LogSat Software

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   Hello,

I'm not sure of the meaning of what I'm seeing in our logs. The main problem with it is we lose logged info as the snippet below is all we'll see in the log over and over again.

Our logs roll over at midnight every day we average about 70MB per 24 hours. Our logs are sent to another server for parsing via the spamfilter.ini path setting. This error usually occurs just after the rollover, but also sometimes during the day and then we don't see mail traffic logged. This is happening about once every 2 weeks, sometimes more frequently.

To 'fix' this I rename the log file and restart the spam service, it usually creates a new log file and starts logging traffic. Could our enterprise antivirus (not SF's) being scanning directories best left alone? 

We have SF v.4.2.4.834. We don't use the Baysian filter anymore. We have the SF server running on server 2003 VM with 2 cpu's and 2 GB of ram.

-- Reloading local black / white lists: SpamFilter.ini
09/23/10 07:50:13:987 -- (10028) EMail from -  - no recipients file found, deleting from queue
09/23/10 07:50:14:050 -- (6740) EMail from -  - no recipients file found, deleting from queue
09/23/10 07:50:14:112 -- (8948) EMail from -  - no recipients file found, deleting from queue
09/23/10 07:51:11:909 -- (9252) Blacklist cache - starting cleanup
09/23/10 07:51:14:268 -- AV Engine - NvcBinDate=09/07/10 08:48:08:000
09/23/10 07:51:14:268 -- AV Engine - NvcIncrDate=09/23/10 09:47:20:000
09/23/10 07:51:14:268 -- AV Engine - NVCMacroDate=09/07/10 08:41:58:000
09/23/10 07:51:14:268 -- AV Engine - Nse_w32Date=09/09/10 11:06:46:000
09/23/10 07:51:14:268 -- AV Engine - NCLDate=06/24/10 11:27:06:000
09/23/10 07:51:14:284 -- Reloading local black / white lists: SpamFilter.ini
09/23/10 07:52:11:908 -- (9944) Blacklist cache - starting cleanup
09/23/10 07:52:14:596 -- AV Engine - NvcBinDate=09/07/10 08:48:08:000
09/23/10 07:52:14:596 -- AV Engine - NvcIncrDate=09/23/10 09:47:20:000
09/23/10 07:52:14:596 -- AV Engine - NVCMacroDate=09/07/10 08:41:58:000
09/23/10 07:52:14:596 -- AV Engine - Nse_w32Date=09/09/10 11:06:46:000
09/23/10 07:52:14:596 -- AV Engine - NCLDate=06/24/10 11:27:06:000
09/23/10 07:52:14:611 -- Reloading local black / white lists: SpamFilter.ini
09/23/10 07:53:12:033 -- AV Engine - NvcBinDate=09/07/10 08:48:08:000
09/23/10 07:53:12:033 -- AV Engine - NvcIncrDate=09/23/10 09:47:20:000
09/23/10 07:53:12:033 -- AV Engine - NVCMacroDate=09/07/10 08:41:58:000
09/23/10 07:53:12:033 -- AV Engine - Nse_w32Date=09/09/10 11:06:46:000
09/23/10 07:53:12:033 -- AV Engine - NCLDate=06/24/10 11:27:06:000
09/23/10 07:53:12:064 -- Reloading local black / white lists: SpamFilter.ini
09/23/10 07:53:12:064 -- (4204) Blacklist cache - starting cleanup
09/23/10 07:54:11:907 -- (9856) Blacklist cache - starting cleanup
09/23/10 07:54:12:017 -- AV Engine - NvcBinDate=09/07/10 08:48:08:000
09/23/10 07:54:12:017 -- AV Engine - NvcIncrDate=09/23/10 09:47:20:000
09/23/10 07:54:12:032 -- AV Engine - NVCMacroDate=09/07/10 08:41:58:000
09/23/10 07:54:12:032 -- AV Engine - Nse_w32Date=09/09/10 11:06:46:000
09/23/10 07:54:12:032 -- AV Engine - NCLDate=06/24/10 11:27:06:000
09/23/10 07:54:12:048 -- Reloading local black / white lists: SpamFilter.ini
09/23/10 07:55:11:907 -- (7052) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
09/23/10 07:55:11:907 -- (7052) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
09/23/10 07:55:12:032 -- AV Engine - NvcBinDate=09/07/10 08:48:08:000
09/23/10 07:55:12:032 -- AV Engine - NvcIncrDate=09/23/10 09:47:20:000
09/23/10 07:55:12:032 -- AV Engine - NVCMacroDate=09/07/10 08:41:58:000
09/23/10 07:55:12:032 -- AV Engine - Nse_w32Date=09/09/10 11:06:46:000
09/23/10 07:55:12:032 -- AV Engine - NCLDate=06/24/10 11:27:06:000
09/23/10 07:55:12:048 -- Reloading local black / white lists: SpamFilter.ini
09/23/10 07:55:12:063 -- (7636) Saved GreyListAllowed.txt
09/23/10 07:55:12:063 -- (8528) Blacklist cache - starting cleanup

Author	Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic
jortmann Members Profile Send Private Message Find Members Posts Add to Buddy List Newbie Joined: 13 November 2007 Location: Canada Status: Offline Points: 11	Post Options Post Reply Quote jortmann Report Post Thanks(0) Quote Reply Topic: Traffic logging stops Posted: 23 September 2010 at 10:38am
	Hello, I'm not sure of the meaning of what I'm seeing in our logs. The main problem with it is we lose logged info as the snippet below is all we'll see in the log over and over again. Our logs roll over at midnight every day we average about 70MB per 24 hours. Our logs are sent to another server for parsing via the spamfilter.ini path setting. This error usually occurs just after the rollover, but also sometimes during the day and then we don't see mail traffic logged. This is happening about once every 2 weeks, sometimes more frequently. To 'fix' this I rename the log file and restart the spam service, it usually creates a new log file and starts logging traffic. Could our enterprise antivirus (not SF's) being scanning directories best left alone? We have SF v.4.2.4.834. We don't use the Baysian filter anymore. We have the SF server running on server 2003 VM with 2 cpu's and 2 GB of ram. -- Reloading local black / white lists: SpamFilter.ini 09/23/10 07:50:13:987 -- (10028) EMail from - - no recipients file found, deleting from queue 09/23/10 07:50:14:050 -- (6740) EMail from - - no recipients file found, deleting from queue 09/23/10 07:50:14:112 -- (8948) EMail from - - no recipients file found, deleting from queue 09/23/10 07:51:11:909 -- (9252) Blacklist cache - starting cleanup 09/23/10 07:51:14:268 -- AV Engine - NvcBinDate=09/07/10 08:48:08:000 09/23/10 07:51:14:268 -- AV Engine - NvcIncrDate=09/23/10 09:47:20:000 09/23/10 07:51:14:268 -- AV Engine - NVCMacroDate=09/07/10 08:41:58:000 09/23/10 07:51:14:268 -- AV Engine - Nse_w32Date=09/09/10 11:06:46:000 09/23/10 07:51:14:268 -- AV Engine - NCLDate=06/24/10 11:27:06:000 09/23/10 07:51:14:284 -- Reloading local black / white lists: SpamFilter.ini 09/23/10 07:52:11:908 -- (9944) Blacklist cache - starting cleanup 09/23/10 07:52:14:596 -- AV Engine - NvcBinDate=09/07/10 08:48:08:000 09/23/10 07:52:14:596 -- AV Engine - NvcIncrDate=09/23/10 09:47:20:000 09/23/10 07:52:14:596 -- AV Engine - NVCMacroDate=09/07/10 08:41:58:000 09/23/10 07:52:14:596 -- AV Engine - Nse_w32Date=09/09/10 11:06:46:000 09/23/10 07:52:14:596 -- AV Engine - NCLDate=06/24/10 11:27:06:000 09/23/10 07:52:14:611 -- Reloading local black / white lists: SpamFilter.ini 09/23/10 07:53:12:033 -- AV Engine - NvcBinDate=09/07/10 08:48:08:000 09/23/10 07:53:12:033 -- AV Engine - NvcIncrDate=09/23/10 09:47:20:000 09/23/10 07:53:12:033 -- AV Engine - NVCMacroDate=09/07/10 08:41:58:000 09/23/10 07:53:12:033 -- AV Engine - Nse_w32Date=09/09/10 11:06:46:000 09/23/10 07:53:12:033 -- AV Engine - NCLDate=06/24/10 11:27:06:000 09/23/10 07:53:12:064 -- Reloading local black / white lists: SpamFilter.ini 09/23/10 07:53:12:064 -- (4204) Blacklist cache - starting cleanup 09/23/10 07:54:11:907 -- (9856) Blacklist cache - starting cleanup 09/23/10 07:54:12:017 -- AV Engine - NvcBinDate=09/07/10 08:48:08:000 09/23/10 07:54:12:017 -- AV Engine - NvcIncrDate=09/23/10 09:47:20:000 09/23/10 07:54:12:032 -- AV Engine - NVCMacroDate=09/07/10 08:41:58:000 09/23/10 07:54:12:032 -- AV Engine - Nse_w32Date=09/09/10 11:06:46:000 09/23/10 07:54:12:032 -- AV Engine - NCLDate=06/24/10 11:27:06:000 09/23/10 07:54:12:048 -- Reloading local black / white lists: SpamFilter.ini 09/23/10 07:55:11:907 -- (7052) Running TTerminateIdleThreads - SFTC=0 - SFFC=0 09/23/10 07:55:11:907 -- (7052) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0 09/23/10 07:55:12:032 -- AV Engine - NvcBinDate=09/07/10 08:48:08:000 09/23/10 07:55:12:032 -- AV Engine - NvcIncrDate=09/23/10 09:47:20:000 09/23/10 07:55:12:032 -- AV Engine - NVCMacroDate=09/07/10 08:41:58:000 09/23/10 07:55:12:032 -- AV Engine - Nse_w32Date=09/09/10 11:06:46:000 09/23/10 07:55:12:032 -- AV Engine - NCLDate=06/24/10 11:27:06:000 09/23/10 07:55:12:048 -- Reloading local black / white lists: SpamFilter.ini 09/23/10 07:55:12:063 -- (7636) Saved GreyListAllowed.txt 09/23/10 07:55:12:063 -- (8528) Blacklist cache - starting cleanup

jortmann Members Profile Send Private Message Find Members Posts Add to Buddy List Newbie Joined: 13 November 2007 Location: Canada Status: Offline Points: 11	Post Options Post Reply Quote jortmann Report Post Thanks(0) Quote Reply Posted: 23 September 2010 at 11:02am
	Sorry, I realized that I posted about this about a 2 months ago. At that time it was a one off. But now the logging stops too often. Looking at the previous responses I'll check Sawmill (the log parser) for any strange settings. I know I did set Sawmill not to reload already parsed logs but to remember what it already parsed in order to speed up the process, perhaps this isn't good after all. Thank you.

LogSat Members Profile Send Private Message Find Members Posts Add to Buddy List Admin Group Joined: 25 January 2005 Location: United States Status: Offline Points: 4104	Post Options Post Reply Quote LogSat Report Post Thanks(0) Quote Reply Posted: 23 September 2010 at 10:51pm
	jortmann, Are you certain that you don't have two instances of SpamFilter running at the same time, for example running both the SpamFilter service in the background, and then starting up the stand-alone version of SpamFilter? You can tell by looking at Task Manager for two SpamFilter.exe and/or SpamFilterSvc.exe running at the same time. Having two instances interfering with each other will also be logged in the SpamFilter's activity logfile with an error similar to: Exception occurred during PerformPostStartupTasks: Could not bind socket. Address and port are already in use.
	Roberto Franceschetti LogSat Software Spam Filter ISP

LogSat Software

Site Navigation[Skip]

Spam Filter ISP Support Forum

Traffic logging stops