Crashing Service |
Post Reply 
|
| Author | |
Bart 
Newbie 
Joined: 20 August 2008 Location: Holland Status: Offline Points: 18 |
 Post Options
 Thanks(0)
 Quote Reply
 Topic: Crashing ServicePosted: 29 November 2008 at 12:32pm |
|
last 2 weeks mij SpamFilter has crashed a couple of times i have no idea what's causing this problem.
11-29-08 07:02:23:755 -- Exception occurred during CheckDatabaseConnection: Access violation at address 00523A27 in module 'SpamFilterSvc.exe'. Read of address 00000008
11-29-08 07:02:23:755 -- Exception occurred during UpdateOtherSettings: Access violation at address 00601C70 in module 'SpamFilterSvc.exe'. Read of address 00000324 11-29-08 07:02:23:755 -- Reloading local black / white lists: SpamFilter.ini 11-29-08 07:02:23:848 -- (1701995880) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-29-08 07:02:23:848 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-29-08 07:02:23:848 -- (0) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-29-08 07:02:23:848 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-29-08 07:02:23:848 -- (1768842608) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-29-08 07:02:23:864 -- (0) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-29-08 07:02:23:864 -- (0) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-29-08 07:02:23:864 -- (1949324108) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-29-08 07:02:23:864 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-29-08 07:02:23:864 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-29-08 07:02:23:880 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-29-08 07:02:23:880 -- (1768842608) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-29-08 07:02:23:880 -- (1481924981) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified do you have an idee ???
|
|
 |
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 29 November 2008 at 3:36pm |
|
Bart,
Could you please zip and email us the entire SpamFilter's activity logfiles for the 28th and 29th? The errors are rather unusual, and it's possible that there were other crash events prior to these than then subsequently caused the entries above. If the zip is over 5MB in file, please upload it to our FTP server - I'll send you a PM with the FTP login info. |
|
|
|
|
Bart
Newbie
Joined: 20 August 2008 Location: Holland Status: Offline Points: 18 |
Post Options
Thanks(0)
Quote Reply
Posted: 30 November 2008 at 5:58am |
|
both files are on the ftp server
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 30 November 2008 at 11:41am |
|
Bart,
There's a mismatch in the logfile we received and the section you posted. On the log for the 29th we received, these are the 3 consecutive entries we have in the logs, showing **just one error** at 07:02:23:755: 11-29-08 07:02:23:270 -- (7464) IPcache Limbo - removed 1 entries during cleanup 11-29-08 07:02:23:755 -- (7968) Exception occurred during TTerminateIdleThreads.DoCleanupListView: Access violation at address 00654A04 in module 'SpamFilterSvc.exe'. Read of address 00000278 11-29-08 18:22:57:036 -- SpamFilter ISP v4.0.1.785 Listening on 192.168.171.1:25, After the single exception at 7:02:23:755, we do not see any entries in the logs until SpamFilter is started at 18:22:57:036. So we do not see a single one of the errors you reported in the post, while instead we have a different error in the log you uploaded at pretty much the same time. Can you please let us know where you retrieved the above log entries in this post and, if you know, why they are not in the logs we received? The error we have in the actual logfile (Exception occurred during TTerminateIdleThreads.DoCleanupListView) does actually look like it could be the culprit for the cascade of errors after, but we'd like to have more info as of the reason of the errors mismatch before proceeding. |
|
|
|
|
Bart
Newbie
Joined: 20 August 2008 Location: Holland Status: Offline Points: 18 |
Post Options
Thanks(0)
Quote Reply
Posted: 01 December 2008 at 4:35am |
|
The error i posted in my first post i found in my system root c:\20081129.log
What i see now is that there was an error on 11-11, 20-11 and 29-11
Looks like it is crashing every 9 days.
I get a debugger question on the screen and when i cancel it i can restart the service and everything is working fine.
here are the other 2 logfiles i found on my C:\ drive
-------- 20081128.log --------------------------
11-20-08 01:51:09:422 -- Exception occurred during CheckDatabaseConnection: Access violation at address 00523A27 in module 'SpamFilterSvc.exe'. Read of address 00000008
11-20-08 01:51:09:422 -- Exception occurred during UpdateOtherSettings: Access violation at address 00601C70 in module 'SpamFilterSvc.exe'. Read of address 00000324 11-20-08 01:51:09:422 -- Reloading local black / white lists: SpamFilter.ini 11-20-08 01:51:09:547 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-20-08 01:51:09:562 -- (0) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-20-08 01:51:09:562 -- (1769238607) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-20-08 01:51:09:562 -- (0) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-20-08 01:51:09:562 -- (1701995880) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-20-08 01:51:09:578 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-20-08 01:51:09:578 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-20-08 01:51:09:578 -- (1632859457) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-20-08 01:51:09:578 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-20-08 01:51:09:578 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-20-08 01:51:09:593 -- (0) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified 11-20-08 01:51:09:593 -- (1952804156) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified ------------------------
------------------ 20081111.log ------------------------
11-11-08 09:24:38:195 -- (14024) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
11-11-08 09:24:38:195 -- (14024) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0 11-11-08 09:24:38:195 -- (13320) Blacklist cache - starting cleanup 11-11-08 09:24:38:304 -- (13320) IPcache Limbo - removed 77 entries during cleanup 11-11-08 09:24:38:413 -- SFDB_WebErrors counter has been reset. Value was:1 11-11-08 09:24:38:413 -- SFDB_WebErrors counter has been reset. Value was:1 11-11-08 09:24:46:773 -- (13420) Connection from: 62.113.86.199 - Originating country : Russian Federation 11-11-08 09:24:46:898 -- (13420) Received MAIL FROM: <> 11-11-08 09:24:46:960 -- (13420) Received RCPT TO: www.info@peerlings.nl 11-11-08 09:24:46:960 -- (13420) - EmailTO is not in AuthorizedTOEmail list... 11-11-08 09:24:46:960 -- (13420) 62.113.86.199 - Mail from: To: www.info@peerlings.nl will be rejected 11-11-08 09:24:47:195 -- (9336) Connection from: 213.147.36.124 - Originating country : Russian Federation 11-11-08 09:24:47:335 -- (9336) Received MAIL FROM: <> 11-11-08 09:24:47:413 -- (9336) Received RCPT TO: www.info@peerlings.nl 11-11-08 09:24:47:413 -- (9336) - EmailTO is not in AuthorizedTOEmail list... 11-11-08 09:24:47:413 -- (9336) 213.147.36.124 - Mail from: To: www.info@peerlings.nl will be rejected 11-11-08 09:24:47:429 -- (10668) Connection from: 118.137.75.42 - Originating country : Indonesia 11-11-08 09:24:47:491 -- (9336) Blacklist cache - Added 213.147.36.124 to limbo 11-11-08 09:24:47:710 -- (9336) SFDB - Added 213.147.36.124 - Response: Error=0 11-11-08 09:24:47:710 -- (9336) Disconnect 11-11-08 09:24:48:241 -- (13900) Connection from: 217.112.42.7 - Originating country : Russian Federation 11-11-08 09:24:48:241 -- (13900) IP is in local blacklist cache. Disconnecting: 217.112.42.7 11-11-08 09:24:48:304 -- (13900) No Data Received 11-11-08 09:24:48:304 -- (13900) Disconnect 11-11-08 09:24:48:429 -- (12624) Connection from: 195.46.113.88 - Originating country : Russian Federation 11-11-08 09:24:48:648 -- (13420) Start virus scan 11-11-08 09:24:48:648 -- (13420) Starting bayesian procedures 11-11-08 09:24:48:695 -- (12512) Time to add Msg to Bayes corpus:0 11-11-08 09:24:48:757 -- (13420) Blacklist cache - Added 62.113.86.199 to limbo 11-11-08 09:24:48:976 -- (13420) SFDB - Added 62.113.86.199 - Response: Error=0 11-11-08 09:24:48:976 -- (13420) Disconnect 11-11-08 09:24:49:179 -- (12624) Received MAIL FROM: <> 11-11-08 09:24:49:382 -- (12624) Received RCPT TO: www.info@peerlings.nl 11-11-08 09:24:49:382 -- (12624) - EmailTO is not in AuthorizedTOEmail list... 11-11-08 09:24:49:382 -- (12624) 195.46.113.88 - Mail from: To: www.info@peerlings.nl will be rejected 11-11-08 09:24:49:679 -- (10668) Received MAIL FROM: <kefxfxcyeydiz@xfxcyey.com> 11-11-08 09:24:49:835 -- (12624) Start virus scan 11-11-08 09:24:49:835 -- (12624) Starting bayesian procedures 11-11-08 09:24:49:882 -- (12512) Time to add Msg to Bayes corpus:0 11-11-08 09:24:50:101 -- (12624) Blacklist cache - Added 195.46.113.88 to limbo 11-11-08 09:24:50:320 -- (12624) SFDB - Added 195.46.113.88 - Response: Error=0 11-11-08 09:24:50:320 -- (12624) Disconnect 11-11-08 09:24:50:695 -- (10668) Received RCPT TO: eerlings@tns-online.nl 11-11-08 09:24:50:710 -- (10668) - EmailTO is not in AuthorizedTOEmail list... 11-11-08 09:24:50:710 -- (10668) 118.137.75.42 - Mail from: kefxfxcyeydiz@xfxcyey.com To: eerlings@tns-online.nl will be rejected 11-11-08 09:24:50:804 -- (13688) Adding to C:\Program Files\SpamFilter\domains\tns-online.nl\WL_AutoWhiteListForceDelivery.txt:mailer.bhf.daegb.salesquest@mc1.nl|esther@tns-online.nl 11-11-08 09:24:50:835 -- (13688) Delivering quarantined email from <mailer.bhf.daegb.salesquest@mc1.nl> to esther@tns-online.nl 11-11-08 09:24:50:882 -- (13092) Starting to process queue directory... 11-11-08 09:24:50:960 -- Exception occurred during CheckDatabaseConnection: Access violation at address 00523A27 in module 'SpamFilterSvc.exe'. Read of address 00000008 ------------------------------------ Looks like every thime the service crashes it writes it last lines to the c:\ drive
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 01 December 2008 at 4:35pm |
|
bart,
There's something not right with the installation of SpamFilter, as *all* the logfiles must be located in one single directory - by default the \SpamFilter\logfiles directory. This location can be changed via the following parameter in the SpamFilter.ini file: LogFilePath=C:\SpamFilter\logfiles Are you by any chance running multiple instances of SpamFilter, or maybe opening the standalone version of SpamFilter while running SpamFilter's service? Can you verify this is not the case by looking at the processes in the Windows Task Manager and ensuring you have only a single instance of either "SpamFilter.exe" or "SpamFilterSvc.exe" in the list? Having both entries in there, or multiple instances of the same problem is bound to cause problems, unless you configure each instance so as to not interfere with the others, and they are all located in separate directories. Is it possible for us to remote into your server to have a better look? You can contact us by email at support at logsat.com to provide us further details. |
|
|
|
|
Bart
Newbie
Joined: 20 August 2008 Location: Holland Status: Offline Points: 18 |
Post Options
Thanks(0)
Quote Reply
Posted: 02 December 2008 at 5:52am |
|
There's only one instance of SpamfilterISP running on my server as a service. All my logfiles are in c:\program files\spamfilter (Default)Only when te service crashes it puts a logfile to c:\
I'll send you an email with a username and password to login to my server and have a look yourself.
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 03 December 2008 at 10:56pm |
|
This is something we've never seen before... It looks like there are some pretty specific access violations errors within SpamFilter, and when these occur, the location in RAM that stores the path for the logfiles gets corrupted, which causes SpamFilter to start writing the logs at the root of the C: drive until it crashes completely.
We're seeing a pattern of errors similar to the following: 11-20-08 01:51:09:422 -- (11520) Exception occurred during TTerminateIdleThreads.DoCleanupListView: Access violation at address 00654A04 in module 'SpamFilterSvc.exe'. Read of address 00000278 When these occur, the problems appear to begin. The "DoCleanupListView" process deals with the removal of stale connections in the "Connections" tab in SpamFilter that displays the live view of incoming connections. It's possible that there is a conflict with the video display that causes the errors. I've disabled the connections grid (the settings is in the "Settings - Configuration" tab) to see if this solves the problem. Can you please monitor it for a few days and let us know if it helps? As a side note, while checking your other settings, I noticed that none of your MAPS RBL blacklist server are working (and thus this filter is not stopping any spam), as the list of servers is missing the ",true" suffix that tells SpamFilter to reverse the IP octet when making a query to the BL servers. The list you have is: bl.spamcop.net zen.spamhaus.org sbl-xbl.spamhaus.org dnsbl.njabl.org cbl.abuseat.org But it should actually be: bl.spamcop.net,true zen.spamhaus.org,true sbl-xbl.spamhaus.org,true dnsbl.njabl.org,true cbl.abuseat.org,true I have not made any changes to this in case you have it so for a reason. Also please note that SpamFilter will will take keywords literally as entered. So if a keyword is listed as: "this is a test" SpamFilter will search for the text that has a double-quote, followed by this is a test and then followed by another double-quote. So if you're looking to use a keyword that consists of the phrase "this is a test", the keyword entry should not have the quotes and should be listed as follows: this is a test If you wish to use an "and", so you want to search for "this is a test" AND "this one too", then you will need to separate the two keywords with a comma (and omit the quotes, as follows: this is a test,this one too There is no OR support, but you can use RegEx (Regular Expressions) to create complex keyword searches. |
|
|
|
|
Bart
Newbie
Joined: 20 August 2008 Location: Holland Status: Offline Points: 18 |
Post Options
Thanks(0)
Quote Reply
Posted: 04 December 2008 at 2:35am |
|
Tnx for your reaction.
I'll watch it for some day's and see if it crashed again and i'll let you know.
I also will make the changes you gave me, the keyword list i extracted from GFI and didn't make any changes. but i will edit it.
Tnx again, i'll keep you posted.
|
|
|
|
Topic Options|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.180 seconds.