਍
਍　　　　　㄀㐀挀戀㔀　㄀搀昀　攀ⴀ㜀㈀　戀㘀㘀昀㐀ⴀ愀㌀㤀挀ⴀ㐀㄀愀　ⴀ愀㤀挀㌀ⴀ㘀㄀㤀戀搀㔀㠀㐀㈀㤀㈀攀ⴀ　　　　　　䀀甀猀ⴀ眀攀猀琀ⴀ㈀⸀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀搀攀愀渀⸀渀漀爀氀椀渀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍　　　　　㄀㐀搀㤀㈀㘀㌀㈀㘀搀㄀ⴀ攀　愀愀㤀挀愀愀ⴀ戀㐀㄀㜀ⴀ㐀㜀㔀㤀ⴀ㠀挀愀昀ⴀ㐀愀搀㄀㠀昀搀昀愀　㄀㄀ⴀ　　　　　　䀀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀樀攀爀爀礀⸀洀挀挀愀爀琀栀礀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍　　　　　㄀㐀攀㈀戀㜀㔀㄀　㜀㔀ⴀ搀㤀戀戀㐀攀㌀㈀ⴀ㘀㄀昀㤀ⴀ㐀㜀攀㌀ⴀ㤀挀㘀愀ⴀ搀㐀㠀㈀㌀㔀㄀㄀㔀㌀昀㌀ⴀ　　　　　　䀀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀氀椀猀攀⸀栀愀爀眀椀渀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍　　　　　㄀㐀昀㌀搀㜀　愀　㜀㠀ⴀ搀㜀㔀戀愀　戀㤀ⴀ愀㈀㤀　ⴀ㐀㠀搀挀ⴀ㤀㤀㐀㘀ⴀ挀㤀戀㜀㔀㄀㔀㜀㔀挀㘀㈀ⴀ　　　　　　䀀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀猀琀攀瘀攀⸀栀愀爀氀攀礀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍　　　　　㄀㐀㘀㘀愀㐀戀㠀㈀戀　ⴀ挀搀㘀愀㤀㜀挀㜀ⴀ㌀㄀攀㐀ⴀ㐀㐀㤀　ⴀ㠀　㄀㘀ⴀ㤀㔀愀㐀㄀昀愀㄀㤀㠀昀㔀ⴀ　　　　　　䀀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀洀椀挀栀愀攀氀⸀栀甀最最椀渀猀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍　　　　　㄀㐀㜀挀㘀㘀㌀㈀愀攀搀ⴀ戀昀㘀㌀㄀㈀㄀㌀ⴀ㠀昀㜀攀ⴀ㐀　㐀㌀ⴀ㠀　搀㤀ⴀ㜀㐀昀㌀㘀挀　挀㐀㤀昀㔀ⴀ　　　　　　䀀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀愀渀搀爀攀愀⸀猀攀最攀爀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍　　　　　㄀㔀　㜀㔀㜀㌀㠀㐀戀㜀ⴀ攀戀挀㌀㄀㈀㈀攀ⴀ　㘀攀㈀ⴀ㐀㘀昀㠀ⴀ㠀㄀㘀　ⴀ㄀㤀昀愀㘀挀㄀愀攀愀戀昀ⴀ　　　　　　䀀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀瀀愀琀琀椀⸀猀挀栀洀椀搀琀ⴀ猀栀漀瘀攀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍　　㔀ⴀ欀瀀猀ⴀ㈀㈀㔀⸀　⸀㄀㐀㘀㔀　⸀　⸀　⸀㜀㔀㔀㘀⸀㜀⸀㐀㐀㘀㌀㌀㈀㔀ⴀ　ⴀ㔀㘀㘀䀀挀漀渀渀攀挀琀⸀最爀漀瘀漀⸀挀漀洀簀洀愀渀甀攀氀愀⸀洀愀爀挀甀氀攀猀挀甀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍㄀　㐀攀㌀攀㌀㌀㜀氀愀礀昀漀瘀挀椀愀㌀渀焀㜀㔀椀愀愀愀愀愀戀礀挀搀礀愀栀搀椀㈀漀戀瀀㐀礀愀愀愀愀愀䀀昀爀攀搀洀攀礀攀爀洀愀椀氀⸀挀漀洀簀戀椀氀氀⸀猀挀栀洀椀搀琀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍　㔀　ⴀ甀眀琀ⴀ㠀㠀㠀⸀　⸀㐀㌀㤀㄀㜀⸀　⸀　⸀㈀㄀㄀㈀　⸀㜀⸀㐀㜀㤀㘀　㘀㄀䀀瀀漀琀漀洀愀挀㄀　㔀　⸀洀欀琀漀洀愀椀氀⸀挀漀洀簀樀愀猀漀渀⸀氀攀攀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍　㜀㌀ⴀ猀昀焀ⴀ㈀　㄀⸀　⸀㈀㤀㔀㄀⸀　⸀　⸀㈀㈀㘀㔀⸀㜀⸀㄀　㘀㜀㤀㈀㜀䀀攀洀ⴀ猀樀ⴀ㜀㜀⸀洀欀琀漀洀愀椀氀⸀挀漀洀簀礀椀欀眀椀渀最⸀猀栀甀洀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍　㠀㤀ⴀ稀猀攀ⴀ㠀㔀㜀⸀　⸀㜀㔀㘀㠀⸀　⸀　⸀㜀㐀㄀㘀⸀㜀⸀㐀㈀　㐀㠀

If you know the latest date for which you know for certain that the autowhitelistforcedelivery file was fine, could you please zip and provide to us all of SpamFilter's activity logfiles starting from the day before the above date up until today? By going thru the activity logfiles one-by-one from before the file became corrupted until it does become corrupted hopefully will allow us to find out when the problem occurred and why.

If the zip are smaller than 10MB you can email them to us at support at logsat dot com. If not, I've just activated our FTP site at:

ftp.logsat.com

username: LogSatUser

password: the same password I sent you for the upload site

I apologize for the issues!

It looks as if the autowhitelist file is being locked by another process while SpamFilter is trying to write to it, which causes it to become corrupted. Here is what we found.

These partial logs show the times when that file is being reloaded, along with its size.:

As you can see, the line in red suddenly shows a huge increase in the AutoWhiteListForceDelivery.txt size, which tells us that the corruption occurred shortly before the entry in red. Looking further in the logs, we then see this errors:

The error in bold show us what most likely happened. Is there anything that can be locking that file? Backups, antivirus, etc?

Are you certain there is nothing else interfering with that autowhitelist text file? As you said, there are no more sharing errors in the new logs, but there are still unexplained entries.

SpamFilter will automatically add to that file a new line every time a user forces the delivery of a quarantined email out of the database. This means that the AutoWhiteListForceDelivery.txt file should always increase in size, never shrink. Yet, if you look at the file size that is being logged when SpamFilter reloads the file, you can see how the size sometimes increases and sometimes decreases:

While we can't discard SpamFilter having issues when the file becomes corrupted (or if SpamFilter itself is corrupting the file), what points to an external application making changes to the file is the following.

SpamFilter will log whenever it adds an entry to the AutoWhiteListForceDelivery.txt file, and will log another entry when it reloads that file if it has been modified within the last 60 seconds.

In this list, you can see that while there are several instances where SpamFilter has added an entry to the AutoWhiteListForceDelivery.txt file and then reloaded it, there are also several entries where that file was detected as having been modified without any traces of SpamFilter having added entries to it. I've marked all those reloads caused by an external factor in red, and the reloads caused by SpamFilter having added one or more entries to that file in blue. 

Note that on both the 26th and the 27th at 4:00AM, 4:01AM and at 6:00AM SpamFilter logs multiple reloads of the AutoWhiteListForceDelivery.txt at almost the same time as it detected changes in that file's timestamp. On the 27th there are additional reloads at 7:03AM unrelated to SpamFilter having added an entry.

Can you think of anything that may be happening on that server (or more specifically to that file) that causes it to change? Do you have any automated process or database process that is writing to it?