SFI stopped responding AGAIN
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6394
Printed Date: 15 January 2025 at 10:26am
Topic: SFI stopped responding AGAIN
Posted By: Stupid
Subject: SFI stopped responding AGAIN
Date Posted: 18 February 2008 at 10:31am
I have been running 4.0.0.700 for almost a month without any problem. With past versions, I did some a similar problem.
Reberto, would you see if you can help?
Here's the last bit of log when it stopped:
2/15/08 16:43:44:326 -- (26864) GreyList limbo - Added 86.2.250.207
02/15/08 16:43:44:326 -- (26864) IP is in not in GreyList Allowed. Disconnecting: 86.2.250.207
02/15/08 16:43:44:389 -- (26864) No Data Received
02/15/08 16:43:44:389 -- (26864) Disconnect
02/15/08 16:43:47:529 -- (25744) Connection from: 71.253.127.56 - Originating country : United States
02/15/08 16:43:47:529 -- (25744) GreyList limbo - Added 71.253.127.56
02/15/08 16:43:47:529 -- (25744) IP is in not in GreyList Allowed. Disconnecting: 71.253.127.56
02/15/08 16:43:47:592 -- (25744) No Data Received
02/15/08 16:43:47:592 -- (25744) Disconnect
02/15/08 16:43:48:436 -- (28128) Connection from: 207.115.20.71 - Originating country : United States
02/15/08 16:43:48:436 -- (28128) GreyList cache - 207.115.20.71 removed from limbo, will add to allowed list
02/15/08 16:43:48:436 -- (28128) IP Greylist - Added 207.115.20.71 to list
02/15/08 16:43:48:654 -- (28128) Received MAIL FROM: <norma@n2itcontainers.com> SIZE=104051
02/15/08 16:43:48:717 -- (28128) Received RCPT TO: Kim.Mitchell@mycompany.com
02/15/08 16:43:48:873 -- (28128) Resolving 207.115.20.71 - flpi102.sbcis.sbc.com
02/15/08 16:43:49:295 -- (28128) - SPF analysis for n2itcontainers.com done: - none
02/15/08 16:43:49:295 -- (28128) Mail from: norma@n2itcontainers.com
02/15/08 16:43:55:139 -- (28128) DNS Error:TimedOut
02/15/08 16:44:00:139 -- (28128) DNS Error:TimedOut
02/15/08 16:44:01:076 -- (26928) Running TTerminateIdleThreads - SFTC=1 - SFFC=1
02/15/08 16:44:01:076 -- (26928) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=1
02/15/08 16:44:01:076 -- (25424) Blacklist cache - starting cleanup
02/15/08 16:44:01:076 -- (25424) Blacklist cache - removed IP 77.253.142.129 from limbo during cleanup
02/15/08 16:44:01:092 -- (25424) Blacklist cache - removed IP 207.126.99.112 from limbo during cleanup
02/15/08 16:44:01:123 -- (25424) GreyList limbo cache - removed 9 entries during cleanup
02/15/08 16:44:01:701 -- (28128) - MAPS search done...
02/15/08 16:44:01:701 -- (28128) RCPT TO: Kim.Mitchell@mycompany.com accepted
02/15/08 16:44:02:342 -- (28128) Checking SFDC
02/15/08 16:44:02:529 -- (28128) Hash cache - Added OK
02/15/08 16:44:02:529 -- (28128) Scanning PDF for spam:70385.pdf
02/15/08 16:44:02:654 -- (28128) Warning: error (1) scanning PDF for spam - Unexpected PDF object encountered
02/15/08 16:44:02:654 -- (28128) Warning: error scanning image for spam - Access violation at address 004047A4 in module 'SpamFilterSvc.exe'. Read of address 00000112
|
Replies:
Posted By: LogSat
Date Posted: 18 February 2008 at 7:43pm
From the log entries, the problem appears to be caused by the PDF image scanning filter. Unfortunately we are aware of the presence of a memory leak in the PDF library we use to scan PDF files for spam. We have been in contact (for quite a long time - several months...) with the vendor that provides the PDF library to work on a solution, but we are currently still waiting for the fix. Due to this problem, we have been actually shipping SpamFilter with the PDF-scanning filter in the disabled state by default, as this was a known issue. If you upgraded SpamFilter to the version supporting the PDF filter several months ago, before the issue was discovered, this may explain why your filter was "on".
If the problem is causing issues (as it's likely in your case), you can disable PDF scanning by setting the following option in the SpamFilter.ini file to 0:
SpamPDFMaxPagesToScan=0
While this may have allowed a few more spam emails to make it thru with the older SpamFilter 3.5, the new SpamFilter 4.0 and the new greylisting filter changed the playing field. This filter has proven to be so effective that you may safely disable the PDF filter, as the amount of emails that could slip by will be very, very small.
-------------
Roberto Franceschetti
http://www.logsat.com" rel="nofollow - LogSat Software
http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP
|
|