[sniffer] Re: Convert your Declude OEM license now and get full credit!

2013-04-11 Thread John Moore
YES!

-Original Message-
From: Message Sniffer Community [mailto:sniffer@sortmonster.com] On Behalf
Of e...@insight.rr.com
Sent: Thursday, April 11, 2013 7:23 AM
To: Message Sniffer Community
Subject: [sniffer] Re: Convert your Declude OEM license now and get full
credit!

Because of this entire issue with declude. It might be nice if you contacted
smarterTools and offered to work with them on them integrating message
sniffer directly into smarterMail. :)



-Original Message-
From: Message Sniffer Community [mailto:sniffer@sortmonster.com] On Behalf
Of Pete McNeil
Sent: Wednesday, April 10, 2013 3:04 PM
To: Message Sniffer Community
Subject: [sniffer] Convert your Declude OEM license now and get full credit!

Hi Sniffer Folks,

It appears that Declude (the company) is failing. After many rumors of
problems and some first hand experience, today the Declude web site has gone
dark.

We have a long standing relationship with the Declude community, and we want
to make sure we do what we can to support them even if Declude itself goes
away.

Place a new order for Message Sniffer (SNF) now and we will give you credit
for any time you have left on your Declude OEM license. Tell us your OEM
expiration date with Declude and we will add the time you have left to your
new SNF license.

For the best pricing we recommend you purchase through one of our resellers:
https://www.armresearch.com/products/resellers.jsp

Please be sure to pass this information on to any interested folks that
might not be on this list! There is bound to be a lot of turmoil right now
and we don't want anybody to miss it.

Please let us know if there is more we can do!

Best,

_M

--
Pete McNeil
Chief Scientist
ARM Research Labs, LLC
www.armresearch.com
866-770-1044 x7010
twitter/codedweller


#
This message is sent to you because you are subscribed to
  the mailing list sniffer@sortmonster.com.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: sniffer-...@sortmonster.com
To switch to the DIGEST mode, E-mail to sniffer-dig...@sortmonster.com
To switch to the INDEX mode, E-mail to sniffer-in...@sortmonster.com
Send administrative queries to  sniffer-requ...@sortmonster.com




#
This message is sent to you because you are subscribed to
  the mailing list sniffer@sortmonster.com.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: sniffer-...@sortmonster.com
To switch to the DIGEST mode, E-mail to sniffer-dig...@sortmonster.com
To switch to the INDEX mode, E-mail to sniffer-in...@sortmonster.com
Send administrative queries to  sniffer-requ...@sortmonster.com



#
This message is sent to you because you are subscribed to
  the mailing list sniffer@sortmonster.com.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: sniffer-...@sortmonster.com
To switch to the DIGEST mode, E-mail to sniffer-dig...@sortmonster.com
To switch to the INDEX mode, E-mail to sniffer-in...@sortmonster.com
Send administrative queries to  sniffer-requ...@sortmonster.com



RE: Re[4]: [sniffer] Rash of false positives

2005-11-09 Thread John Moore








We had this same thing happen.

It has been happening more frequently
recently and we are looking into disabling sniffer as
it seems to be the culprit each time.

John Moore
305 Spin











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris
Sent: Wednesday, November 09, 2005
11:38 AM
To: sniffer@SortMonster.com
Subject: Re: Re[4]: [sniffer] Rash
of false positives







This morning my server quit sending mail and my tech said the Dr.
Watson error on the server was my Sniffer file...I rebooted and thought it was
OK but quit again..I had a lot of mail back logged...so I updated a new rule
base but it did not seem to helpI reinstalled Imail and things seem OK but
slow since there is such a back log of mailIf things don't get back to
normal I will be back..






Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
Crossroads to a Cleaner Internet







- Original Message - 





From: Pete
McNeil 





To: Darin Cox






Sent:
Tuesday, November 08, 2005 3:03 PM





Subject: Re[4]: [sniffer] Rash of false positives









On Tuesday, November 8, 2005, 3:25:20
PM, Darin wrote:






 
  
  
  
  
  Hi Pete,
  
  There was a consistent stream of false
  positives over the mentioned time period, not just a blast at a particular
  time. They suddenly started at 5pm (shortly after a 4:30pm rulesbase
  update), and were fairly evenly spread from 5pm - 11pm and 6am - 10am today
  (not many legitimate emails came in between 11pm and 6am)...spanning 4 other
  rulebase updates at 8:40pm, 12am, 3am, and 6:20am. There were a number
  of different rules involved, and over 45 false positives in that time period.
  
 






This is highly unusual -- I didn't
remove many rules, and normally only one or two would be responsible. If you
found that a large number of rules were responsible then something else happend
and we need to look at that... I'd need to see your SNF logs from that period
since the changes (removals anyway) in the rulebase were very small and
unrelated - that just doesn't line up with your description.



One thing does-- in the past if
snf2check was not used to check a new download then a corrupted rulebase could
cause SNF to produce erratic results... since snf2check has been in place we
have not seen this. Is it possible that a bad rulebase file got pressed into
service on your system? -- probably a look at the logs would help there too
since this kind of failure is accompanied by very specific oddities in the
logs.



Hope this helps,



_M



This E-Mail came from the Message Sniffer mailing list. For
information and (un)subscription instructions go to
http://www.sortmonster.com/MessageSniffer/Help/Help.html 










RE: Re[4]: [sniffer] Rash of false positives

2005-11-09 Thread John Moore








We have not run snf2check on the updates. And
it may be a coincidence or bad timing that sniffer
appears to be the culprit. But we have stopped sniffer
(commented out in the declude global.cfg)
for an observed period of time and the mail never stops (and had never stopped
before sniffer) and conversely, it only stops when sniffer is running.

We have not gone the extra steps of
putting sniffer in persistent mode.

We are looking at moving the imail/declude/sniffer setup to a newer box with more
resources.

Currently on a dell 2450 dual 833 and 1
gig of ram and raid 5. Volume of email is less than 10,000 emails per day.

J











From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Darin Cox
Sent: Wednesday, November 09, 2005
1:47 PM
To: sniffer@SortMonster.com
Subject: Re: Re[4]: [sniffer] Rash
of false positives







Arecorrupted
rulebase files the culprit? How do you update... and do you run
snf2check on the updates?











Just wondering if
the rulebase file is theproblem, if the problemoccurs during the
update, or if you are running into obscure errors with the EXE itself






Darin.

















- Original
Message - 



From: John Moore 





To: sniffer@SortMonster.com






Sent: Wednesday,
November 09, 2005 12:42 PM





Subject: RE: Re[4]:
[sniffer] Rash of false positives











We had this same thing happen.

It has been happening more frequently
recently and we are looking into disabling sniffer as it seems to be the
culprit each time.

John Moore
305 Spin











From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Richard Farris
Sent: Wednesday, November 09, 2005
11:38 AM
To: sniffer@SortMonster.com
Subject: Re: Re[4]: [sniffer] Rash
of false positives







This morning my server quit sending mail and my tech said the Dr.
Watson error on the server was my Sniffer file...I rebooted and thought it was
OK but quit again..I had a lot of mail back logged...so I updated a new rule
base but it did not seem to helpI reinstalled Imail and things seem OK but
slow since there is such a back log of mailIf things don't get back to
normal I will be back..






Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
Crossroads to a Cleaner Internet







- Original Message - 





From: Pete
McNeil 





To: Darin Cox






Sent:
Tuesday, November 08, 2005 3:03 PM





Subject: Re[4]: [sniffer] Rash of false positives









On Tuesday, November 8, 2005, 3:25:20
PM, Darin wrote:






 
  
  
  
  
  Hi Pete,
  
  There was a consistent stream of false
  positives over the mentioned time period, not just a blast at a particular
  time. They suddenly started at 5pm (shortly after a 4:30pm rulesbase
  update), and were fairly evenly spread from 5pm - 11pm and 6am - 10am today
  (not many legitimate emails came in between 11pm and 6am)...spanning 4 other
  rulebase updates at 8:40pm, 12am, 3am, and 6:20am. There were a number
  of different rules involved, and over 45 false positives in that time period.
  
 






This is highly unusual -- I didn't
remove many rules, and normally only one or two would be responsible. If you
found that a large number of rules were responsible then something else happend
and we need to look at that... I'd need to see your SNF logs from that period
since the changes (removals anyway) in the rulebase were very small and
unrelated - that just doesn't line up with your description.



One thing does-- in the past if
snf2check was not used to check a new download then a corrupted rulebase could
cause SNF to produce erratic results... since snf2check has been in place we
have not seen this. Is it possible that a bad rulebase file got pressed into
service on your system? -- probably a look at the logs would help there too
since this kind of failure is accompanied by very specific oddities in the
logs.



Hope this helps,



_M



This E-Mail came from the Message Sniffer mailing list. For
information and (un)subscription instructions go to
http://www.sortmonster.com/MessageSniffer/Help/Help.html 










RE: [sniffer] Rash of false positives

2005-11-09 Thread John Moore








Matt,

Thank you for your help and thorough
explanation. I added the declude.cfg with the PROCESSES
20

We are running declude
2.06 and have the JM pro and AV standard.

We will look into getting the persistent
mode setup and see if that helps as well.

Thanks, again.

John











From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Matt
Sent: Wednesday, November 09, 2005
4:49 PM
To: sniffer@SortMonster.com
Subject: Re: [sniffer] Rash of
false positives





John,

The mystery heap issue is a memory issue with Windows where it only reserves so
much memory for running things like Declude, Sniffer, other external tests and
your virus scanners. If you have something that is hanging, running
slowly, or taking too long, it can gobble up all of the memory available to
these launched processes and then result in errors. Generally speaking,
you can only get about 40 or so processes of these types to run at one time
before you could start seeing these errors. Declude counts as one
process, and often there is one other process that Declude launches that goes
to this count (external tests and virus scanners are all run in serial so only
one can be launched at a time by a single Declude process). If you have
something like a virus scanner that crashes and then pops up a window on your
next login, this can count towards the number of open processes.

You can specify in Declude how many processes to run before Declude starts
dumping things into an overflow, either the overflow folder in 2.x and before,
or something under proc in 3.x. If you create a file called Declude.cfg
and place in it PROCESSES 20 that should protect you
from hitting the mystery heap's limitations unless something is crashing and
hanging. You might want to check Task Manager for processes to verify if
things are hanging since not everything will pop up a window.

I believe that running Sniffer in persistent mode will help to alleviate this
condition, but it's only one part and if the mystery heap is the cause, it
might just cause the errors to be triggered on other IMail launched processes
including Declude.exe and your virus scanners.

Matt



John Moore wrote: 



We have not run snf2check on the updates.
And it may be a coincidence or bad timing that sniffer appears to be the
culprit. But we have stopped sniffer (commented out in the declude global.cfg)
for an observed period of time and the mail never stops (and had never stopped
before sniffer) and conversely, it only stops when sniffer is running.

We have not gone the extra steps of
putting sniffer in persistent mode.

We are looking at moving the
imail/declude/sniffer setup to a newer box with more resources.

Currently on a dell 2450 dual 833 and 1
gig of ram and raid 5. Volume of email is less than 10,000 emails per day.

J











From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
On Behalf Of Darin Cox
Sent: Wednesday, November 09, 2005
1:47 PM
To: sniffer@SortMonster.com
Subject: Re: Re[4]: [sniffer] Rash
of false positives







Arecorrupted
rulebase files the culprit? How do you update... and do you run
snf2check on the updates?











Just
wondering if the rulebase file is theproblem, if the problemoccurs
during the update, or if you are running into obscure errors with the EXE
itself






Darin.

















-
Original Message - 



From: John Moore 





To: sniffer@SortMonster.com






Sent: Wednesday, November 09, 2005 12:42
PM





Subject: RE: Re[4]: [sniffer] Rash of false
positives











We had this same thing happen.

It has been happening more frequently
recently and we are looking into disabling sniffer as it seems to be the
culprit each time.

John Moore
305 Spin











From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
On Behalf Of Richard Farris
Sent: Wednesday, November 09, 2005
11:38 AM
To: sniffer@SortMonster.com
Subject: Re: Re[4]: [sniffer] Rash
of false positives







This
morning my server quit sending mail and my tech said the Dr. Watson error on
the server was my Sniffer file...I rebooted and thought it was OK but quit
again..I had a lot of mail back logged...so I updated a new rule base but it
did not seem to helpI reinstalled Imail and things seem OK but slow since
there is such a back log of mailIf things don't get back to normal I will be
back..








Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
Crossroads to a Cleaner Internet







-
Original Message - 





From: Pete
McNeil 





To: Darin Cox






Sent: Tuesday, November 08, 2005 3:03 PM





Subject: Re[4]: [sniffer] Rash of false
positives









On Tuesday, November 8, 2005, 3:25:20 PM, Darin
wrote:






 
  
  
  
  
  Hi Pete,
  
  
  There was a consistent stream of false positives over
  the mentioned time period, not just a blast at a particular time. They
  suddenly started at 5pm (shortly after a 4:30pm rulesbase update), and were
  fairly evenly spread from 5pm - 11pm and 6am