Re: [Declude.JunkMail] Still working on Spool overflow
The first thing to do is to switch from F-Prot.exe (16-bit) to fpcmd.exe (32-bit), as quite a few servers have serious troubles when there are too many 16-bit processes (for no apparent reason). What is the setting in the virus.cfg for fpcmd.exe How many E-mails do you send/receive per day on this server? What is the CPU power of the server? I'm guessing you are processing about 250,000 E-mails/day on that server. At 250,000 E-mails/day, you're quickly approaching IMail's limitations -- specifically, at that volume, you only have 10 seconds to process each E-mail. That includes scanning for viruses (which is quick, but CPU-intensive), scanning for spam (which takes time, but little CPU power), and actually delivery (quick for local mailboxes, lengthy for outgoing E-mail). I ran DOMLIST and is showed 249,070 To scan 250,000 E-mails/day for viruses, you should be dealing with at least 2.5GHz of CPU power (1 2.5GHz CPU, 2 1.3GHz CPUs, etc.). Running on a P4 3.0 gig with WinNT4.0 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Still working on Spool overflow
Fred, No we are running the f-prot.exe with the switches Lenny Bauman LRBCG.COM, Inc. Phone 419-621-5770 Toll Free 1-800-NET-ACCESS (638-2223) E-mail [EMAIL PROTECTED] - Original Message - From: Frederick Samarelli [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 05, 2003 12:18 PM Subject: Re: [Declude.JunkMail] Still working on Spool overflow Are you using this line in the Virus.cfg SCANFILEC:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt - Original Message - From: Lenny Bauman [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 05, 2003 11:59 AM Subject: [Declude.JunkMail] Still working on Spool overflow Scott, I have the system working with Imail and Declude JM, But when I configured Declude Virus with f-prot the processor goes to 100% and sets there then the spool starts to build. I can see anywhere from 5 to 150 NTVDM and Declude in the task manager. When I shut off Declude Virus the processor goes back to 7 to 25%. and the spool clears out.Any ideas Lenny Bauman LRBCG.COM, Inc. Phone 419-621-5770 Toll Free 1-800-NET-ACCESS (638-2223) E-mail [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Still working on Spool overflow
Lenny: This is what we have: SCANFILEC:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE 3 VIRUSCODE 6 REPORT Infection: Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Lenny Bauman Sent: Wednesday, November 05, 2003 12:41 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Still working on Spool overflow The first thing to do is to switch from F-Prot.exe (16-bit) to fpcmd.exe (32-bit), as quite a few servers have serious troubles when there are too many 16-bit processes (for no apparent reason). What is the setting in the virus.cfg for fpcmd.exe How many E-mails do you send/receive per day on this server? What is the CPU power of the server? I'm guessing you are processing about 250,000 E-mails/day on that server. At 250,000 E-mails/day, you're quickly approaching IMail's limitations -- specifically, at that volume, you only have 10 seconds to process each E-mail. That includes scanning for viruses (which is quick, but CPU-intensive), scanning for spam (which takes time, but little CPU power), and actually delivery (quick for local mailboxes, lengthy for outgoing E-mail). I ran DOMLIST and is showed 249,070 To scan 250,000 E-mails/day for viruses, you should be dealing with at least 2.5GHz of CPU power (1 2.5GHz CPU, 2 1.3GHz CPUs, etc.). Running on a P4 3.0 gig with WinNT4.0 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Still working on Spool overflow
The first thing to do is to switch from F-Prot.exe (16-bit) to fpcmd.exe (32-bit), as quite a few servers have serious troubles when there are too many 16-bit processes (for no apparent reason). What is the setting in the virus.cfg for fpcmd.exe It's in the manual. :) It's the same as with F-Prot.exe, except that you must remove the /NOFLOPPY and /NOBOOT switches. I ran DOMLIST and is showed 249,070 Running on a P4 3.0 gig with WinNT4.0 At that volume, you may have to go to some great lengths to get everything running smoothly on one server. One thing that may be worthwhile in your situation is adding a line AVAFTERJM to the \IMail\Declude\virus.cfg file, which will prevent Declude Virus scanning any E-mail that Declude JunkMail blocks. However, there is a VERY IMPORTANT WARNING when doing this -- any E-mail that Declude JunkMail blocks will not be scanned for viruses, so if you re-deliver E-mail that has been held by Declude JunkMail, you will need to be careful. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Still working on Spool overflow
At that volume, you may have to go to some great lengths to get everything running smoothly on one server. One other thing that you should make sure of is that you are using PRESCAN ON in the \IMail\Declude\virus.cfg file (assuming you are running Declude Virus Pro, which you should if you are processing millions of E-mails a week). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Still working on Spool overflow
Change it to the setting I sent. - Original Message - From: Lenny Bauman [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 05, 2003 12:42 PM Subject: Re: [Declude.JunkMail] Still working on Spool overflow Fred, No we are running the f-prot.exe with the switches Lenny Bauman LRBCG.COM, Inc. Phone 419-621-5770 Toll Free 1-800-NET-ACCESS (638-2223) E-mail [EMAIL PROTECTED] - Original Message - From: Frederick Samarelli [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 05, 2003 12:18 PM Subject: Re: [Declude.JunkMail] Still working on Spool overflow Are you using this line in the Virus.cfg SCANFILEC:\Progra~1\FSI\F-Prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt - Original Message - From: Lenny Bauman [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 05, 2003 11:59 AM Subject: [Declude.JunkMail] Still working on Spool overflow Scott, I have the system working with Imail and Declude JM, But when I configured Declude Virus with f-prot the processor goes to 100% and sets there then the spool starts to build. I can see anywhere from 5 to 150 NTVDM and Declude in the task manager. When I shut off Declude Virus the processor goes back to 7 to 25%. and the spool clears out.Any ideas Lenny Bauman LRBCG.COM, Inc. Phone 419-621-5770 Toll Free 1-800-NET-ACCESS (638-2223) E-mail [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Still working on Spool overflow
Processor is now running at 7 to 45% ... OK, that means that the CPU usage is now under control. ... and the spool and overflow is fill fast 1200 plus in each but when I go into the queue it shows only 30 messages being queued Most likely, that is due to a Declude JunkMail test that died a long time ago. You should go through your \IMail\Declude\global.cfg file and look for any dead tests (such as any references to osirusoft, monkeys, or orbz). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
