Print Page | Close Window

SF service terminates unexpectedly after starting

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6769
Printed Date: 05 February 2025 at 11:56am


Topic: SF service terminates unexpectedly after starting
Posted By: lyndonje
Subject: SF service terminates unexpectedly after starting
Date Posted: 02 November 2009 at 5:38am
We had a customer who turned off their server at the weekend, and there seems to have been an incredibly large number of emails received from a yahoo group to one of their recipients.

Our client has turned on their server this morning and we have started to deliver the emails, but for some reason their server is generating a bounce back to yahoo saying the message has been forwarded more than the maximum allowed?

Anyhow, for the time being I have blacklisted the FROM address, and stopped their server from sending outbound mail until we manage to settle things down.

Noticed that the queue directory on the SF server had over 100,000 files in it - which I assume most are related to the problem mentioned above. Suddenly SF stopped responding, and so I restarted the SF service. Upon restarting, the SF GUI template appears, CPU runs at 100% and after about 4 seconds the GUI disappears and then the service shows as stopped, with error in system event viewer stating service had terminated unexpectedly. 

Tried restarting the server which made no difference. Then wondered if SF was erroring due to the number of files in the queue folder. So renamed the queue folder and created a new empty one - still no different. Then incase any of the SF .exe or .dll had corrupted for any reason, I've overwrote them with the originals from the ZIP file from when the current version was downloaded. Again this made no difference.

There is plenty of free disk space - what could be causing this??


Replies:
Posted By: LogSat
Date Posted: 02 November 2009 at 7:32am
Lyndon,

Can you please zip and email us SpamFilter's activity logfile for today and yesterday so we can take a look? 100,000 files in the queue are going to cause higher load on the server until all the queue is processed, but should not cause crasher. If you rename that folder, thus eliminating this queue as the cause, there is likely something else going on. I'll contact you via a PM on the forum to provide you our FTP access info in case the zip is over 8MB (too big for email).


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: lyndonje
Date Posted: 02 November 2009 at 7:49am
Hi Roberto,

Logs uploaded! :)

Posted By: LogSat
Date Posted: 02 November 2009 at 8:49am
Lyndon,

I see a huge amount of database timeout errors while SpamFilter is restarting, and it's possible that this may be contributing in the problem. Can you try to start SpamFilter without having any SMTP traffic being directed to the server so that SpamFilter has time to startup reading the database settings without having to deal with incoming email as well? If you can't control the flow of emails to SpamFilter's server, you can try to change the SMTP listening port in SpamFilter from 25 to 26, which will cause all incoming emails to stop. If SpamFilter starts up, you can then switch the port back to 25 while SpamFilter is running.
Please let me know if this works, while w e continue to look thru the logs to see if there's any other clues.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: lyndonje
Date Posted: 02 November 2009 at 9:15am
Unfortunately this makes no difference as I had already closed port 25 on the firewall. Also changed the listening port to 26 to be sure, but no difference.

Posted By: LogSat
Date Posted: 02 November 2009 at 4:21pm
For the record, the issue was as follows:

============
I just noticed this in the logs:

11/02/09 11:59:38:191 -- Could not initialize Norman A/V engine - error $00010015
11/02/09 11:59:38:191 -- DoNotStartWithoutAV is true - shutting down SpamFilter...

There is an error initializing the AntiVirus engine, and apparently you had configured the "DoNotStartWithoutAV" option in the SpamFilter.ini file to not start SpamFilter if there's any problems with the antivirus. Can you try changing back that value back to 0 to see if that was the issue?

============


To then address the antivirus errors, the suggested procedure was:
============

If the antivirus tab says "No Antivirus support files found on server" that usually does indicate that one or more antivirus-related files are missing.

Can you please try to:
  • Stop SpamFilter
  • Run Regedit on the server, and locate and delete the key: 
    HKEY_LOCAL_MACHINE\SOFTWARE\Norman Data Defense Systems
  • Delete the "C:\Program Files\SpamFilter\nse" and "C:\Program Files\SpamFilter\Nvc" directories
  • Reinstall the antivirus plugin
  • Restart SpamFilter



-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: lyndonje
Date Posted: 03 November 2009 at 3:58am
Roberto, yesterday as I went back to the server to do this, the lower right part of the screen had populated with virus definitions information which was previously blank.

I set DoNotStartWithoutAV back to 1, and restarted the SF Service, and the service stayed online. Checking the AV tab now it says AV is found.

So it would seem as though despite not previously finding the AV plugin, after been left on 'Updating...' it seems to have re-installed itself?

Posted By: LogSat
Date Posted: 03 November 2009 at 5:06pm
That actually is possible. SpamFilter attempts to download the antivirus definition files every hour. If the corruption/missing files was related to one of these files that are downloaded during the updates, this issue could have indeed self-healed on a subsequent download.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window