or a different version? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 2005 SpamHeaders - Fix
Hi, Scott, et.al, I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. I don't know if I'm getting his with a new wave of spam and the server's straining to keep up or if there might be something in the new Declude code which would cause the .EXE to not run as quickly or as efficiently as before. I'm not pointing fingers. I just wanted to know if there's been any possible performance changes because of the bug fix. If not I'll look somewhere else. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 2005 SpamHeaders - Fix
Scott, I was running 1.81. Thanks, Dan - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, January 04, 2005 10:25 AM Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. Were you running v1.81 before, or a different version? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2005 SpamHeaders - Fix
I moved from 1.81 to 1.82 this morning and I am not seeing any extra cpu load, so it doesn't seem to be universal. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Tuesday, January 04, 2005 10:35 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix Scott, I was running 1.81. Thanks, Dan - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, January 04, 2005 10:25 AM Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. Were you running v1.81 before, or a different version? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2005 SpamHeaders - Fix
I moved from 1.81 to 1.82 this morning and I am not seeing any extra cpu load, so it doesn't seem to be universal. I moved from the last full release..1.75? To 1.82 this morning and things seem fine here. Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged Best in the World at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) htmla href=http://www.cruzanrums.com;www.cruzanrums.com/a/html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] 2005 SpamHeaders - Fix
All of the input and suggestions as to how issues like this could be handled has been noted and I thank you for your input We will be posting the updated, fixed .exe on our site tomorrow. For those who have current service agreements please feel free to download it now from the following link. For those who are running an older system without a Service Agreement please email us your version and contact details to [EMAIL PROTECTED] and we will arrange an alternative version. http://www.declude.com/version/182/declude.zip 1. Replace current declude.exe with this declude executable 2. At command prompt go to your IMail Directory 3. Type Declude and enter - it should show version 1.82 Barry --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 2005 SpamHeaders - Fix
Thanks Barry and Scott... much appreciated! I'm sure all of the customers, on and off of service agreements appreciate you making appropriate versions with fixes available to them. Darin. - Original Message - From: Barry Simpson [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, January 03, 2005 9:11 PM Subject: [Declude.JunkMail] 2005 SpamHeaders - Fix All of the input and suggestions as to how issues like this could be handled has been noted and I thank you for your input We will be posting the updated, fixed .exe on our site tomorrow. For those who have current service agreements please feel free to download it now from the following link. For those who are running an older system without a Service Agreement please email us your version and contact details to [EMAIL PROTECTED] and we will arrange an alternative version. http://www.declude.com/version/182/declude.zip 1. Replace current declude.exe with this declude executable 2. At command prompt go to your IMail Directory 3. Type Declude and enter - it should show version 1.82 Barry --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
