Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - SFI stopped responding AGAIN
  FAQ FAQ  Forum Search   Register Register  Login Login

SFI stopped responding AGAIN

 Post Reply Post Reply
Author
Stupid View Drop Down
Senior Member
Senior Member


Joined: 28 November 2005
Status: Offline
Points: 127
Post Options Post Options   Thanks (0) Thanks(0)   Quote Stupid Quote  Post ReplyReply Direct Link To This Post Topic: SFI stopped responding AGAIN
    Posted: 18 February 2008 at 10:31am
I have been running 4.0.0.700 for almost a month without any problem. With past versions, I did some a similar problem.

Reberto, would you see if you can help?

Here's the last bit of log when it stopped:

2/15/08 16:43:44:326 -- (26864) GreyList limbo - Added 86.2.250.207
02/15/08 16:43:44:326 -- (26864) IP is in not in GreyList Allowed. Disconnecting: 86.2.250.207
02/15/08 16:43:44:389 -- (26864) No Data Received
02/15/08 16:43:44:389 -- (26864) Disconnect
02/15/08 16:43:47:529 -- (25744) Connection from: 71.253.127.56  -  Originating country : United States
02/15/08 16:43:47:529 -- (25744) GreyList limbo - Added 71.253.127.56
02/15/08 16:43:47:529 -- (25744) IP is in not in GreyList Allowed. Disconnecting: 71.253.127.56
02/15/08 16:43:47:592 -- (25744) No Data Received
02/15/08 16:43:47:592 -- (25744) Disconnect
02/15/08 16:43:48:436 -- (28128) Connection from: 207.115.20.71  -  Originating country : United States
02/15/08 16:43:48:436 -- (28128) GreyList cache - 207.115.20.71 removed from limbo, will add to allowed list
02/15/08 16:43:48:436 -- (28128) IP Greylist - Added 207.115.20.71 to list
02/15/08 16:43:48:654 -- (28128) Received MAIL FROM: <norma@n2itcontainers.com> SIZE=104051
02/15/08 16:43:48:717 -- (28128) Received RCPT TO: Kim.Mitchell@mycompany.com
02/15/08 16:43:48:873 -- (28128) Resolving 207.115.20.71 - flpi102.sbcis.sbc.com
02/15/08 16:43:49:295 -- (28128) - SPF analysis for n2itcontainers.com done: - none
02/15/08 16:43:49:295 -- (28128) Mail from: norma@n2itcontainers.com
02/15/08 16:43:55:139 -- (28128) DNS Error:TimedOut
02/15/08 16:44:00:139 -- (28128) DNS Error:TimedOut
02/15/08 16:44:01:076 -- (26928) Running TTerminateIdleThreads - SFTC=1 - SFFC=1
02/15/08 16:44:01:076 -- (26928) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=1
02/15/08 16:44:01:076 -- (25424) Blacklist cache - starting cleanup
02/15/08 16:44:01:076 -- (25424) Blacklist cache - removed IP 77.253.142.129 from limbo during cleanup
02/15/08 16:44:01:092 -- (25424) Blacklist cache - removed IP 207.126.99.112 from limbo during cleanup
02/15/08 16:44:01:123 -- (25424) GreyList limbo cache - removed 9 entries during cleanup
02/15/08 16:44:01:701 -- (28128) - MAPS search done...
02/15/08 16:44:01:701 -- (28128) RCPT TO: Kim.Mitchell@mycompany.com accepted
02/15/08 16:44:02:342 -- (28128) Checking SFDC
02/15/08 16:44:02:529 -- (28128) Hash cache - Added OK
02/15/08 16:44:02:529 -- (28128) Scanning PDF for spam:70385.pdf
02/15/08 16:44:02:654 -- (28128) Warning: error (1) scanning PDF for spam - Unexpected PDF object encountered
02/15/08 16:44:02:654 -- (28128) Warning: error scanning image for spam - Access violation at address 004047A4 in module 'SpamFilterSvc.exe'. Read of address 00000112

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 18 February 2008 at 7:43pm
From the log entries, the problem appears to be caused by the PDF image scanning filter. Unfortunately we are aware of the presence of a memory leak in the PDF library we use to scan PDF files for spam. We have been in contact (for quite a long time - several months...) with the vendor that provides the PDF library to work on a solution, but we are currently still waiting for the fix. Due to this problem, we have been actually shipping SpamFilter with the PDF-scanning filter in the disabled state by default, as this was a known issue. If you upgraded SpamFilter to the version supporting the PDF filter several months ago, before the issue was discovered, this may explain why your filter was "on".

If the problem is causing issues (as it's likely in your case), you can disable PDF scanning by setting the following option in the SpamFilter.ini file to 0:

SpamPDFMaxPagesToScan=0

While this may have allowed a few more spam emails to make it thru with the older SpamFilter 3.5, the new SpamFilter 4.0 and the new greylisting filter changed the playing field. This filter has proven to be so effective that you may safely disable the PDF filter, as the amount of emails that could slip by will be very, very small.

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.189 seconds.