Print Page | Close Window

SpamFilter CRASH

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7106
Printed Date: 26 December 2024 at 7:33am


Topic: SpamFilter CRASH
Posted By: PAP400
Subject: SpamFilter CRASH
Date Posted: 22 December 2014 at 1:39pm
Hallo,

I have a brand new Spam Filter for ISP 4.6.0.113 on a Windows 2012R2 STD.
It's been working for 3 days, then it started to crash continuously every 10 minutes and 5/6 seconds with the following windows logs:

SYSTEM
The SpamFilter service terminated unexpectedly.  It has done this xx time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service

APPLICATION
Faulting application name: SpamFilterSvc.exe, version: 4.6.0.113, time stamp: 0x539afcf6
Faulting module name: ntdll.dll, version: 6.3.9600.17278, time stamp: 0x53eebd22
Exception code: 0xc0000005
Fault offset: 0x0000000000093592
Faulting process id: 0x2698
Faulting application start time: 0x01d01e0ff4ad68b8
Faulting application path: C:\Program Files\SpamFilter\SpamFilterSvc.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 76ab46e5-8a04-11e4-80c9-40f2e9f70681
Faulting package full name:
Faulting package-relative application ID:

Because of the "access violation" I've tried to:
- Inhibit Antivirus to check SpamFilterSvc.exe activity (latest SEP 12.1.5)
- Inhibit Antivirus to check SpamFilter application folder, subfolders and files
- Inhibit Antivirus to check quarantine SQL Server files and folders
- Deactivate real-time antivirus check at all (!)
- Launche SpamFilter as an application (Spamfilter.exe)
- Activate UI0Detect changing the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows\NoInteractiveServices key

Nothing changed
No special log before crash

The only other service installed is an IBM Domino 9.01 with some related add-in task.

I have no idea on what happens every 10 minutes (and 5~6 seconds): do you have some?

Thank you

Paolo Pallara


Replies:
Posted By: LogSat
Date Posted: 22 December 2014 at 3:44pm
Paolo,

Can you please zip us the following so we can take a look:

• SpamFilter's activity logfile for today

• Your SpamFilter.ini file

• The \SpamFilter\Domains directory structure (if the files containing any of your blacklists/whitelists are outside that directory tree, please include those as well.


If the zipped file is over 8MB in size, I'll send you via a PM the credentials to upload the files to our website.



-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: LogSat
Date Posted: 23 December 2014 at 7:10pm
We received the files, thank you. 

There seems to be an access violation (0xc0000005) within the C:\Windows\SYSTEM32\ntdll.dll, that is then in turn causing SpamFilter to crash. Do you have access to a different version of the NTDLL.dll file that you can try using?

Alternatively, you could try running the 32bit version of SpamFilter instead of the 64bit version one. You can download the x86 version of the binaries from our website after logging in. Please note that you will need to replace the both the SpamFilter.exe and the SpamFilterSvc.exe, along with the two DLL files libeay32.dll and ssleay32.dll from the .zip file containing the 32bit (x86) version of SpamFilter. Lastly, depending on how you constructed the connection string to the database, you may need to use the 32-bit ODBC administrator to create a DSN if you used one.

As a side note, while I do not believe this is the cause of the problems, fFrom SpamFilter's logfile we see that SpamFilter is sometimes started as a service (the executable in Task Manager is SpamFilterSvc.exe), and sometimes instead the standalone version of SpamFilter (SpamFilter.exe) is instead launched:

12/22/14 15:28:50:224 -- SpamFilter ISP v4.6.0.113 Listening on all IPs port 25 (64bit standalone mode)
12/22/14 15:28:57:849 -- SpamFilter ISP v4.6.0.113 Listening on all IPs port 25 (64bit service mode)


In addition, there are some instances where one version of SpamFilter is launched (for example the standalone version) while the other one (for ex the windows service) is already running:
12/22/14 17:07:00:501 -- SpamFilter ISP v4.6.0.113 Listening on all IPs port 25 (64bit service mode)
12/22/14 17:07:09:122 -- SpamFilter ISP v4.6.0.113 Listening on all IPs port 25 (64bit standalone mode)
12/22/14 17:07:13:044 -- Exception occurred during PerformPostStartupTasks: Could not bind socket. Address and port are already in use.

When this happens there is a conflict leading to undetermined issues, as both applications will be fighting for the same resources and trying to listen on the same port.




-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window