[sniffer] Re: Slow processing times, errors

2013-06-27 Thread DFN Systems
unsubscribe

 

  _  

From: Message Sniffer Community [mailto:sniffer@sortmonster.com] On Behalf
Of e...@protologic.com
Sent: Thursday, June 27, 2013 3:18 PM
To: Message Sniffer Community
Subject: [sniffer] Re: Slow processing times, errors

 

We were experiencing this several days ago and couldn't find a fix that
worked or worked for long. We uninstalled SNF and reinstalled and have not
detected a problem since. I will check the logs and report back if I see
anything intermittent.




Sent using SmarterSync Over-The-Air sync for iPad, iPhone, BlackBerry and
other SmartPhones. May use speech to text. If something seems odd please
don't hesitate to ask for clarification. E.O.E.

On 2013-06-27, at 2:06 PM, Matt wrote:

 Pete,
 
 I've had many recent incidences where, as it turns out, SNFclient.exe
takes 30 to 90 seconds to respond to every message with a result code
(normally less than a second), and as a result backs up processing.
Restarting the Sniffer service seems to do the trick, but I only tested that
for the first time today after figuring this out.
 
 I believe the events are triggered by updates, but I'm not sure as of yet.
Updates subsequent to the slow down do not appear to fix the situation, so
it seems to be resident in the service. When this happens, my
SNFclient.exe.err log fill up with lines like this:
 
 20130627155608, arg1=F:\\proc\work\D6063018a2550.smd : Could Not
Connect!
 
 At the same time, my Sniffer logs start showing frequent ERROR_MSG_FILE
results on about 1/8th of the messages.
 
 I'm currently using the service version 3.0.2-E3.0.17. It's not entirely
clear to me what the most current one is.
 
 Any suggestions as to the cause or solution?
 
 Thanks,
 
 Matt
 
 
 #
 This message is sent to you because you are subscribed to
 the mailing list .
 This list is for discussing Message Sniffer,
 Anti-spam, Anti-Malware, and related email topics.
 For More information see http://www.armresearch.com
 To unsubscribe, E-mail to: 
 To switch to the DIGEST mode, E-mail to 
 To switch to the INDEX mode, E-mail to 
 Send administrative queries to 
 



[sniffer] Re: Stock spam

2006-12-12 Thread Bill Green dfn Systems

It's interesting to see such mixed results posted. It makes me wonder
what the differences are between the systems reporting high catch
rates (which we also see, once a campaign has been analyzed) and low
catch rates.


I personally found the importance of triggered updates. I was receiving lots 
of stock and image spam. I had scheduled updates several times a day so I 
didn't think that had much to do with it. I couldn't get the Triggered 
update script to work until last week when I executed each line manually and 
found my bonehead mistake. Spam has all but disappeared.


I would encourage anyone using scheduled updates, no matter how frequently, 
to move to a Triggered Update script


Bill Green
dfn Systems 




#
This message is sent to you because you are subscribed to
 the mailing list sniffer@sortmonster.com.
To unsubscribe, E-mail to: [EMAIL PROTECTED]
To switch to the DIGEST mode, E-mail to [EMAIL PROTECTED]
To switch to the INDEX mode, E-mail to [EMAIL PROTECTED]
Send administrative queries to  [EMAIL PROTECTED]



[sniffer] Re: Lot of stock spam getting through....

2006-07-07 Thread Bill Green dfn Systems



I agree! I could tell Pete was burning the midnight 
oil by the pattern of Sniffer Updates this morning.
Thanks Pete!

Bill Green
dfn Systems
505-622-7853
[EMAIL PROTECTED]

  - Original Message - 
  From: 
  George Thompson 
  To: Message Sniffer Community 
  Sent: Friday, July 07, 2006 9:18 AM
  Subject: [sniffer] Re: Lot of stock spam 
  getting through
  Hi Pete,I've been a customer for a couple of years and 
  usually don't have much to say via maillists. But I wanted to take a moment 
  this morning and think you for the work you do. Keeping up with this 
  stuff must force you to keep your nose to the grindstone. I really 
  appreciate your work.Thanks again,George ThompsonCheif 
  Technical OfficerLevelfield.com, Incwww.levelfield.comDBA 
  OnlineAgency.comwww.onlineagency.combuilding the Internet one small 
  business at a time I had a big fight with one like that all last 
  night -- there are some unusual characters in the message that made it 
  hard to filter and it took some time to do the analysis (picking 
  through them with a hex editor).  I think these are 
  handled now (as of about 0400e this morning) as I don't have any 
  getting through spamtraps at the moment. I will look into it 
  again.  _M  -- Pete McNeil 
  Chief Scientist, Arm Research Labs, LLC.


[sniffer] Re: Weight Gate Success? Failure?

2006-06-13 Thread Bill Green dfn Systems


I've tried Pete's WeightGate with INVURIBL.

Original line in Declude Global Config.
INV-URIBL external weight E:\INVURIBL\invURIBL.exe %WEIGHT% %REMOTEIP% 5 
 0


New line
INVARIANT external weight e:\tools\ShowMe.exe -50 %WEIGHT% 10 
E:\INVURIBL\invURIBL.exe %WEIGHT% %REMOTEIP% 5 0


Account for line Wrap

I have verified Invuribl is being called. I'm still confirming Spam Blocking 
Performance. The resulting CPU savings were no less than stunning.


Bill Green
dfn Systems


INV-URIBL external weight E:\INVURIBL\invURIBL.exe %WEIGHT% %REMOTEIP% 5 
  0


INVARIANT external weight e:\tool\ShowMe.exe -50 %WEIGHT% 10 
E:\INVURIBL\invURIBL.exe %WEIGHT% %REMOTEIP% 5 0


Account for line Wrap

- Original Message - 
From: Pete McNeil [EMAIL PROTECTED]

To: Message Sniffer Community sniffer@sortmonster.com
Sent: Tuesday, June 13, 2006 9:48 AM
Subject: [sniffer] Weight Gate Success? Failure?



Hello Sniffer Folks,

 Is anyone successfully using the WeightGate utility?

 Anyone having trouble with it?

 I've literally heard nothing so far ;-)

 Thanks,

 _M

--
Pete McNeil
Chief Scientist,
Arm Research Labs, LLC.


#
This message is sent to you because you are subscribed to
 the mailing list sniffer@sortmonster.com.
To unsubscribe, E-mail to: [EMAIL PROTECTED]
To switch to the DIGEST mode, E-mail to [EMAIL PROTECTED]
To switch to the INDEX mode, E-mail to [EMAIL PROTECTED]
Send administrative queries to  [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Declude EVA]






---
[This E-mail scanned for viruses by Declude EVA]



#
This message is sent to you because you are subscribed to
 the mailing list sniffer@sortmonster.com.
To unsubscribe, E-mail to: [EMAIL PROTECTED]
To switch to the DIGEST mode, E-mail to [EMAIL PROTECTED]
To switch to the INDEX mode, E-mail to [EMAIL PROTECTED]
Send administrative queries to  [EMAIL PROTECTED]



[sniffer] Re: Weight Gate Success? Failure?

2006-06-13 Thread Bill Green dfn Systems

Andrew,
   Comments inline:


Can I be the first to point out that in your example, you're still
calling ShowMe.exe and not WeightGate.exe so you will be appending to
c:\ShowMe.log with every call?


Yes, I've changed that to WeightGate.exe. In my excitement, I copied the 
line to the email before the change.
Another blunder was that strange email from me to me that somehow made it to 
the list. Sorry.



And for those new to the party, I'll explain that what Bill is doing
with his modified configuration is to avoid calling InvURIBL when the
current Declude weight is less than -50 or more than 10.



If it's less than -50, Bill is presumably already heavily negatively
weighting known ham senders and thus avoiding calling InvURIBL on
messages that are ham.



Likewise, it the current weight is more than 10, Bill is assuming the
message is already spammy enough and doesn't want InvURIBL to run on
those either.


I will probably tweak these settings as I survey the results.


Bill Green
dfn Systems 



---
[This E-mail scanned for viruses by Declude EVA]



#
This message is sent to you because you are subscribed to
 the mailing list sniffer@sortmonster.com.
To unsubscribe, E-mail to: [EMAIL PROTECTED]
To switch to the DIGEST mode, E-mail to [EMAIL PROTECTED]
To switch to the INDEX mode, E-mail to [EMAIL PROTECTED]
Send administrative queries to  [EMAIL PROTECTED]