Spam Filter ISP Forums http://www.logsat.com/spamfilter/forums/ This is an XML content feed of; Spam Filter ISP Forums : Last 10 Posts Thu, 29 Jul 2010 21:39:23 +0000 Thu, 29 Jul 2010 17:25:00 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 9.61 30 www.logsat.com/spamfilter/forums/RSS_topic_feed.asp Spam Filter ISP Support : Spamfilter Logs not updating http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6859&PID=13730#13730 Author: jortmann
Subject: Spamfilter Logs not updating
Posted: 29 July 2010 at 5:25pm

Problem resolved sort of. Actually deleting the existing log file and restarting the spamfilter service triggered a new file which is logging properly.

But I still wonder why the logging stops in the first place.

cheers
]]> Thu, 29 Jul 2010 17:25:00 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6859&PID=13730#13730 Spam Filter ISP Support : Spamfilter Logs not updating http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6859&PID=13729#13729 Author: jortmann
Subject: Spamfilter Logs not updating
Posted: 29 July 2010 at 4:43pm

We're running v4.1.2.812 and in the spamfilter.ini the log directory points to our log server which runs Sawmill - \\logserver\Spamfilterlogs.

These log files roll over every night at 12. We've had a few issues where the log file isn't updating with the correct into. Below is a snippet of what is being logged. Rebooting has fixed this in the past, but it's not working now. Not sure what to look at.

Thanks

07/28/10 23:59:13:963 -- (3504) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/28/10 23:59:13:963 -- (3504) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/28/10 23:59:14:057 -- (960) Blacklist cache - starting cleanup
07/28/10 23:59:15:525 -- AV Engine - NvcBinDate=07/15/10 09:45:44:000
07/28/10 23:59:15:525 -- AV Engine - NvcIncrDate=07/28/10 15:10:00:000
07/28/10 23:59:15:525 -- AV Engine - NVCMacroDate=07/15/10 09:13:54:000
07/28/10 23:59:15:525 -- AV Engine - Nse_w32Date=06/24/10 11:41:26:000
07/28/10 23:59:15:525 -- AV Engine - NCLDate=06/24/10 11:27:06:000
07/28/10 23:59:15:541 -- Reloading local black / white lists: SpamFilter.ini
07/29/10 00:00:13:996 -- (2300) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/29/10 00:00:13:996 -- (2300) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/29/10 00:00:14:011 -- (1216) Blacklist cache - starting cleanup
07/29/10 00:00:19:418 -- AV Engine - NvcBinDate=07/15/10 09:45:44:000
07/29/10 00:00:19:418 -- AV Engine - NvcIncrDate=07/28/10 15:10:00:000
07/29/10 00:00:19:418 -- AV Engine - NVCMacroDate=07/15/10 09:13:54:000
07/29/10 00:00:19:418 -- AV Engine - Nse_w32Date=06/24/10 11:41:26:000
07/29/10 00:00:19:418 -- AV Engine - NCLDate=06/24/10 11:27:06:000
07/29/10 00:00:19:433 -- Reloading local black / white lists: SpamFilter.ini
07/29/10 00:01:13:982 -- (508) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/29/10 00:01:13:982 -- (508) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/29/10 00:01:14:013 -- AV Engine - NvcBinDate=07/15/10 09:45:44:000
07/29/10 00:01:14:013 -- AV Engine - NvcIncrDate=07/28/10 15:10:00:000
07/29/10 00:01:14:013 -- AV Engine - NVCMacroDate=07/15/10 09:13:54:000
07/29/10 00:01:14:013 -- AV Engine - Nse_w32Date=06/24/10 11:41:26:000
07/29/10 00:01:14:013 -- AV Engine - NCLDate=06/24/10 11:27:06:000
07/29/10 00:01:14:013 -- Reloading local black / white lists: SpamFilter.ini
07/29/10 00:01:14:013 -- (3572) Blacklist cache - starting cleanup
07/29/10 00:01:14:013 -- (1784) Saved GreyListAllowed.txt
07/29/10 00:01:14:013 -- (1984) Starting to process quarantine directory...
07/29/10 00:01:19:138 -- (3920) HTTP Error in GetSFDBStats:Read Timeout
07/29/10 00:01:19:138 -- (1432) HTTP Error in GetSFDBStats:Read Timeout
07/29/10 00:02:14:046 -- AV Engine - NvcBinDate=07/15/10 09:45:44:000
07/29/10 00:02:14:046 -- AV Engine - NvcIncrDate=07/28/10 15:10:00:000
07/29/10 00:02:14:046 -- AV Engine - NVCMacroDate=07/15/10 09:13:54:000
07/29/10 00:02:14:046 -- AV Engine - Nse_w32Date=06/24/10 11:41:26:000
07/29/10 00:02:14:046 -- AV Engine - NCLDate=06/24/10 11:27:06:000
07/29/10 00:02:14:046 -- (392) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/29/10 00:02:14:046 -- (392) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/29/10 00:02:14:046 -- (188) Blacklist cache - starting cleanup
07/29/10 00:02:14:046 -- Reloading local black / white lists: SpamFilter.ini
07/29/10 00:03:14:047 -- (2396) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/29/10 00:03:14:047 -- (2396) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/29/10 00:03:14:313 -- AV Engine - NvcBinDate=07/15/10 09:45:44:000
07/29/10 00:03:14:313 -- AV Engine - NvcIncrDate=07/28/10 15:10:00:000
07/29/10 00:03:14:313 -- AV Engine - NVCMacroDate=07/15/10 09:13:54:000
07/29/10 00:03:14:313 -- AV Engine - Nse_w32Date=06/24/10 11:41:26:000
07/29/10 00:03:14:313 -- AV Engine - NCLDate=06/24/10 11:27:06:000
07/29/10 00:03:14:328 -- Reloading local black / white lists: SpamFilter.ini
07/29/10 00:03:14:532 -- (748) Blacklist cache - starting cleanup
07/29/10 00:03:15:532 -- SFDB_WebErrors counter has been reset. Value was:1
07/29/10 00:03:15:688 -- SFDB_WebErrors counter has been reset. Value was:1
07/29/10 00:04:13:971 -- (2348) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/29/10 00:04:13:971 -- (2348) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/29/10 00:04:13:971 -- (2076) Blacklist cache - starting cleanup
07/29/10 00:04:13:986 -- AV Engine - NvcBinDate=07/15/10 09:45:44:000
07/29/10 00:04:13:986 -- AV Engine - NvcIncrDate=07/28/10 15:10:00:000
07/29/10 00:04:13:986 -- AV Engine - NVCMacroDate=07/15/10 09:13:54:000
07/29/10 00:04:13:986 -- AV Engine - Nse_w32Date=06/24/10 11:41:26:000
07/29/10 00:04:13:986 -- AV Engine - NCLDate=06/24/10 11:27:06:000
07/29/10 00:04:13:986 -- Reloading local black / white lists: SpamFilter.ini
07/29/10 00:05:14:035 -- (2436) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/29/10 00:05:14:035 -- (2436) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/29/10 00:05:14:050 -- AV Engine - NvcBinDate=07/15/10 09:45:44:000
07/29/10 00:05:14:050 -- AV Engine - NvcIncrDate=07/28/10 15:10:00:000
07/29/10 00:05:14:050 -- AV Engine - NVCMacroDate=07/15/10 09:13:54:000
07/29/10 00:05:14:050 -- AV Engine - Nse_w32Date=06/24/10 11:41:26:000
07/29/10 00:05:14:050 -- AV Engine - NCLDate=06/24/10 11:27:06:000
07/29/10 00:05:14:066 -- Reloading local black / white lists: SpamFilter.ini
07/29/10 00:05:14:081 -- (2120) Blacklist cache - starting cleanup
07/29/10 00:06:13:974 -- (2664) Starting to process queue directory...
07/29/10 00:06:13:974 -- (3756) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/29/10 00:06:13:974 -- (3756) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/29/10 00:06:13:989 -- (680) Saved GreyListAllowed.txt
07/29/10 00:06:13:989 -- (676) Blacklist cache - starting cleanup
07/29/10 00:06:13:989 -- (2112) Starting to process quarantine directory...
07/29/10 00:06:14:005 -- AV Engine - NvcBinDate=07/15/10 09:45:44:000
07/29/10 00:06:14:005 -- AV Engine - NvcIncrDate=07/28/10 15:10:00:000
07/29/10 00:06:14:005 -- AV Engine - NVCMacroDate=07/15/10 09:13:54:000
07/29/10 00:06:14:005 -- AV Engine - Nse_w32Date=06/24/10 11:41:26:000
07/29/10 00:06:14:005 -- AV Engine - NCLDate=06/24/10 11:27:06:000
07/29/10 00:06:14:005 -- Reloading local black / white lists: SpamFilter.ini
07/29/10 00:07:13:975 -- (2348) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/29/10 00:07:13:975 -- (2348) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/29/10 00:07:13:991 -- AV Engine - NvcBinDate=07/15/10 09:45:44:000
07/29/10 00:07:13:991 -- AV Engine - NvcIncrDate=07/28/10 15:10:00:000
07/29/10 00:07:13:991 -- AV Engine - NVCMacroDate=07/15/10 09:13:54:000
07/29/10 00:07:13:991 -- AV Engine - Nse_w32Date=06/24/10 11:41:26:000
07/29/10 00:07:13:991 -- AV Engine - NCLDate=06/24/10 11:27:06:000
07/29/10 00:07:14:006 -- Reloading local black / white lists: SpamFilter.ini
07/29/10 00:07:14:006 -- (3928) Blacklist cache - starting cleanup
07/29/10 00:08:13:977 -- (3716) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/29/10 00:08:13:977 -- (3716) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/29/10 00:08:13:977 -- (3480) Blacklist cache - starting cleanup
07/29/10 00:08:14:008 -- AV Engine - NvcBinDate=07/15/10 09:45:44:000
07/29/10 00:08:14:008 -- AV Engine - NvcIncrDate=07/28/10 15:10:00:000
07/29/10 00:08:14:008 -- AV Engine - NVCMacroDate=07/15/10 09:13:54:000
07/29/10 00:08:14:008 -- AV Engine - Nse_w32Date=06/24/10 11:41:26:000
07/29/10 00:08:14:008 -- AV Engine - NCLDate=06/24/10 11:27:06:000
07/29/10 00:08:14:008 -- Reloading local black / white lists: SpamFilter.ini
07/29/10 00:09:13:978 -- (2984) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/29/10 00:09:13:978 -- (2984) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/29/10 00:09:13:994 -- AV Engine - NvcBinDate=07/15/10 09:45:44:000
07/29/10 00:09:13:994 -- AV Engine - NvcIncrDate=07/28/10 15:10:00:000
07/29/10 00:09:14:010 -- AV Engine - NVCMacroDate=07/15/10 09:13:54:000
07/29/10 00:09:14:010 -- AV Engine - Nse_w32Date=06/24/10 11:41:26:000
07/29/10 00:09:14:010 -- AV Engine - NCLDate=06/24/10 11:27:06:000
07/29/10 00:09:14:010 -- Reloading local black / white lists: SpamFilter.ini
07/29/10 00:09:14:010 -- (1804) Blacklist cache - starting cleanup
07/29/10 00:10:14:105 -- (2076) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/29/10 00:10:14:105 -- (2076) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/29/10 00:10:14:105 -- (1048) Blacklist cache - starting cleanup
07/29/10 00:10:16:839 -- AV Engine - NvcBinDate=07/15/10 09:45:44:000
07/29/10 00:10:16:839 -- AV Engine - NvcIncrDate=07/28/10 15:10:00:000
07/29/10 00:10:16:839 -- AV Engine - NVCMacroDate=07/15/10 09:13:54:000
07/29/10 00:10:16:839 -- AV Engine - Nse_w32Date=06/24/10 11:41:26:000
07/29/10 00:10:16:839 -- AV Engine - NCLDate=06/24/10 11:27:06:000
07/29/10 00:10:16:839 -- Reloading local black / white lists: SpamFilter.ini
]]> Thu, 29 Jul 2010 16:43:37 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6859&PID=13729#13729 Announcements : SFDB database currently unavailable http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6858&PID=13728#13728 Author: LogSat
Subject: SFDB database currently unavailable
Posted: 27 July 2010 at 11:27pm

The SFDB database is operational again.

]]> Tue, 27 Jul 2010 23:27:04 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6858&PID=13728#13728 Announcements : SFDB database currently unavailable http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6858&PID=13727#13727 Author: LogSat
Subject: SFDB database currently unavailable
Posted: 27 July 2010 at 9:35pm

Approximately an hour ago we experienced a hardware failure on one of our database servers which caused some corruption to the SFDB database. The SFDB filter is currently offline while the database is being rebuild. The service will be restored in a few hours. SpamFilter will automatically resume using the SFDB database as soon as it is back online.

We'll update the posting as soon as the unexpected maintenance is completed.
]]> Tue, 27 Jul 2010 21:35:12 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6858&PID=13727#13727 Spam Filter ISP Support : MySQL commands for cleanup http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6845&PID=13726#13726 Author: yapadu
Subject: MySQL commands for cleanup
Posted: 27 July 2010 at 6:13pm

So if you keep the email for two weeks, you end up with maybe a little over 2 million messages in that table.

It should not be a big issue for mysql to hold that many records in a database.  What type of hardware is the database running on?
]]> Tue, 27 Jul 2010 18:13:36 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6845&PID=13726#13726 Spam Filter ISP Support : MySQL commands for cleanup http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6845&PID=13725#13725 Author: morten44
Subject: MySQL commands for cleanup
Posted: 27 July 2010 at 5:58pm

Hi
Thanks for reply
We get about 120.000-150.000 incomming mails a day
About 90% is spam
I think our problem has to do with the size of the mysql database as when it gets big spamfilter freezes when mysql is running. When i stop mysql, spamfiler start to work ok again.
Our spamfilter program is working good as long as we dont the quarantene database. IT works well for 3 weeks after a new install and then the problems starts
 
 
]]> Tue, 27 Jul 2010 17:58:11 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6845&PID=13725#13725 Spam Filter ISP Support : Spammers using SpamFilter to send Spam http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6857&PID=13724#13724 Author: ITI Computers
Subject: Spammers using SpamFilter to send Spam
Posted: 27 July 2010 at 9:10am

Thanks for the reply.
Adding our users to the "Authorized To" list is not a viable option, as we have 100's of domains and 1000's of users. And more being added all the time, which we do not control.
 
I upgraded our SF program yesterday to the newest version on the site, SpamFilter ISP (v4.1.2.812), I did not see a link to the 4.2.4.830 version. Is it stable? And can you provide a link to it either here or to my email?
]]> Tue, 27 Jul 2010 09:10:11 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6857&PID=13724#13724 Spam Filter ISP Support : MySQL commands for cleanup http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6845&PID=13723#13723 Author: yapadu
Subject: MySQL commands for cleanup
Posted: 27 July 2010 at 7:22am

tblmsgs stores the actual email that has been placed in quarantine.  You can only make this table smaller by storing the messages for fewer days.  If you currently store for 14 days, if you reduce it to 7 days the table size would reduce by about half.

I see from this thread you are doing your own cleanup, and not relying on spamfilter to do it so you might want to make sure it is working.

How many messages do you process a day that you have a 5gb tblmsgs table?
]]> Tue, 27 Jul 2010 07:22:40 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6845&PID=13723#13723 Spam Filter ISP Support : Spammers using SpamFilter to send Spam http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6857&PID=13722#13722 Author: LogSat
Subject: Spammers using SpamFilter to send Spam
Posted: 26 July 2010 at 9:23pm

Bill,

SpamFilter v4.2.4.830 that was released a few months ago has the following feature, which is exactly what you're looking for: 

/ New to VersionNumber = '4.2.4.830';
{TODO -cNew To avoid backscatter, if an incoming email passes all filtering rules, but cannot be forwarded (ex. mailbox full, non-existent user), SpamFilter maintains open the incoming remote connection until it can verify with the destination server that the email can be delivered. If not, a 5xx error is output forcing the remote server to generate the NDR, rather than having SpamFilter send an NDR notification email}

With versions of SpamFilter prior to v4.2, a very effective way to both eliminate the backscatter and to at the same time reduce spam, is to implement the "Authorized TO" whitelist in SpamFilter. If you provide SpamFilter a list with all the valid email users on your system, SpamFilter will immediately reject any attempt to deliver emails to non-existent users. This causes an immediate disconnect of the spammer, without any NDRs (non-deliverable receipt emails) being generated.
]]> Mon, 26 Jul 2010 21:23:18 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6857&PID=13722#13722 Spam Filter ISP Support : MySQL commands for cleanup http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6845&PID=13719#13719 Author: morten44
Subject: MySQL commands for cleanup
Posted: 26 July 2010 at 12:57pm

Hi
Thanks for your reply
At a closer look I can see that after Optemizing the database the tblquarantene is about 120MB and that is acceptable. I cant remember what it was before because my focus was on the tblmsgs table. That is about 5GB and that does not seem to get smaller.
 
Do you know what the table is used for?
Is there a way to empty that one or make it smaller?
 
I cant even open it as it freezes, probably because its to big.

At the moment I have managed to get Spamfilter up and running again by disable the database, but its not optimal.
 
I seem to have this issue every time i setup this system. I have tried to setup ISP spamfilter 3 times on 2 servers and it runs fine for 2-3 weeks, then it starts to behave strange and customers can not connect and send/receive. At the same time server starts to be very slow, to a point of freezing.
If i broswe using Windows Explorer inside the spamfilter homedir and click on quarantene Explorer freezes.
 
Hope there are some with simular issues who has a solution to the freezing or how to make the tblmsgs smaller
 
 
Regards
Morten
]]> Mon, 26 Jul 2010 12:57:03 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6845&PID=13719#13719