Regarding Spam Filter 2.6.3.487
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5420
Printed Date: 05 February 2025 at 5:01pm
Topic: Regarding Spam Filter 2.6.3.487
Posted By: scharette
Subject: Regarding Spam Filter 2.6.3.487
Date Posted: 20 December 2005 at 10:01am
|
Hi I am really close to purchasing your software at this time. My only hesitation is that in this particular build I am seeing emails being sent multiple times (on approx a 20 min cycle). The emails are identical and the headers are all in order pointing at our spam server as being the issue. Is this a known problem? Would it be fixed if I bought the newest version? The program has definately impressed me quite a bit as I used it briefly a year ago, however didnt find it to be advantagous at that time. However, your new version definately does circles around the old. Your help is very much appreciated. Thanks Sara Sling Shot |
Replies:
Posted By: Desperado
Date Posted: 20 December 2005 at 10:13am
|
Hmmm. I, too, experienced this issue (if it is the same) and worke with LogSat support on it. Unfortunately, I seemed to be the only other customer with this issue. I am now running REGISTERED version v2.7.1.511 and the issue seems to be resolved. I believe LogSat support can shed some light on this issue. ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
Posted By: LogSat
Date Posted: 20 December 2005 at 10:25am
|
Sara, If you can provide us with additional information we'll try to see if the issue you're having is caused by SpamFilter and if so, to find out what the problem is. We'll need: Your SpamFilter.ini file SpamFilter's activity logfile for a day this occurred The TO and FROM email addresses for a user where duplicate emails occurred so we can locate the emails in the log If available, the email headers for some of the duplicate emails for the above users Please zip these to us at: support at logsat.com Dan, as a side note, where you seing the problem with the earlier version occurring at regular intervals (as Sara mentioned), or where they random? ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: Desperado
Date Posted: 20 December 2005 at 11:39am
|
Roberto, It *seemed* to go along with my queue flush time but I will need to verify that. ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
Posted By: scharette
Date Posted: 20 December 2005 at 1:44pm
|
Hi I have emailed a log as well as my ini file......unfortuantely I have deleted the duplicate emails at this time so I dont have the headers. I can try to remote into a customers computer this evening and see if I can retrieve them from the deleted folder....... I am kinda under the impression it might have to do with my flush queue as well.....though I am not certain of this.... I am going to go ahead and purchase the most recent software at this time. Thanks for your quick responses....... Thank you Desperado for bringing your two cents to the table....glad to hear that I am not the only person that is experiencing it.....also glad to hear that it isn't an issue with the newest release! Thanks Sara |
Posted By: Desperado
Date Posted: 21 December 2005 at 8:47am
|
Sara, I believe that not only will you be pleased with the product but also with all the support you get. I have rarely, if ever, received as much personal attention for the support of any product and find that LogSat (Roberto) is very open to changes and never "passes the buck". If there is a problem with the product, he has never failed to find and fix it. ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
Posted By: agavv
Date Posted: 21 December 2005 at 11:43am
|
Sara, We served more than 2400000 inbound connections till now and never had any duplicates! Version .511 is a dream: we changed last week from 487 and changed the settings for the blacklist cache in 3 - 15 - 90 to catch the spamload in this part of the world. This version results also in a lower load on our DNS-servers by not checking for reverse-dns. We almost never asked for anything because all is in the manual and if not it is findable in the forum. We are running about 1000 domains through SF !!! Very good software and support. AGAVV
|
Posted By: Guests
Date Posted: 21 December 2005 at 2:01pm
|
SpamFilter is excellent! The new .511 really is nice with the IP Blacklist cache. |
Posted By: LogSat
Date Posted: 21 December 2005 at 4:47pm
Thanks everyone for the support!  Dan, in Sara's case we were actually seing the remote server making multiple connections each single time and re-sending the same email content. It was not a loop however, as one of the X- email headers was slightly different every time, so the server was actually re-sending it multiple times. We've asked Sara for some Debug logs from SpamFilter so we can see the SMTP traffic and ensure that it's not SpamFilter sending some "weird" response that's causing this. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: Desperado
Date Posted: 21 December 2005 at 7:06pm
|
Roberto, Please let me know what you find. I still do not understand some ot the "events" we had. I believe you have may log. ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
Posted By: Guests
Date Posted: 23 December 2005 at 9:25am
|
Not sure that you received this email as I
have not received a response. This issue is still happening for
me in the new build. The logs below are from the newest
version. It is more than one email that is subject to constant
redelivery. I would really like to get down to the bottom of this
if possible. I did end up blocking the address in question until
resolution is found. Once I blocked the domain it did finally
send the last command to end the connection. I did lose this log,
though I will try to do it with another email/IP in question. Below email was sent 12/21/05: Hi Roberto, I have upgraded to the newest release and still having the same issues, so you help is very much appreciated. I have done the debug you have requested and here is the logs: >>HELO mail.homebistro.qm4.net MAIL mailto:FROM:%3Creturn_0_1985632_103127@homebistro.qm4.net - - TO:<WJMEAD@MEADCOMPANY.COM> DATA DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; d=qm4.net; s=2005_1; >> >>HELO mail.homebistro.qm4.net MAIL mailto:FROM:%3Creturn_0_1985632_103127@homebistro.qm4.net - - TO:<WJMEAD@MEADCOMPANY.COM> DATA DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; d=qm4.net; s=2005_1; >> >>g= HELO mail.homebistro.qm4.net MAIL mailto:FROM:%3Creturn_0_1985632_103127@homebistro.qm4.net - - TO:<WJMEAD@MEADCOMPANY.COM> DATA DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; d=qm4.net; s=2005_1; >> >>g= >>HELO mail.homebistro.qm4.net MAIL mailto:FROM:%3Creturn_0_1985632_103127@homebistro.qm4.net - - TO:<WJMEAD@MEADCOMPANY.COM> DATA DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; d=qm4.net; s=2005_1; >> >>g= HELO mail.homebistro.qm4.net MAIL mailto:FROM:%3Creturn_0_1985632_103127@homebistro.qm4.net - - TO:<WJMEAD@MEADCOMPANY.COM> DATA DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; d=qm4.net; s=2005_1; >> >>g= >>HELO mail.homebistro.qm4.net MAIL mailto:FROM:%3Creturn_0_1985632_103127@homebistro.qm4.net - - TO:<WJMEAD@MEADCOMPANY.COM> DATA DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; d=qm4.net; s=2005_1; >> >>g= <<250 Ok Please let me know what you think as soon as possible. Thanks Sara Sling Shot |
Posted By: LogSat
Date Posted: 23 December 2005 at 10:09am
|
Actually we didn't.. it was stopped by SpamFilter, fault of one of our keywords (which we just removed!). I've responded to you by email just minutes ago.
------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: scharette
Date Posted: 23 December 2005 at 10:33am
|
Hi Roberto, Thank you for your quick response....I have an email going to you shortly. Sorry about my last post as I read through it, it is very short and to the point (could be seen as rude). Please know this wasnt intentional nor directed toward you, I know you are very responsive, and knew there had to be an issue with the email getting to you, just was in a hurry to get that posted and handle a few other things ..... Your assistance is very much appreciated! |
Posted By: LogSat
Date Posted: 23 December 2005 at 10:38am
|
Sara, I hope you're joking about the posting being rude! If we loook at all my "short" posts then I should be banned from our own forum :-) We'll wait for the email then, and hope we'll be able to provide an answer. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: scharette
Date Posted: 06 January 2006 at 10:02am
|
Well Roberto, These last few weeks have been more than hectic in my office, due to the holidays and people being on vacation. So I haven't had as much time as I like to put towards the spam software....but for whatever reason it is indeed still happening. Unforutantely I have had very little luck using the debug feature as the emails duplicate themselves within a small period of time so by the time I find out about them, the duplicates have stopped. I again, got duplicates of the BMG newsletter this month (which is the same one that duplicated for me last month).....and I see that the wjmead address I gave you is still getting multiple duplicate newsletters. Here is a couple headers from the BMG one that just duplicated for me this morning and last night.... Date: Thu, 05 Jan 2006 20:05:55 -0500 From: "BMG Music Service" mailto:bmgmusic@bmgmusicservice.com - mailto:bmg.1996107@bmgmusic.ed10.net - - scharette@sst-ltd.net Received: from spam02 [192.168.50.39] by mail.inct.net with ESMTP (SMTPD32-8.00) id A55182005FC; Fri, 06 Jan 2006 08:49:05 -0500 Received: from 216.74.160.10 by my_mailserver.mydomain.com (LogSat Software SMTP Server) Fri, 6 Jan 2006 08:32:38 -0500 Received: from ([127.0.0.1:51490]) by bm1-1.ed10.com (ecelerity 1.2.12.3 r(6451)) with ECSTREAM id 2B/21-01811-372CDB34 for mailto:scharette@sst-ltd.net%3E - - <3762-64093-FBJOY-LQF5NB-89VSZB-H@e-dialog.com> X-Mail-From: mailto:FBJOY-LQF5NB-89VSZB-H@bmg.bounce.ed10.net - - scharette@sst-ltd.net X-Mailer: EDMAIL R6.00.02 X-Server: LogSat Software SMTP Server X-SF-RX-Return-Path: mailto:FBJOY-LQF5NB-89VSZB-H@bmg.bounce.ed10.net - mailto:bmgmusic@bmgmusicservice.com - mailto:bmg.1996107@bmgmusic.ed10.net - - scharette@sst-ltd.net Received: from spam02 [192.168.50.39] by mail.inct.net with ESMTP (SMTPD32-8.00) id A0093DF005E4; Fri, 06 Jan 2006 07:18:17 -0500 Received: from 216.74.160.10 by my_mailserver.mydomain.com (LogSat Software SMTP Server) Fri, 6 Jan 2006 07:01:52 -0500 Received: from ([127.0.0.1:51490]) by bm1-1.ed10.com (ecelerity 1.2.12.3 r(6451)) with ECSTREAM id 2B/21-01811-372CDB34 for mailto:scharette@sst-ltd.net%3E - - <3762-64093-FBJOY-LQF5NB-89VSZB-H@e-dialog.com> X-Mail-From: mailto:FBJOY-LQF5NB-89VSZB-H@bmg.bounce.ed10.net - - scharette@sst-ltd.net X-Mailer: EDMAIL R6.00.02 X-Server: LogSat Software SMTP Server X-SF-RX-Return-Path: mailto:FBJOY-LQF5NB-89VSZB-H@bmg.bounce.ed10.net - mailto:bmgmusic@bmgmusicservice.com - mailto:bmg.1996107@bmgmusic.ed10.net - - scharette@sst-ltd.net Received: from spam02 [192.168.50.39] by mail.inct.net with ESMTP (SMTPD32-8.00) id AAC386CD05C2; Fri, 06 Jan 2006 05:47:31 -0500 Received: from 216.74.160.10 by my_mailserver.mydomain.com (LogSat Software SMTP Server) Fri, 6 Jan 2006 05:31:07 -0500 Received: from ([127.0.0.1:51490]) by bm1-1.ed10.com (ecelerity 1.2.12.3 r(6451)) with ECSTREAM id 2B/21-01811-372CDB34 for mailto:scharette@sst-ltd.net%3E - - <3762-64093-FBJOY-LQF5NB-89VSZB-H@e-dialog.com> X-Mail-From: mailto:FBJOY-LQF5NB-89VSZB-H@bmg.bounce.ed10.net - - scharette@sst-ltd.net X-Mailer: EDMAIL R6.00.02 X-Server: LogSat Software SMTP Server X-SF-RX-Return-Path: mailto:FBJOY-LQF5NB-89VSZB-H@bmg.bounce.ed10.net - |
Posted By: scharette
Date Posted: 06 January 2006 at 10:26am
|
Just as I finished up the last post....I was able to pull one debug log on a particular email that is duplicating itself...... >>EHLO jasper-cc.upromise.com <<250-8BITMIME <<250 HELP >>EHLO jasper-cc.upromise.com <<250-8BITMIME <<250 HELP >>MAIL FROM:<mailer-vd02@vd02.upromise.com> <<250 Address Okay >>RCPT TO:<hillcrest@mail.inct.net> >>MAIL FROM:<mailer-vd02@vd02.upromise.com> <<250 Address Okay >>RCPT TO:<daustrom@tpaconsulting.com> <<250 hillcrest@mail.inct.net Address Okay >>DATA <<354 Start mail input; end with <CRLF>.<CRLF> <<250 daustrom@tpaconsulting.com Address Okay >>Received: from bomber-cc (bomber-app.prod.upromise.com [172.24.36.140]) >>n. Save 1% for college >>ers in-stores, online, or by phone. >>57698096 >>DATA <<354 Start mail input; end with <CRLF>.<CRLF> >>alt="" border="0"></td> >>s/mc/spacer.gif' width='1' height='2' alt='' border='0'></td> >>eight='4' ></td> >>Received: from bomber-cc (bomber-app.prod.upromise.com [172.24.36.140]) >>ise.com/browse.php?olmcat=home_kitchen&ax=ase_ 20051228_03_20224 >> >>-800-462-3966). <table cellpadding="0" cellspacing="0" border="0"><tr><td><font face="verdana, sans-serif" size="2" color="#333333"><a href="http://www.upromise.com/8364 .do?ax=ase_20051228_03_10109">Learn more</a> </td> >>border="0"><tr><td><font face="verdana, sans-serif" size="2" color="#333333"><a href="http://www.upromise.com/8365 .do?ax=ase_20051228_03_10119">Learn more</a> </td> >>://www.upromise.com/survey-mm/2503995520/ase01_200 51228">Take this short survey</a> </font></td><td va lign="bottom"><a href="http://www.upromise.com/survey -mm/2503995520/ase0120051228"><img src='http://im.upr omise.com/images/mc/buttons/arrow_yellow.gif' width='20' height='11' alt='' border='0' vspace='1'></a></td></tr>&l t;/table></td></tr> >> cellpadding='0' cellspacing='0' border='0'><tr><td> >>order='0'></td> >><td width='1' bgcolor='#dddddd'><img src='http://im.upromise.com/im ages/mc/spacer.gif' width='1' height='4' ></td> >>ing free shipping... all in one place? <a href="http://shop.upromise.com/browse.php?olmcat=Free %20Shipping&ax=ase_20051228_03_20204">Click here now</a>.</td> >>href="http://shop.upromise.com/browse.php?olmcat=t ravel&ax=ase_20051228_03_20069">upromise.com</a> ;.</td> >>f" size="2" color="#666666"><li>Buying or selling your home? <<250 Ok <<250 Ok What is really odd, is that the emails that are duplicating themselves all have one thing in common and that is that they all end in the <<250 Ok <<250 Ok Even though I can confirm the email has been delivered to the recipient. Instead of the standard <<250 Ok >>QUIT <<221 Signing Off response which is given if the email is properly deliverd and not duplicated. Header for the particular Debug log above. Header Information [ javascript headerDisplay0; - HIDE ] Received: from spam02 [192.168.50.39] by mail.inct.net with ESMTP (SMTPD32-8.00) id A4B853505FA; Fri, 06 Jan 2006 09:54:48 -0500 Received: from 12.130.29.196 by my_mailserver.mydomain.com (LogSat Software SMTP Server) Fri, 6 Jan 2006 09:53:07 -0500 Received: from bomber-cc (bomber-app.prod.upromise.com [172.24.36.140]) by jasper-cc.upromise.com (Postfix) with ESMTP id CFC63A16C for http://mail.inct.net:8383/X8c689e93cf99989ace9fb27a700d/newmsg.cgi?mbx=Main&to=daustrom@tpaconsulting.com - <daustrom@tpaconsulting.com> ; Sun, 1 Jan 2006 23:23:22 -0500 (EST) Message-ID: http://mail.inct.net:8383/X8c689e93cf99989ace9fb27a700d/newmsg.cgi?mbx=Main&to=1.1ppbrt.8toe.rx.0.77fexo.2dyiq@dialog - <1.1ppbrt.8toe.rx.0.77fexo.2dyiq@dialog> Date: Sun, 1 Jan 2006 23:21:09 -0500 (EST) From: Upromise http://mail.inct.net:8383/X8c689e93cf99989ace9fb27a700d/newmsg.cgi?mbx=Main&to=accountsummary@upromise.com - <accountsummary@upromise.com> Reply-To: accountsummary@upromise.com To: http://mail.inct.net:8383/X8c689e93cf99989ace9fb27a700d/newmsg.cgi?mbx=Main&to=daustrom@tpaconsulting.com - <daustrom@tpaconsulting.com> Subject: Douglas, Your Monthly Upromise Account Summary as of 12/24/2005 Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_587594_719563.1136175802828" X-Server: LogSat Software SMTP Server X-SF-RX-Return-Path: http://mail.inct.net:8383/X8c689e93cf99989ace9fb27a700d/newmsg.cgi?mbx=Main&to=mailer-vd02@vd02.upromise.com - <mailer-vd02@vd02.upromise.com> X-SF-HELO-Domain: jasper-cc.upromise.com X-RCPT-TO: http://mail.inct.net:8383/X8c689e93cf99989ace9fb27a700d/newmsg.cgi?mbx=Main&to=daustrom@tpaconsulting.com - <daustrom@tpaconsulting.com> Status: R X-UIDL: 426987481 Header from a previous instance of this email. Header Information [ javascript headerDisplay0; - HIDE ] Received: from spam02 [192.168.50.39] by mail.inct.net with ESMTP (SMTPD32-8.00) id A12651F05FC; Fri, 06 Jan 2006 08:31:18 -0500 Received: from 12.130.29.196 by my_mailserver.mydomain.com (LogSat Software SMTP Server) Fri, 6 Jan 2006 08:29:42 -0500 Received: from bomber-cc (bomber-app.prod.upromise.com [172.24.36.140]) by jasper-cc.upromise.com (Postfix) with ESMTP id CFC63A16C for http://mail.inct.net:8383/Xb0509e93cf9fc9cb9fcbb27a700d/newmsg.cgi?mbx=Main&to=daustrom@tpaconsulting.com - <daustrom@tpaconsulting.com> ; Sun, 1 Jan 2006 23:23:22 -0500 (EST) Message-ID: http://mail.inct.net:8383/Xb0509e93cf9fc9cb9fcbb27a700d/newmsg.cgi?mbx=Main&to=1.1ppbrt.8toe.rx.0.77fexo.2dyiq@dialog - <1.1ppbrt.8toe.rx.0.77fexo.2dyiq@dialog> Date: Sun, 1 Jan 2006 23:21:09 -0500 (EST) From: Upromise http://mail.inct.net:8383/Xb0509e93cf9fc9cb9fcbb27a700d/newmsg.cgi?mbx=Main&to=accountsummary@upromise.com - <accountsummary@upromise.com> Reply-To: accountsummary@upromise.com To: http://mail.inct.net:8383/Xb0509e93cf9fc9cb9fcbb27a700d/newmsg.cgi?mbx=Main&to=daustrom@tpaconsulting.com - <daustrom@tpaconsulting.com> Subject: Douglas, Your Monthly Upromise Account Summary as of 12/24/2005 Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_587594_719563.1136175802828" X-Server: LogSat Software SMTP Server X-SF-RX-Return-Path: http://mail.inct.net:8383/Xb0509e93cf9fc9cb9fcbb27a700d/newmsg.cgi?mbx=Main&to=mailer-vd02@vd02.upromise.com - <mailer-vd02@vd02.upromise.com> X-SF-HELO-Domain: jasper-cc.upromise.com X-RCPT-TO: http://mail.inct.net:8383/Xb0509e93cf9fc9cb9fcbb27a700d/newmsg.cgi?mbx=Main&to=daustrom@tpaconsulting.com - <daustrom@tpaconsulting.com> Status: R X-UIDL: 426987475 Hopefully this helps...... Thanks Sara |
Posted By: Desperado
Date Posted: 06 January 2006 at 11:19am
|
Roberto, I too am getting 3 or 4 reports of duplicated messages in the last 2 days. Dan ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
Posted By: scharette
Date Posted: 06 January 2006 at 1:45pm
|
Hi This is just another instance of that same email. Please let me know if I should be providing you headers for each Debug log. This email has been sent to two of our users more than 20 times today. The problem seems to be getting worse......though it is really hard to tell.... >>EHLO jasper-cc.upromise.com <<250-8BITMIME <<250 HELP >>EHLO jasper-cc.upromise.com <<250-8BITMIME <<250 HELP >>MAIL FROM:<mailer-vd02@vd02.upromise.com> <<250 Address Okay >>RCPT TO:<hillcrest@mail.inct.net> >>MAIL FROM:<mailer-vd02@vd02.upromise.com> <<250 Address Okay >>RCPT TO:<daustrom@tpaconsulting.com> <<250 hillcrest@mail.inct.net Address Okay >>DATA <<354 Start mail input; end with <CRLF>.<CRLF> <<250 daustrom@tpaconsulting.com Address Okay >>Received: from bomber-cc (bomber-app.prod.upromise.com [172.24.36.140]) >>n. Save 1% for college >>ers in-stores, online, or by phone. >>57698096 >>DATA <<354 Start mail input; end with <CRLF>.<CRLF> >>alt="" border="0"></td> >>s/mc/spacer.gif' width='1' height='2' alt='' border='0'></td> >>eight='4' ></td> >>Received: from bomber-cc (bomber-app.prod.upromise.com [172.24.36.140]) >>ise.com/browse.php?olmcat=home_kitchen&ax=ase_ 20051228_03_20224 >> - Have a new credit card? >> >>-800-462-3966). <table cellpadding="0" cellspacing="0" border="0"><tr><td><font face="verdana, sans-serif" size="2" color="#333333"><a href="http://www.upromise.com/8364 .do?ax=ase_20051228_03_10109">Learn more</a> </td> >>border="0"><tr><td><font face="verdana, sans-serif" size="2" color="#333333"><a href="http://www.upromise.com/8365 .do?ax=ase_20051228_03_10119">Learn more</a> </td> >>://www.upromise.com/survey-mm/2503995520/ase01_200 51228">Take this short survey</a> </font></td><td va lign="bottom"><a href="http://www.upromise.com/survey -mm/2503995520/ase0120051228"><img src='http://im.upr omise.com/images/mc/buttons/arrow_yellow.gif' width='20' height='11' alt='' border='0' vspace='1'></a></td></tr>&l t;/table></td></tr> >> cellpadding='0' cellspacing='0' border='0'><tr><td> >>order='0'></td> >>ing free shipping... all in one place? <a href="http://shop.upromise.com/browse.php?olmcat=Free %20Shipping&ax=ase_20051228_03_20204">Click here now</a>.</td> >>'#F3F3DE'><td colspan=5><img src='http://im.upromise.com/images/mc/ spacer.gif' width='10' height='10'></td></tr></tr> >></td></tr></table></td> >>80/ct?g=1.1ppbrt.8toe.rx.0.77fexo.2dyiq&i=2188 97&a=%26ux%3ddaustrom&h=1">upromise.com</a> to learn more.<br><br> <<250 Ok <<250 Ok Thanks Sara |
Posted By: LogSat
Date Posted: 06 January 2006 at 4:05pm
|
Dan, Sara's duplicates were different than yours in the past. If you (Dan) can send me the logs showing the duplicates, along with the to/from emails I'll be able to see if the issues are related or not. Sara, Unfortunately the only list I was able to susbscribe to last time still has not sent me emails, so that is a dead end so far. The missing >>QUIT <<221 Signing Off should not be an issue, but in this case I'm not going to discard anything, and will look into it. One possibilty could in theory be that the sender never sees the "250 OK" so thinks that the email was not successful. If you can please zip and email us your SpamFilter logs from today so we can correlate your posting entries with them, that will help. We may need to prepare a special debug build for you, but we need first to understand "where" to put extra debug code. Please allow us 12/24 hours once we have your logs to try to come up with a way to better see what is causing this. Are you familiar with either Windows' Network Monitor utility, or with Etherreal? They both perform packet sniffing on a server, and the raw TCP data may help to shed some light onto this. If you're familiar with them please let us know so we can ask you to run them on the server. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: Desperado
Date Posted: 06 January 2006 at 4:37pm
|
Roberto, I sent my info by email. ------------- The Desperado Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
Posted By: LogSat
Date Posted: 08 January 2006 at 7:00pm
|
Sara,
One of SpamFilter's many filters is the SURBL check. This filter looks at every single URL inside a message, and checks each one against DNS blacklists to see if domain name has been used to spam before. If so, the email is blocked. This filter is very, very efficient and powerful. The email you forwarded
us from Sony BMG contains 321 URLs in it. This causes SpamFilter to perform 321
DNS lookups. Normally this should take about 10 seconds (we tested it on our
servers just now), so it is not a problem. However, should your DNS server
experience problems, or timeouts, SpamFilter has a DNS lookup timeout of 15
seconds. After 15 seconds, if a response from ther DNS server is not received,
SpamFilter will ignore the lookup and continue with the next one. Unfortunately,
in the BMG email, should the DNS server be unavailable, it will mean that
SpamFilter will timeout once per URL, so in this case 321 x 15 seconds = 4815
seconds. This means that it could take up to 80 minutes for SpamFilter to "test"
all 321 URLs should the DNS server have issues. This very well explains the
20-30 minutes we've observed in your logs that it has taken to process these
emails. The remote server, seing this long delay, is most likely interpreting it as a failure in sending its email, and will thus try again multiple times. Now with hindsight, going back thru your logs we also do see several DNS
timeouts, indicating problems.
While it's easy to blame
a DNS server for the problems, hopefully you'll have noticed that this is not
how to operate... Please allow us a few more hours to come up with a solution,
so that even with DNS problems the tests won't take that long. We'll also try to
improve the SURBL DNS checks by avoiding duplicate lookups. We'll be testing the
new build as fast as possible, and then will provide you with a "beta" build for
you to test as well. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: mikek
Date Posted: 09 January 2006 at 2:44am
321 URLs with different domains? I shouldn't think so. I guess a solution would be to filter out duplicates before checking them against SURBL, or set up a cache of SURBL lookups (for 10 minutes or so).
Just my 2 cents.
Cheers!
|
LogSat wrote:Posted By: LogSat
Date Posted: 09 January 2006 at 7:18am
|
Yeap, we agree, thus to address the problem we release yesterday build 516 as follows : // New to VersionNumber = '2.7.1.516'; {TODO -cFix : SURBL filter could take several minutes to be process emails with hundreds of URLs if DNS server is down, possibly causing re-sends of the email. Improved lookups by removing duplicate TLDs and added global timeout to avoid problem} {TODO -cFix : SpamFilter version number and blacklist/whitelist loading indicators are missing in logs when SpamFilter service is started} {TODO -cNew : Added "Notice - IdleDisconnectMinutesTimeout reached. Removing threadID" log entry when disconnecting idle threads} ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |