|
Eran,
It usually means that the RegEx has a problem (like not the correct number of Parens) but I am not getting these except on a check for invalis email addresses when the address is WAY too long. In that case, the entry "Loop Stack Exceeded" is in the log. THIS IS NORMAL and prevents a high CPU condition.
If you have one message source that goes along with one of your log entries, I would send the information to mailto:support@logsat.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - support@logsat.com and ask Roberto.
One very important question ... what build of SpamFilter are you running? There are new builds that did, in fact, correct a condition that could cause this. I am running build 206 and the following RegEx's have been fully tested with that build.
((<[!--]+[\x20]{0,1}[a-zA-Z0-9]{10,}[\x20]{0,1}[!--](.+)){2,})
((http|3dhttp)://.{0,26}(((%.+%))|@|:)[(\d|\w)])
( http://+[\d]{1,3}\.{1}[\d]{1,3}\.{1}[\d]{1,3}\.{1}[\d]{1,3" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://+" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://+ [\d]{1,3}\.{1}[\d]{1,3}\.{1}[\d]{1,3}\.{1}[\d]{1,3})
(( http://http:/" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://http:/ \w)|(<(\w){3,10}(\x20/>)|(\* http://w" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://w )))
(<[!--]+[a-zA-Z0-9]{2,3}(-\->))
(((natural penis)|(arge your p)|(1-4 inches)|(3 - 5 inches\!)|(generic viagra)|(123respmarket)|(herbalpillsonline)|(herbaltrials\.com)|(naturalherbal)|(pillsavings)|(gsc\-100)|(go771world)))
((text\-decoration: blink)|(click here to start)|(limited time (special|offer))|(your privacy is extremely important to us)|(this is not spam))
(((www\.)|( http://))(\w){1,20}(4u)\.(biz|com|net)|(medsonsale\.biz)|(freeandgetsave)|(opportunit12)|(thirdw\.com)|(teflondoninc)|(epromotionad" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http:// ))(\w){1,20}(4u)\.(biz|com|net)|(medsonsale\.biz)|(freeandgetsave)|(opportunit12)|(thirdw\.com)|(teflondoninc)|(epromotionad))
((lsgone\.php)|(isgone\.php)|(exit\.asp)|(mc4\.idetermination)|(medsusa\.biz)|(getitwhileucan)|(\&\#105)|(4improvement\.biz)|(best\-ratez\.biz)|(genoveseinc\.biz)|(greatestoffersite\.biz)|(gootle\.us))
((remove\.php)|(hit\.php)|(re\-move))
(content\-type:\x20text/(html|plain)(;){0,1}((\r\n){0,2}|((\r\n){0,2}(\t|((\x20){0,15}))charset(.){5,20}))(\r\n){0,3}content-transfer\-encoding:\x20base64\r\n)
((you credit card has)|(card has been charged for))
((spa m kil)|(spa m bloc))
Dan S.
|