re: [Declude.JunkMail] Declude queue alert
Hi Harry, Below is a script I copied from the list long ago - edit as applicable for your setup, save it as a .vbs file and run it every 15 min or so -Nick fHold1 = \\192.168.254.23\goofy\imail\spool fHold2 = \\192.168.254.23\goofy\imail\spool\proc aMail = e:\imail\imail1.exe mFrom = -u 'spamstar2.moni...@madriveraccess.com' mTo = -t 'n...@madriveraccess.com' if GetFileCount(fHold1) 300 then MailNotice Imail Spool, GetFileCount(fHold1), mTo end if if GetFileCount(fHold2) 300 then MailNotice Imail\spool\proc, GetFileCount(fHold2), mTo end if Function GetFileCount(folderspec) Dim fso, f, f1, fc Set fso = CreateObject(Scripting.FileSystemObject) Set f = fso.GetFolder(folderspec) Set fc = f.Files GetFileCount = fc.count End Function Function MailNotice(fname, fcount, mTo) Dim mCmd, mSubj, WshShell set WshShell = WScript.CreateObject(WScript.Shell) mSubj = -s 'SPAMSTAR2(192.168.254.23) Mail held in fname : fcount ' mCmd = aMail mFrom mTo mSubj -f Return = WshShell.Run(mCmd , 1, TRUE) End Function MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: Harry Vanderzand ha...@intown.net Sent: Wednesday, August 25, 2010 9:52 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Declude queue alert Is there any way that the system can give me an alert when the Declude queue fills up past a certain point? There have been a couple of cases recently that have caused Declude to stop processing. The mail backs up in the queue and I only realize it when someone complains or I notice that no mail has come in for a while. I then restart the service and processing starts up again. If I were to get an alert that say, 500 items were in the queue then I would know there is a problem. Thank you Please note our new Address Harry Vanderzand Intown Internet 740 Erbsville Road Waterloo, On, N2J 3Z4 519-741-1222 DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying,or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Thank you. --- [This E-mail was checked by Declude] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude queue alert * complete solution *
Heres the solution I implemented years ago with David. Simply create 2 batch files: 1. One that checks if the review folder is empty (could be usefull) 2. One that checks if the Proc is over 500 !!! Using these 2 batch files, you can create a Scheduled task that runs every 10-15-20 minutes as you wish. For the Proc over 500, you should use a different SMTP than yours We are using the free Blat tool to send us emails or notifications. Blat.org I believe. And we also use a zip tool to send the content of the folder along in the email. You also need to change all the paths according to you. Thanks Stephan Chayer IntraSoft Solutions 450-581-2297 File: reviewfolder.cmd @echo off dir d:\imailspool\proc\review\*.smd c:\imail\scripts\review.txt :: echo %errorlevel% if %errorlevel% == 1 goto empty :: 1 = empty ( quit ) :: 0 = send email to admin c:\winnt\BLAT c:\imail\scripts\review.txt -s NS1 Declude Review Folder not empty -t mana...@yourdomain.com -server (IP of smtp) -f mana...@yourdomain.com :empty File : decludeproc500.cmd @echo off :: SEND DIR TO A FILE dir d:\imailspool\proc\*.smd c:\imail\scripts\decludeproc.txt If %errorlevel% == 1 goto DecProcUnder500 :: 1 = empty ( quit ) :: 0 = envoi d'un email a l'admin :: SEND FILE COUNT TO A FILE dir /b d:\Imailspool\proc | find /c /v c:\imail\scripts\proc.txt :: READ UP TO 4 VARIABLES IN THE SPECIFIED FILE FOR /F tokens=1,2,3,4 delims= %%i in (c:\imail\scripts\proc.txt) do ( set var1=%%i set var2=%%j set var3=%%k set var4=%%l ) If %var1% LSS 500 goto DecProcUnder500 :: IF COMPARISON EXPRESSION :: EQU - equal NEQ - not equal LSS - less than LEQ - less than or equal :: GTR - greater than GEQ - greater than or equal :: DECLUDE OVER 500, PLEASE CHECK :: SHOULD USE AN EXTERNAL SMTP TO MAKE SURE ADMIN IS NOTIFIED echo Verify Declude Proc for issues zip -r -S -q -v over500declude decludeproc.txt c:\winnt\BLAT c:\imail\scripts\procco500body.txt -attach c:\imail\scripts\over500declude.zip -s Declude Proc directory over 500 -t em...@yourdomain.com -server (IP or name of smtp server) -f em...@yourdomain.com goto end :DecProcUnder500 echo Declude Proc OK :end The file procco500body.txt has simply one line inside: Declude over 500, do something !! De : supp...@declude.com [mailto:supp...@declude.com] De la part de Harry Vanderzand Envoyé : 25 août, 2010 9:43 À : declude.junkmail@declude.com Objet : [Declude.JunkMail] Declude queue alert Is there any way that the system can give me an alert when the Declude queue fills up past a certain point? There have been a couple of cases recently that have caused Declude to stop processing. The mail backs up in the queue and I only realize it when someone complains or I notice that no mail has come in for a while. I then restart the service and processing starts up again. If I were to get an alert that say, 500 items were in the queue then I would know there is a problem. Thank you Please note our new Address Harry Vanderzand Intown Internet 740 Erbsville Road Waterloo, On, N2J 3Z4 519-741-1222 DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying,or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Thank you. --- [This E-mail was checked by Declude] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude queue alert
I used to use this in the past when we were using iMail, and it worked very well. But we've since switched to SmarterMail. Does anyone know what to call instead of imail1.exe? Would it be the mailserver.exe file, located in the Program Files\Smarter Tools\SmarterMail\Service folder? Todd From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Nick Hayer Sent: Wednesday, August 25, 2010 9:04 AM To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] Declude queue alert Hi Harry, Below is a script I copied from the list long ago - edit as applicable for your setup, save it as a .vbs file and run it every 15 min or so -Nick fHold1 = \\192.168.254.23\goofy\imail\spool file:///\\192.168.254.23\goofy\imail\spool fHold2 = \\192.168.254.23\goofy\imail\spool\proc file:///\\192.168.254.23\goofy\imail\spool\proc aMail = e:\imail\imail1.exe mFrom = -u 'spamstar2.moni...@madriveraccess.com' mTo = -t 'n...@madriveraccess.com' if GetFileCount(fHold1) 300 then MailNotice Imail Spool, GetFileCount(fHold1), mTo end if if GetFileCount(fHold2) 300 then MailNotice Imail\spool\proc, GetFileCount(fHold2), mTo end if Function GetFileCount(folderspec) Dim fso, f, f1, fc Set fso = CreateObject(Scripting.FileSystemObject) Set f = fso.GetFolder(folderspec) Set fc = f.Files GetFileCount = fc.count End Function Function MailNotice(fname, fcount, mTo) Dim mCmd, mSubj, WshShell set WshShell = WScript.CreateObject(WScript.Shell) mSubj = -s 'SPAMSTAR2(192.168.254.23) Mail held in fname : fcount ' mCmd = aMail mFrom mTo mSubj -f Return = WshShell.Run(mCmd , 1, TRUE) End Function MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm _ From: Harry Vanderzand ha...@intown.net Sent: Wednesday, August 25, 2010 9:52 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Declude queue alert Is there any way that the system can give me an alert when the Declude queue fills up past a certain point? There have been a couple of cases recently that have caused Declude to stop processing. The mail backs up in the queue and I only realize it when someone complains or I notice that no mail has come in for a while. I then restart the service and processing starts up again. If I were to get an alert that say, 500 items were in the queue then I would know there is a problem. Thank you Please note our new Address Harry Vanderzand Intown Internet 740 Erbsville Road Waterloo, On, N2J 3Z4 519-741-1222 DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying,or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Thank you. --- [This E-mail was checked by Declude] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was checked by Declude] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude queue alert
Of course - thanks Nick! Todd From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Nick Hayer Sent: Wednesday, August 25, 2010 12:13 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude queue alert dunno - but for sure you could use cdosys -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm _ From: Todd Richards to...@nnepa.com Sent: Wednesday, August 25, 2010 11:56 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude queue alert I used to use this in the past when we were using iMail, and it worked very well. But we've since switched to SmarterMail. Does anyone know what to call instead of imail1.exe? Would it be the mailserver.exe file, located in the Program Files\Smarter Tools\SmarterMail\Service folder? Todd From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Nick Hayer Sent: Wednesday, August 25, 2010 9:04 AM To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] Declude queue alert Hi Harry, Below is a script I copied from the list long ago - edit as applicable for your setup, save it as a .vbs file and run it every 15 min or so -Nick fHold1 = \\192.168.254.23\goofy\imail\spool file:///\\%5C%5C192.168.254.23%5Cgoofy%5Cimail%5Cspool fHold2 = \\192.168.254.23\goofy\imail\spool\proc file:///\\%5C%5C192.168.254.23%5Cgoofy%5Cimail%5Cspool%5Cproc aMail = e:\imail\imail1.exe mFrom = -u 'spamstar2.moni...@madriveraccess.com' mTo = -t 'n...@madriveraccess.com' if GetFileCount(fHold1) 300 then MailNotice Imail Spool, GetFileCount(fHold1), mTo end if if GetFileCount(fHold2) 300 then MailNotice Imail\spool\proc, GetFileCount(fHold2), mTo end if Function GetFileCount(folderspec) Dim fso, f, f1, fc Set fso = CreateObject(Scripting.FileSystemObject) Set f = fso.GetFolder(folderspec) Set fc = f.Files GetFileCount = fc.count End Function Function MailNotice(fname, fcount, mTo) Dim mCmd, mSubj, WshShell set WshShell = WScript.CreateObject(WScript.Shell) mSubj = -s 'SPAMSTAR2(192.168.254.23) Mail held in fname : fcount ' mCmd = aMail mFrom mTo mSubj -f Return = WshShell.Run(mCmd , 1, TRUE) End Function MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm _ From: Harry Vanderzand ha...@intown.net Sent: Wednesday, August 25, 2010 9:52 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Declude queue alert Is there any way that the system can give me an alert when the Declude queue fills up past a certain point? There have been a couple of cases recently that have caused Declude to stop processing. The mail backs up in the queue and I only realize it when someone complains or I notice that no mail has come in for a while. I then restart the service and processing starts up again. If I were to get an alert that say, 500 items were in the queue then I would know there is a problem. Thank you Please note our new Address Harry Vanderzand Intown Internet 740 Erbsville Road Waterloo, On, N2J 3Z4 519-741-1222 DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying,or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Thank you. --- [This E-mail was checked by Declude] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was checked by Declude] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was checked by Declude] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was checked by Declude] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can
Re: [Declude.JunkMail] Declude Queue
Is there a way to turn off Declude Queue? Yes, but it's kind of like turning off your car engine -- you can do it, but can't do much of anything else until you turn it back on. Somehow, it seems that Declude is thinking there is a problem and is putting all Q into the overflow file. However, the spool only has a couple hundred files. That's because there *is* a problem. The number of files in the spool isn't very important. All that Declude Queue looks at is the total number of running processes that it knows were started by services (the ones that cause Microsoft to crash the server if there are too many of them). So if the number of Declude.exe and SMTP32.exe processes is fairly high (around 30), there's a reason that Declude Queue is doing this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Queue
Somehow, it seems that Declude is thinking there is a problem and is putting all Q into the overflow file. However, the spool only has a couple hundred files. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Tuesday, December 16, 2003 7:40 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude Queue Is there a way to turn off Declude Queue? John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Queue Question
Is there any trick to getting declude queue to work? No -- it just works. I came in to work to see 5000+ messages in my spool directory, and a bunch of popups since the machine ran out of memory and could no longer allocate space to the new processes. It has happened in the past several times, not real often, but it happens. That's a different (but related) issue -- Declude Queue can't prevent the popups (although the most recent versions make it very difficult for the popups to occur. Once the popups start, they usually can't be stopped (thanks, Microsoft!) -- when this happens, the E-mails will accumulate in the spool directory, and Declude Queue won't get a chance to handle those E-mails until after the situation has resolved (when it is likely too late for Declude Queue to do anything about it). I have never noticed declude queuing any messages, and my max processes for smtpd is set to 15. In this case, Declude Queue should start working when you have a total of 15 service-started processes in memory (such as SMTP32.exe and Declude.exe). When this happens, Declude Queue will move new E-mails -- ones that IMail would otherwise push to the queue for later delivery -- into the \IMail\spool\overflow directory, until IMail has free processes available. Once the E-mails are delivered (or delivery is attempted), you won't see any trace of them in the \IMail\spool\overflow directory. Unfortunately, there is no easy way to test that it is working, but it should just work (there isn't anything to configure). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] declude queue / imail spool problems?
I am having some trouble with my mail server. About once a week, I find my spool folder overflowing. There are usually only about 200 files in that folder, but when this weird thing happens, there are 5000+ in both the spool and in the overflow folder. If there are lots of D*.SMD files in the spool directory, and lots of Q*.SMD files in the overflow directory, then IMail reached its maximum capacity and Declude Queue took over. Without Declude Queue, you would have seen all those files in the spool directory, and they would get sent out more slowly. If I move all the files from the overflow back into the spool, they clear out pretty quickly, but more keep showing up in the overflow at a rate of about 100 per few minutes. What could be causing this? Where do I start to try to figure it out. There is nothing unusual in the imail log and there is nothing about queue in any of the logs. If you run regedit, what is the entry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SMTPD32\Parameters\MaxQueProc set to? That controls how many processes can be running at once. If your server is capable, you could try increasing that value. Specifically, Declude Queue will start moving those files to the overflow directory when the maximum number of processes is reached (at which point IMail would normally keep the file in the queue, and not even attempt to deliver it until the next queue run, typically 20-30 minutes later). What you really need to do is find out *why* so much E-mail is being sent/received; in many cases, it is a spammer or other undesirable (such as a mail loop). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] declude queue / imail spool problems?
Here's what I did to fix it: 1) I turned off declude junkmail (by renaming the global.cfg file) 2) Moved all the files from the overflow directory to the spool directory They all cleared out and things are back to normal. Now (an hour after i turned junkmail off) I am going to turn junkmail back on and see what happens. From what I could tell, most of the extra email was spam. I could not find any trace of a mail loop, though. Our mail server is a Dell 2450 with 2 866processors and 512mb ram. it has a caching raid controller and some very fast drives. How high do you think I could get away with setting that max processes value? In the imail admin for 7.11 there is an advanced tab under the smtp service. One of the values that can be set there is max processes. Is this the same thing? Thanks, Jim - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 18, 2002 12:37 PM Subject: Re: [Declude.JunkMail] declude queue / imail spool problems? I am having some trouble with my mail server. About once a week, I find my spool folder overflowing. There are usually only about 200 files in that folder, but when this weird thing happens, there are 5000+ in both the spool and in the overflow folder. If there are lots of D*.SMD files in the spool directory, and lots of Q*.SMD files in the overflow directory, then IMail reached its maximum capacity and Declude Queue took over. Without Declude Queue, you would have seen all those files in the spool directory, and they would get sent out more slowly. If I move all the files from the overflow back into the spool, they clear out pretty quickly, but more keep showing up in the overflow at a rate of about 100 per few minutes. What could be causing this? Where do I start to try to figure it out. There is nothing unusual in the imail log and there is nothing about queue in any of the logs. If you run regedit, what is the entry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SMTPD32\Parameters\MaxQ ueProc set to? That controls how many processes can be running at once. If your server is capable, you could try increasing that value. Specifically, Declude Queue will start moving those files to the overflow directory when the maximum number of processes is reached (at which point IMail would normally keep the file in the queue, and not even attempt to deliver it until the next queue run, typically 20-30 minutes later). What you really need to do is find out *why* so much E-mail is being sent/received; in many cases, it is a spammer or other undesirable (such as a mail loop). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] declude queue / imail spool problems?
Here's what I did to fix it: 1) I turned off declude junkmail (by renaming the global.cfg file) 2) Moved all the files from the overflow directory to the spool directory They all cleared out and things are back to normal. Now (an hour after i turned junkmail off) I am going to turn junkmail back on and see what happens. Note that you also did something else here -- by turning off Declude JunkMail, you sped up delivery of *new* E-mails, especially if you are using an old spam test that times out (causing the E-mail to be in memory for 10+ extra seconds). That may be a factor. From what I could tell, most of the extra email was spam. It sounds like you may be dealing with a massive distributed spam attack, where a spammer compromises thousands of computers, and sends spam via a dictionary-like attack (sending to thousands and thousands of made-up addresses, hoping a few will receive the E-mail). If you have a nobody alias, this can shut down your server. Our mail server is a Dell 2450 with 2 866processors and 512mb ram. it has a caching raid controller and some very fast drives. How high do you think I could get away with setting that max processes value? It's impossible to say -- only trial and error will tell for sure. The problem is that Microsoft doesn't document the pertinent information about the problem. The problem is that if you go too high, Microsoft will run out of a special type of memory and choke, causing all new processes to fail upon loading. With the best information we can get from Microsoft, it shouldn't be possible for this to happen with recent versions of Declude (although it definitely will happen without Declude). A value of 30 is the default, so if it is lower, you should be able to raise it to 30 with no problem. In the imail admin for 7.11 there is an advanced tab under the smtp service. One of the values that can be set there is max processes. Is this the same thing? Ah, yes -- I forgot about that (a nice new feature). That is the same thing. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] declude queue / imail spool problems?
I turned it back on and the number of files in the spool started growing at a very fast pace. I'm running declude v1.53 if that helps. We do get lots of dictionary attacks, but they don't actually get in as files do they? don't the emails to bogus users get rejected before they are written to a file? The part about dead tests sounds interesting. Below is a list of the tests that I am running... Thanks, Jim #ORBZIN ip4r inputs.orbz.org 127.0.0.2 5 0 #ORBZOUT ip4r outputs.orbz.org 127.0.0.2 5 0 ORDB ip4r relays.ordb.org * 14 0 OSDUL ip4rrelays.osirusoft.com 127.0.0.3 15 0 OSFORM ip4rrelays.osirusoft.com 127.0.0.8 15 0 OSLIST ip4rrelays.osirusoft.com 127.0.0.7 15 0 OSRELAY ip4rrelays.osirusoft.com 127.0.0.2 14 0 OSSMART ip4rrelays.osirusoft.com 127.0.0.5 15 0 OSSOFT ip4rrelays.osirusoft.com 127.0.0.6 15 0 OSSRC ip4rrelays.osirusoft.com 127.0.0.4 15 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 25 0 DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 15 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 15 0 NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 15 0 ADULT adult x x 30 0 BADHEADERS badheaders x x 10 0 MAILFROMenvfrom x x 15 0 PERCENT percent x x 15 0 REVDNS revdnsexists x x 15 0 ROUTING spamrouting x x 15 0 SPAMHEADERS spamheaders x x 15 0 SNIFFER external nonzero e:\imail\declude\Sniffer\sniffer.exe 29 0 WEIGHT weight x x 30 0 - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 18, 2002 12:59 PM Subject: Re: [Declude.JunkMail] declude queue / imail spool problems? Here's what I did to fix it: 1) I turned off declude junkmail (by renaming the global.cfg file) 2) Moved all the files from the overflow directory to the spool directory They all cleared out and things are back to normal. Now (an hour after i turned junkmail off) I am going to turn junkmail back on and see what happens. Note that you also did something else here -- by turning off Declude JunkMail, you sped up delivery of *new* E-mails, especially if you are using an old spam test that times out (causing the E-mail to be in memory for 10+ extra seconds). That may be a factor. From what I could tell, most of the extra email was spam. It sounds like you may be dealing with a massive distributed spam attack, where a spammer compromises thousands of computers, and sends spam via a dictionary-like attack (sending to thousands and thousands of made-up addresses, hoping a few will receive the E-mail). If you have a nobody alias, this can shut down your server. Our mail server is a Dell 2450 with 2 866processors and 512mb ram. it has a caching raid controller and some very fast drives. How high do you think I could get away with setting that max processes value? It's impossible to say -- only trial and error will tell for sure. The problem is that Microsoft doesn't document the pertinent information about the problem. The problem is that if you go too high, Microsoft will run out of a special type of memory and choke, causing all new processes to fail upon loading. With the best information we can get from Microsoft, it shouldn't be possible for this to happen with recent versions of Declude (although it definitely will happen without Declude). A value of 30 is the default, so if it is lower, you should be able to raise it to 30 with no problem. In the imail admin for 7.11 there is an advanced tab under the smtp service. One of the values that can be set there is max processes. Is this the same thing? Ah, yes -- I forgot about that (a nice new feature). That is the same thing. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] declude queue / imail spool problems?
We do get lots of dictionary attacks, but they don't actually get in as files do they? That depends. If you have a nobody alias, they do come in as files, and are processed by Declude. If you do not have a nobody alias, then they will not be processed (by IMail or Declude). don't the emails to bogus users get rejected before they are written to a file? Yes -- if there is no nobody alias. The part about dead tests sounds interesting. Below is a list of the tests that I am running... All of those tests are still around, so that shouldn't account for the problem. Have you tried looking at the logs to see why there is so much mail? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] declude queue / imail spool problems?
OK, I confirmed that there are no nobody aliases. I will start pouring through the logs... is there a program that would make that any easier? Thanks, Jim - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 18, 2002 1:54 PM Subject: Re: [Declude.JunkMail] declude queue / imail spool problems? We do get lots of dictionary attacks, but they don't actually get in as files do they? That depends. If you have a nobody alias, they do come in as files, and are processed by Declude. If you do not have a nobody alias, then they will not be processed (by IMail or Declude). don't the emails to bogus users get rejected before they are written to a file? Yes -- if there is no nobody alias. The part about dead tests sounds interesting. Below is a list of the tests that I am running... All of those tests are still around, so that shouldn't account for the problem. Have you tried looking at the logs to see why there is so much mail? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
