Re: [Declude.Virus] Declude Beta 3.0.4.4 Posted
Hi Andy, Andy Schmidt wrote: Thanks Bill. I had gotten the impression as if everyone with dual-processor system was reporting this and that people were still seeing it with the latest version. If you will would you let me know more about this issue. I haven't been following exactly so I do not know what I should be looking for :) I have 3.0.4.4 running on my quad processor [with hyper threading] box without ant problems - at least as far as I can tell. If I'm I missing something I will revert back to 2.0.6.16 in a heartbeat! -Nick --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Declude Beta 3.0.4.4 Posted
Hi Nick: I'm only repeating what I'm told - I don't have factual information on my own. There have been several reports on this list that describes the following problem with dual-processor systems: Declude is supposed to check the /proc folder and ONLY go to sleep (for 30 seconds), if the folder contains no messages. On systems that have that problem, Declude goes to sleep even though there ARE messages to process. The result is, that messages are queuing up and never get processed. There is a parameter to set the sleep time low (e.g. 1 second), this way, the effect of the problem is less - but now Declude does't go to sleep when it actually could - with a possible impact on resource consumption. (Of course, the question is why this appears to be related to dual-processor systems. May be one process still has an access lock against the first file in the proc folder and another process doesn't handle that error condition right - who knows.) Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Friday, September 23, 2005 08:15 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Declude Beta 3.0.4.4 Posted Hi Andy, Andy Schmidt wrote: Thanks Bill. I had gotten the impression as if everyone with dual-processor system was reporting this and that people were still seeing it with the latest version. If you will would you let me know more about this issue. I haven't been following exactly so I do not know what I should be looking for :) I have 3.0.4.4 running on my quad processor [with hyper threading] box without ant problems - at least as far as I can tell. If I'm I missing something I will revert back to 2.0.6.16 in a heartbeat! -Nick --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Declude Beta 3.0.4.4 Posted
Andy Schmidt wrote: Hi Nick: I'm only repeating what I'm told - I don't have factual information on my own. chuckle chuckle chuckle. you are very funny at times! Declude is supposed to check the /proc folder and ONLY go to sleep (for 30 seconds), if the folder contains no messages. On systems that have that problem, Declude goes to sleep even though there ARE messages to process. Gotcha. No biggie for me to monitor at least. Haven't seen that symptom yet but now the other emails regarding this make sense. Thanks - -Nick --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Declude Beta 3.0.4.4 Posted
I think it really depends on your volume if you will see this. Also, if you have already tweaked your WAITFORMAIL you may not see it as well. On my system during off peak hours I get on anverage between 75-100 messages per minute. What you will see is Declude will spawn up to 20 or so threads (I modified my threads value to keep up with volume) and process the messages. Once the decludeproc finishes processing that round of messages it will stop using any CPU time and sit idle for roughly 30 seconds. Once it sleeps for 30 seconds it will start to process messages again. See snippet of log 09/22/2005 21:38:43.703 q5c96523a026274b2.smd Successfully move [x:\IMail\spool\proc\work\q5c96523a026274b2.smd] to [x:\SPAM-HOLD\22Sep2005\q5c96523a026274b2.smd] 09/22/2005 21:39:08.968 q5c646c64029c7469.smd CFG: Set hop to 0. What occurs on my system is that the initial process completes and there is still messages in the /proc directory, but instead of grabbing more messages out of the /proc directory Declude goes to sleep. During the time it sleeps even more messages come in. Essentially what occurs is the amount of mail in the /proc folder just climbs steadily. Now I switched the WAITFORMAIL setting down to 1 second, but under those settings it appears to chew up an inordinate amount of CPU. I am still tweaking the values for a balance. The box is a Dell PowerEdge 2600 Dual Xeon with HT enabled with 4GB of RAM. Fresh install of Windows 2003 running Imail 8.15 HF 2. The box is only used for gatewaying. I guess the moral of the story is you would not really see this (if it affects you) only if the volume the box is processing is more than what the normal /work queue runs can handle. You could probably easily test this by increasing your WAITFORMAIL setting to a couple of minutes. If you are not affected by this than your system will continue to function properly and process the mail in the /proc folder as it should. If it is affected by it you would see files still in the proc folder and Declude go to sleep for that specified period of time. The key thing is that you would have to watch the proc folder since normal operation would be for the decludeproc service to go to sleep if no files existed in the folder. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Andy Schmidt writes: Hi Nick: I'm only repeating what I'm told - I don't have factual information on my own. There have been several reports on this list that describes the following problem with dual-processor systems: Declude is supposed to check the /proc folder and ONLY go to sleep (for 30 seconds), if the folder contains no messages. On systems that have that problem, Declude goes to sleep even though there ARE messages to process. The result is, that messages are queuing up and never get processed. There is a parameter to set the sleep time low (e.g. 1 second), this way, the effect of the problem is less - but now Declude does't go to sleep when it actually could - with a possible impact on resource consumption. (Of course, the question is why this appears to be related to dual-processor systems. May be one process still has an access lock against the first file in the proc folder and another process doesn't handle that error condition right - who knows.) Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Friday, September 23, 2005 08:15 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Declude Beta 3.0.4.4 Posted Hi Andy, Andy Schmidt wrote: Thanks Bill. I had gotten the impression as if everyone with dual-processor system was reporting this and that people were still seeing it with the latest version. If you will would you let me know more about this issue. I haven't been following exactly so I do not know what I should be looking for :) I have 3.0.4.4 running on my quad processor [with hyper threading] box without ant problems - at least as far as I can tell. If I'm I missing something I will revert back to 2.0.6.16 in a heartbeat! -Nick --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL
[Declude.Virus] Admin - Please unsubscribe me
Sorry to post to the list but I am hoping the admin of this list sees this. I want to unsubscribe and have followed the procedure 3 times to unsubscribe by sending email to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. I have sent them in plain text formatted emails and nothing is happening. I still am on the list. Please remove me if you do not mind Thank You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.Virus] AVAFTERJM ?
Thursday, September 22, 2005, 9:01:37 AM, you wrote: Dsic AVAFTERJM ON goes in the virus.cfg file and it makes AV run after JM as Dsic you suspected. Several of us run this mode for the reason you cited. The Dsic only deal you have to remember is if something is trapped by JM and you put Dsic it back in the queue it will not be virus scanned. This begs the follow up...if we have an automated release functionality whereby users can retrieve a held message, is there anyway to resubmit that to Declude and specify virus scanning only to be performed? This would keep users from releasing viruses to themselves. -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] AVAFTERJM ?
David, You could write something to the message that Declude JunkMail was set to whitelist, and then copy the D*.smd file to the spool and the Q*.smd file to the overflow directory (or the proc directory in 3.0+). This would cause the message to be scanned by both JunkMail and Virus, however it would be whitelisted in JunkMail if you followed that procedure. Matt David Sullivan wrote: Thursday, September 22, 2005, 9:01:37 AM, you wrote: Dsic AVAFTERJM ON goes in the virus.cfg file and it makes AV run after JM as Dsic you suspected. Several of us run this mode for the reason you cited. The Dsic only deal you have to remember is if something is trapped by JM and you put Dsic it back in the queue it will not be virus scanned. This begs the follow up...if we have an automated release functionality whereby users can retrieve a held message, is there anyway to resubmit that to Declude and specify virus scanning only to be performed? This would keep users from releasing viruses to themselves. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] VBE attachments
Wasn't, but I am now. Thanks Greg John Tolmachoff (Lists) wrote: Everyone is banning vbe attachments, correct? --- [This E-mail scanned for viruses by Findlay Internet] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Admin - Please unsubscribe me
Jim, If you figure how to get off of this list, please let me know. I must have unsubscribed ten times with no success. Good luck! On 23 Sep 2005 at 8:55, Jim Smith wrote: Sorry to post to the list but I am hoping the admin of this list sees this. I want to unsubscribe and have followed the procedure 3 times to unsubscribe by sending email to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. I have sent them in plain text formatted emails and nothing is happening. I still am on the list. Please remove me if you do not mind Thank You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses] - Don Duffy Manager, Technical Services Office 330-684-5103 Fax 330-684-5122 www.orrutilities.com --- [This E-mail was scanned for viruses] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Admin - Please unsubscribe me
Don and Jim, I believe this is an issue with IMail's listserv functionality. I believe that it desires a plain text response. Try sending the commands in a plain text message. Matt Don Duffy wrote: Jim, If you figure how to get off of this list, please let me know. I must have unsubscribed ten times with no success. Good luck! On 23 Sep 2005 at 8:55, Jim Smith wrote: Sorry to post to the list but I am hoping the admin of this list sees this. I want to unsubscribe and have followed the procedure 3 times to unsubscribe by sending email to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". I have sent them in plain text formatted emails and nothing is happening. I still am on the list. Please remove me if you do not mind Thank You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses] - Don Duffy Manager, Technical Services Office 330-684-5103 Fax 330-684-5122 www.orrutilities.com --- [This E-mail was scanned for viruses] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.Virus] AVAFTERJM ?
Friday, September 23, 2005, 12:17:32 PM, you wrote: M You could write something to the message that Declude JunkMail was set M to whitelist, and then copy the D*.smd file to the spool and the Q*.smd That's a great idea. Something innocuous in the headers as a whitelist key. Rather than just putting it in /overflow though, couldn't I call declude.exe with the Q file name for immediate processing? -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] AVAFTERJM ?
David, The one issue with calling declude.exe directly is that you don't want the Q*.smd file to be in the spool, otherwise IMail's Queue Manager can steal it, though that would only cause an error in this case and the message would be delivered. I would recommend moving the D*.smd file back into the spool and then calling the Q*.smd file from where ever you were storing it (using the COPYFILE operative I presume). Matt David Sullivan wrote: Friday, September 23, 2005, 12:17:32 PM, you wrote: M You could write something to the message that Declude JunkMail was set M to whitelist, and then copy the D*.smd file to the spool and the Q*.smd That's a great idea. Something innocuous in the headers as a whitelist key. Rather than just putting it in /overflow though, couldn't I call declude.exe with the Q file name for immediate processing? --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.Virus] AVAFTERJM ?
Matt, Is it possible to call declude.exe with the path to another folder containing the Q/D? M The one issue with calling declude.exe directly is that you don't want M the Q*.smd file to be in the spool, otherwise IMail's Queue Manager can M steal it, though that would only cause an error in this case and the M message would be delivered. I would recommend moving the D*.smd file M back into the spool and then calling the Q*.smd file from where ever you M were storing it (using the COPYFILE operative I presume). -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Admin - Please unsubscribe me
Hi Matt, As I said in my original message I was aware of Imail's problem with HTML messages and have therefore sent 2 seperate requests to unsubscibe to this list in Plain Text and it does nothing. I cannot get off this list and need the admin to do it because the automated way does not work. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Friday, September 23, 2005 11:26 AM Subject: Re: [Declude.Virus] Admin - Please unsubscribe me Don and Jim,I believe this is an issue with IMail's listserv functionality. I believe that it desires a plain text response. Try sending the commands in a plain text message.MattDon Duffy wrote: Jim, If you figure how to get off of this list, please let me know. I must have unsubscribed ten times with no success. Good luck! On 23 Sep 2005 at 8:55, Jim Smith wrote: Sorry to post to the list but I am hoping the admin of this list sees this. I want to unsubscribe and have followed the procedure 3 times to unsubscribe by sending email to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". I have sent them in plain text formatted emails and nothing is happening. I still am on the list. Please remove me if you do not mind Thank You --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses] - Don Duffy Manager, Technical Services Office 330-684-5103 Fax 330-684-5122 www.orrutilities.com --- [This E-mail was scanned for viruses] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus".The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Admin - Please unsubscribe me
There are issues with Declude Confirm if they are using their own product. I have been reporting this for some time, but they are working on getting the new Beta working instead and were going to focus on Confirm later as it is a free product. Thanks, Grant Griffith EI8HTLEGS, A Division of ETC (812)932-1000 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim Smith Sent: Friday, September 23, 2005 1:31 PM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Admin - Please unsubscribe me Hi Matt, As I said in my original message I was aware of Imail's problem with HTML messages and have therefore sent 2 seperate requests to unsubscibe to this list in Plain Text and it does nothing. I cannot get off this list and need the admin to do it because the automated way does not work. - Original Message - From: Matt To: Declude.Virus@declude.com Sent: Friday, September 23, 2005 11:26 AM Subject: Re: [Declude.Virus] Admin - Please unsubscribe me Don and Jim, I believe this is an issue with IMail's listserv functionality. I believe that it desires a plain text response. Try sending the commands in a plain text message. Matt Don Duffy wrote: Jim,If you figure how to get off of this list, please let me know. I must have unsubscribed ten times with no success. Good luck!On 23 Sep 2005 at 8:55, Jim Smith wrote: Sorry to post to the list but I am hoping the admin of this list sees this. I want to unsubscribe and have followed the procedure 3 times to unsubscribe by sending email to [EMAIL PROTECTED], and type unsubscribe Declude.Virus. I have sent them in plain text formatted emails and nothing is happening. I still am on the list. Please remove me if you do not mindThank You---This E-mail came from the Declude.Virus mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype unsubscribe Declude.Virus. The archives can be foundat http://www.mail-archive.com.---[This E-mail was scanned for viruses] - Don DuffyManager, Technical ServicesOffice 330-684-5103Fax 330-684-5122www.orrutilities.com---[This E-mail was scanned for viruses]---This E-mail came from the Declude.Virus mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype unsubscribe Declude.Virus. The archives can be foundat http://www.mail-archive.com.
Re: [Declude.Virus] AVAFTERJM ?
David, I believe so. The Q* file contains the path to the D* file, and that is always under the spool unless you have changed the Q* file to point elsewhere. Also, the best way to embed something in the headers that can't be forged would be to do it above the Received lines and then code a custom filter that whitelists with a HEADERS WHITELIST STARTSWITH X-Reprocess: Reprocessed Matt David Sullivan wrote: Matt, Is it possible to call declude.exe with the path to another folder containing the Q/D? M The one issue with calling declude.exe directly is that you don't want M the Q*.smd file to be in the spool, otherwise IMail's Queue Manager can M steal it, though that would only cause an error in this case and the M message would be delivered. I would recommend moving the D*.smd file M back into the spool and then calling the Q*.smd file from where ever you M were storing it (using the COPYFILE operative I presume). --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Admin - Please unsubscribe me
Seems like to me an email to Barry would get you off Declude's list. If I had sent 10 I would phone him up! Confirm is less than very useful if it doesn't work, but I would prefer they spend there development time on Declude. At 01:43 PM 9/23/2005 -0500, Grant Griffith wrote: There are issues with Declude Confirm if they are using their own product. I have been reporting this for some time, but they are working on getting the new Beta working instead and were going to focus on Confirm later as it is a free product. Thanks, Grant Griffith EI8HTLEGS, A Division of ETC (812)932-1000 -- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim Smith Sent: Friday, September 23, 2005 1:31 PM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] Admin - Please unsubscribe me Hi Matt, As I said in my original message I was aware of Imail's problem with HTML messages and have therefore sent 2 seperate requests to unsubscibe to this list in Plain Text and it does nothing. I cannot get off this list and need the admin to do it because the automated way does not work. - Original Message - From: mailto:[EMAIL PROTECTED]>Matt To: mailto:Declude.Virus@declude.com>Declude.Virus@declude.com Sent: Friday, September 23, 2005 11:26 AM Subject: Re: [Declude.Virus] Admin - Please unsubscribe me Don and Jim, I believe this is an issue with IMail's listserv functionality. I believe that it desires a plain text response. Try sending the commands in a plain text message. Matt Don Duffy wrote: Jim,If you figure how to get off of this list, please let me know.nbsp; I must have unsubscribed ten times with no success.nbsp; Good luck!nbsp;On 23 Sep 2005 at 8:55, Jim Smith wrote:nbsp;nbsp; Sorry to post to the list but I am hoping the admin of this list sees this. I want to unsubscribe and have followed the procedure 3 times to unsubscribe by sending email tonbsp; mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED], andnbsp;nbsp;nbsp; type quot;unsubscribe Declude.Virusquot;.nbsp;nbsp;nbsp;nbsp;nbsp; I have sent them in plain text formatted emails and nothing is happening.nbsp; I still am on the list.nbsp; Please remove me if you do not mindThank Younbsp;---This E-mail came from the Declude.Virus mailing list.nbsp; Tounsubscribe, just send an E-mail to mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED], andtype quot;unsubscribe Declude.Virusquot;.nbsp;nbsp;nbsp; The archives can be foundat http://www.mail-archive.com>http://www.mail-archive.com.---[This E-mail was scanned for viruses]nbsp;nbsp;nbsp;nbsp;nbsp; nbsp;- Don DuffyManager, Technical ServicesOffice 330-684-5103Faxnbsp; 330-684-5122http://www.orrutilities.com>www.orrutilities.comnbsp;nbsp;nbsp;---[This E-mail was scanned for viruses]nbsp;---This E-mail came from the Declude.Virus mailing list.nbsp; Tounsubscribe, just send an E-mail to mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED], andtype quot;unsubscribe Declude.Virusquot;.nbsp;nbsp;nbsp; The archives can be foundat http://www.mail-archive.com>http://www.mail-archive.com.nbsp;nbsp;nbsp; [This E-mail scanned for viruses by F-Prot] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
