Spam Filter ISP Support - Crashing Service

Crashing Service

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6586
Printed Date: 28 December 2024 at 7:04pm

Topic: Crashing Service

Posted By: Bart
Subject: Crashing Service
Date Posted: 29 November 2008 at 12:32pm

last 2 weeks mij SpamFilter has crashed a couple of times

i have no idea what's causing this problem.

11-29-08 07:02:23:755 -- Exception occurred during CheckDatabaseConnection: Access violation at address 00523A27 in module 'SpamFilterSvc.exe'. Read of address 00000008
11-29-08 07:02:23:755 -- Exception occurred during UpdateOtherSettings: Access violation at address 00601C70 in module 'SpamFilterSvc.exe'. Read of address 00000324
11-29-08 07:02:23:755 -- Reloading local black / white lists: SpamFilter.ini
11-29-08 07:02:23:848 -- (1701995880) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-29-08 07:02:23:848 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-29-08 07:02:23:848 -- (0) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-29-08 07:02:23:848 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-29-08 07:02:23:848 -- (1768842608) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-29-08 07:02:23:864 -- (0) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-29-08 07:02:23:864 -- (0) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-29-08 07:02:23:864 -- (1949324108) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-29-08 07:02:23:864 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-29-08 07:02:23:864 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-29-08 07:02:23:880 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-29-08 07:02:23:880 -- (1768842608) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-29-08 07:02:23:880 -- (1481924981) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified

do you have an idee ???

Replies:

Posted By: LogSat
Date Posted: 29 November 2008 at 3:36pm

Bart,

Could you please zip and email us the entire SpamFilter's activity logfiles for the 28th and 29th? The errors are rather unusual, and it's possible that there were other crash events prior to these than then subsequently caused the entries above. If the zip is over 5MB in file, please upload it to our FTP server - I'll send you a PM with the FTP login info.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Bart
Date Posted: 30 November 2008 at 5:58am

both files are on the ftp server

Posted By: LogSat
Date Posted: 30 November 2008 at 11:41am

Bart,

There's a mismatch in the logfile we received and the section you posted. On the log for the 29th we received, these are the 3 consecutive entries we have in the logs, showing **just one error** at 07:02:23:755:

11-29-08 07:02:23:270 -- (7464) IPcache Limbo - removed 1 entries during cleanup
11-29-08 07:02:23:755 -- (7968) Exception occurred during TTerminateIdleThreads.DoCleanupListView: Access violation at address 00654A04 in module 'SpamFilterSvc.exe'. Read of address 00000278
11-29-08 18:22:57:036 -- SpamFilter ISP v4.0.1.785 Listening on 192.168.171.1:25,

After the single exception at 7:02:23:755, we do not see any entries in the logs until SpamFilter is started at 18:22:57:036.

So we do not see a single one of the errors you reported in the post, while instead we have a different error in the log you uploaded at pretty much the same time.

Can you please let us know where you retrieved the above log entries in this post and, if you know, why they are not in the logs we received?

The error we have in the actual logfile (Exception occurred during TTerminateIdleThreads.DoCleanupListView) does actually look like it could be the culprit for the cascade of errors after, but we'd like to have more info as of the reason of the errors mismatch before proceeding.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Bart
Date Posted: 01 December 2008 at 4:35am

The error i posted in my first post i found in my system root c:\20081129.log

What i see now is that there was an error on 11-11, 20-11 and 29-11

Looks like it is crashing every 9 days.

I get a debugger question on the screen and when i cancel it i can restart the service and everything is working fine.

here are the other 2 logfiles i found on my C:\ drive

-------- 20081128.log --------------------------

11-20-08 01:51:09:422 -- Exception occurred during CheckDatabaseConnection: Access violation at address 00523A27 in module 'SpamFilterSvc.exe'. Read of address 00000008
11-20-08 01:51:09:422 -- Exception occurred during UpdateOtherSettings: Access violation at address 00601C70 in module 'SpamFilterSvc.exe'. Read of address 00000324
11-20-08 01:51:09:422 -- Reloading local black / white lists: SpamFilter.ini
11-20-08 01:51:09:547 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-20-08 01:51:09:562 -- (0) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-20-08 01:51:09:562 -- (1769238607) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-20-08 01:51:09:562 -- (0) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-20-08 01:51:09:562 -- (1701995880) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-20-08 01:51:09:578 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-20-08 01:51:09:578 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-20-08 01:51:09:578 -- (1632859457) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-20-08 01:51:09:578 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-20-08 01:51:09:578 -- (1668443974) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-20-08 01:51:09:593 -- (0) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
11-20-08 01:51:09:593 -- (1952804156) Exception occurred during TFilterObject.LoadFilters.ADOConnection.Open: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified

------------------------

------------------ 20081111.log ------------------------

11-11-08 09:24:38:195 -- (14024) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
11-11-08 09:24:38:195 -- (14024) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
11-11-08 09:24:38:195 -- (13320) Blacklist cache - starting cleanup
11-11-08 09:24:38:304 -- (13320) IPcache Limbo - removed 77 entries during cleanup
11-11-08 09:24:38:413 -- SFDB_WebErrors counter has been reset. Value was:1
11-11-08 09:24:38:413 -- SFDB_WebErrors counter has been reset. Value was:1
11-11-08 09:24:46:773 -- (13420) Connection from: 62.113.86.199 - Originating country : Russian Federation
11-11-08 09:24:46:898 -- (13420) Received MAIL FROM: <>
11-11-08 09:24:46:960 -- (13420) Received RCPT TO: http://www.info@peerlings.nl - www.info@peerlings.nl
11-11-08 09:24:46:960 -- (13420) - EmailTO is not in AuthorizedTOEmail list...
11-11-08 09:24:46:960 -- (13420) 62.113.86.199 - Mail from: To: http://www.info@peerlings.nl - www.info@peerlings.nl will be rejected
11-11-08 09:24:47:195 -- (9336) Connection from: 213.147.36.124 - Originating country : Russian Federation
11-11-08 09:24:47:335 -- (9336) Received MAIL FROM: <>
11-11-08 09:24:47:413 -- (9336) Received RCPT TO: http://www.info@peerlings.nl - www.info@peerlings.nl
11-11-08 09:24:47:413 -- (9336) - EmailTO is not in AuthorizedTOEmail list...
11-11-08 09:24:47:413 -- (9336) 213.147.36.124 - Mail from: To: http://www.info@peerlings.nl - www.info@peerlings.nl will be rejected
11-11-08 09:24:47:429 -- (10668) Connection from: 118.137.75.42 - Originating country : Indonesia
11-11-08 09:24:47:491 -- (9336) Blacklist cache - Added 213.147.36.124 to limbo
11-11-08 09:24:47:710 -- (9336) SFDB - Added 213.147.36.124 - Response: Error=0
11-11-08 09:24:47:710 -- (9336) Disconnect
11-11-08 09:24:48:241 -- (13900) Connection from: 217.112.42.7 - Originating country : Russian Federation
11-11-08 09:24:48:241 -- (13900) IP is in local blacklist cache. Disconnecting: 217.112.42.7
11-11-08 09:24:48:304 -- (13900) No Data Received
11-11-08 09:24:48:304 -- (13900) Disconnect
11-11-08 09:24:48:429 -- (12624) Connection from: 195.46.113.88 - Originating country : Russian Federation
11-11-08 09:24:48:648 -- (13420) Start virus scan
11-11-08 09:24:48:648 -- (13420) Starting bayesian procedures
11-11-08 09:24:48:695 -- (12512) Time to add Msg to Bayes corpus:0
11-11-08 09:24:48:757 -- (13420) Blacklist cache - Added 62.113.86.199 to limbo
11-11-08 09:24:48:976 -- (13420) SFDB - Added 62.113.86.199 - Response: Error=0
11-11-08 09:24:48:976 -- (13420) Disconnect
11-11-08 09:24:49:179 -- (12624) Received MAIL FROM: <>
11-11-08 09:24:49:382 -- (12624) Received RCPT TO: http://www.info@peerlings.nl - www.info@peerlings.nl
11-11-08 09:24:49:382 -- (12624) - EmailTO is not in AuthorizedTOEmail list...
11-11-08 09:24:49:382 -- (12624) 195.46.113.88 - Mail from: To: http://www.info@peerlings.nl - www.info@peerlings.nl will be rejected
11-11-08 09:24:49:679 -- (10668) Received MAIL FROM: < mailto:kefxfxcyeydiz@xfxcyey.com - kefxfxcyeydiz@xfxcyey.com >
11-11-08 09:24:49:835 -- (12624) Start virus scan
11-11-08 09:24:49:835 -- (12624) Starting bayesian procedures
11-11-08 09:24:49:882 -- (12512) Time to add Msg to Bayes corpus:0
11-11-08 09:24:50:101 -- (12624) Blacklist cache - Added 195.46.113.88 to limbo
11-11-08 09:24:50:320 -- (12624) SFDB - Added 195.46.113.88 - Response: Error=0
11-11-08 09:24:50:320 -- (12624) Disconnect
11-11-08 09:24:50:695 -- (10668) Received RCPT TO: mailto:eerlings@tns-online.nl - eerlings@tns-online.nl
11-11-08 09:24:50:710 -- (10668) - EmailTO is not in AuthorizedTOEmail list...
11-11-08 09:24:50:710 -- (10668) 118.137.75.42 - Mail from: mailto:kefxfxcyeydiz@xfxcyey.com - kefxfxcyeydiz@xfxcyey.com To: mailto:eerlings@tns-online.nl - eerlings@tns-online.nl will be rejected
11-11-08 09:24:50:804 -- (13688) Adding to C:\Program Files\SpamFilter\domains\tns-online.nl\WL_AutoWhiteListForceDelivery.txt:mailer.bhf.daegb.salesquest@mc1.nl|esther@tns-online.nl
11-11-08 09:24:50:835 -- (13688) Delivering quarantined email from < mailto:mailer.bhf.daegb.salesquest@mc1.nl - mailer.bhf.daegb.salesquest@mc1.nl > to mailto:esther@tns-online.nl - esther@tns-online.nl
11-11-08 09:24:50:882 -- (13092) Starting to process queue directory...
11-11-08 09:24:50:960 -- Exception occurred during CheckDatabaseConnection: Access violation at address 00523A27 in module 'SpamFilterSvc.exe'. Read of address 00000008
------------------------------------

Looks like every thime the service crashes it writes it last lines to the c:\ drive

Posted By: LogSat
Date Posted: 01 December 2008 at 4:35pm

bart,

There's something not right with the installation of SpamFilter, as *all* the logfiles must be located in one single directory - by default the \SpamFilter\logfiles directory. This location can be changed via the following parameter in the SpamFilter.ini file:

LogFilePath=C:\SpamFilter\logfiles

Are you by any chance running multiple instances of SpamFilter, or maybe opening the standalone version of SpamFilter while running SpamFilter's service? Can you verify this is not the case by looking at the processes in the Windows Task Manager and ensuring you have only a single instance of either "SpamFilter.exe" or "SpamFilterSvc.exe" in the list? Having both entries in there, or multiple instances of the same problem is bound to cause problems, unless you configure each instance so as to not interfere with the others, and they are all located in separate directories.

Is it possible for us to remote into your server to have a better look? You can contact us by email at support at logsat.com to provide us further details.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Bart
Date Posted: 02 December 2008 at 5:52am

There's only one instance of SpamfilterISP running on my server as a service.

All my logfiles are in c:\program files\spamfilter (Default)

Only when te service crashes it puts a logfile to c:\

I'll send you an email with a username and password to login to my server and have a look yourself.

Posted By: LogSat
Date Posted: 03 December 2008 at 10:56pm

This is something we've never seen before... It looks like there are some pretty specific access violations errors within SpamFilter, and when these occur, the location in RAM that stores the path for the logfiles gets corrupted, which causes SpamFilter to start writing the logs at the root of the C: drive until it crashes completely.

We're seeing a pattern of errors similar to the following:

11-20-08 01:51:09:422 -- (11520) Exception occurred during TTerminateIdleThreads.DoCleanupListView: Access violation at address 00654A04 in module 'SpamFilterSvc.exe'. Read of address 00000278

When these occur, the problems appear to begin. The "DoCleanupListView" process deals with the removal of stale connections in the "Connections" tab in SpamFilter that displays the live view of incoming connections. It's possible that there is a conflict with the video display that causes the errors. I've disabled the connections grid (the settings is in the "Settings - Configuration" tab) to see if this solves the problem. Can you please monitor it for a few days and let us know if it helps?

As a side note, while checking your other settings, I noticed that none of your MAPS RBL blacklist server are working (and thus this filter is not stopping any spam), as the list of servers is missing the ",true" suffix that tells SpamFilter to reverse the IP octet when making a query to the BL servers. The list you have is:

bl.spamcop.net
zen.spamhaus.org
sbl-xbl.spamhaus.org
dnsbl.njabl.org
cbl.abuseat.org

But it should actually be:

bl.spamcop.net,true
zen.spamhaus.org,true
sbl-xbl.spamhaus.org,true
dnsbl.njabl.org,true
cbl.abuseat.org,true

I have not made any changes to this in case you have it so for a reason.

Also please note that SpamFilter will will take keywords literally as entered. So if a keyword is listed as:

"this is a test"

SpamFilter will search for the text that has a double-quote, followed by this is a test and then followed by another double-quote. So if you're looking to use a keyword that consists of the phrase "this is a test", the keyword entry should not have the quotes and should be listed as follows:

this is a test

If you wish to use an "and", so you want to search for "this is a test" AND "this one too", then you will need to separate the two keywords with a comma (and omit the quotes, as follows:

this is a test,this one too

There is no OR support, but you can use RegEx (Regular Expressions) to create complex keyword searches.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Bart
Date Posted: 04 December 2008 at 2:35am

Tnx for your reaction.

I'll watch it for some day's and see if it crashed again and i'll let you know.

I also will make the changes you gave me, the keyword list i extracted from GFI and didn't make any changes. but i will edit it.

Tnx again, i'll keep you posted.