Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Regarding Spam Filter 2.6.3.487
  FAQ FAQ  Forum Search   Register Register  Login Login

Regarding Spam Filter 2.6.3.487

 Post Reply Post Reply
Author
scharette View Drop Down
Newbie
Newbie


Joined: 20 December 2005
Location: United States
Status: Offline
Points: 16
Post Options Post Options   Thanks (0) Thanks(0)   Quote scharette Quote  Post ReplyReply Direct Link To This Post Topic: Regarding Spam Filter 2.6.3.487
    Posted: 20 December 2005 at 10:01am
Hi

I am really close to purchasing your software at this time.  My only hesitation is that in this particular build I am seeing emails being sent multiple times (on approx a 20 min cycle).  The emails are identical and the headers are all in order pointing at our spam server as being the issue.  Is this a known problem?  Would it be fixed if I bought the newest version? 

The program has definately impressed me quite a bit as I used it briefly a year ago, however didnt find it to be advantagous at that time.  However, your new version definately does circles around the old. 

Your help is very much appreciated.

Thanks

Sara
Sling Shot
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 20 December 2005 at 10:13am
Hmmm.  I, too, experienced this issue (if it is the same) and worke with LogSat support on it.  Unfortunately, I seemed to be the only other customer with this issue.  I am now running REGISTERED version v2.7.1.511 and the issue seems to be resolved.  I believe LogSat support can shed some light on this issue.
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 20 December 2005 at 10:25am
Sara,

If you can provide us with additional information we'll try to see if the issue you're having is caused by SpamFilter and if so, to find out what the problem is. We'll need:

Your SpamFilter.ini file
SpamFilter's activity logfile for a day this occurred
The TO and FROM email addresses for a user where duplicate emails occurred so we can locate the emails in the log
If available, the email headers for some of the duplicate emails for the above users

Please zip these to us at: support at logsat.com

Dan, as a side note, where you seing the problem with the earlier version occurring at regular intervals (as Sara mentioned), or where they random?
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 20 December 2005 at 11:39am

Roberto,

It *seemed* to go along with my queue flush time but I will need to verify that.

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
scharette View Drop Down
Newbie
Newbie


Joined: 20 December 2005
Location: United States
Status: Offline
Points: 16
Post Options Post Options   Thanks (0) Thanks(0)   Quote scharette Quote  Post ReplyReply Direct Link To This Post Posted: 20 December 2005 at 1:44pm
Hi

I have emailed a log as well as my ini file......unfortuantely I have deleted the duplicate emails at this time so I dont have the headers.  I can try to remote into a customers computer this evening and see if I can retrieve them from the deleted folder.......

I am kinda under the impression it might have to do with my flush queue as well.....though I am not certain of this....

I am going to go ahead and purchase the most recent software at this time. Thanks for your quick responses.......

Thank you Desperado for bringing your two cents to the table....glad to hear that I am not the only person that is experiencing it.....also glad to hear that it isn't an issue with the newest release!

Thanks

Sara
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 21 December 2005 at 8:47am

Sara,

I believe that not only will you be pleased with the product but also with all the support you get.  I have rarely, if ever, received as much personal attention for the support of any product and find that LogSat (Roberto) is very open to changes and never "passes the buck".  If there is a problem with the product, he has never failed to find and fix it.

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
agavv View Drop Down
Newbie
Newbie
Avatar

Joined: 22 August 2005
Location: Netherlands
Status: Offline
Points: 8
Post Options Post Options   Thanks (0) Thanks(0)   Quote agavv Quote  Post ReplyReply Direct Link To This Post Posted: 21 December 2005 at 11:43am

Sara,

We served  more than 2400000 inbound connections till now and never had any duplicates!

Version .511 is a dream: we changed last week from 487 and changed the settings for the blacklist cache in 3 - 15 - 90 to catch the spamload in this part of the world.

This version results also in a lower load on our DNS-servers by not checking for reverse-dns.

We almost never asked for anything because all is in the manual and if not it is findable in the forum.

We are running about 1000 domains through SF !!!

Very good software and support.

AGAVV

 

 

 

 

Back to Top
WebGuyz View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebGuyz Quote  Post ReplyReply Direct Link To This Post Posted: 21 December 2005 at 2:01pm

SpamFilter is excellent!

The new .511 really is nice with the IP Blacklist cache.
Thanks to the SF staff for a great product.

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 21 December 2005 at 4:47pm
Thanks everyone for the support!

Dan, in Sara's case we were actually seing the remote server making multiple connections each single time and re-sending the same email content. It was not a loop however, as one of the X- email headers was slightly different every time, so the server was actually re-sending it multiple times. We've asked Sara for some Debug logs from SpamFilter so we can see the SMTP traffic and ensure that it's not SpamFilter sending some "weird" response that's causing this.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 21 December 2005 at 7:06pm

Roberto,

Please let me know what you find.  I still do not understand some ot the "events" we had.  I believe you have may log.

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
Sara View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Sara Quote  Post ReplyReply Direct Link To This Post Posted: 23 December 2005 at 9:25am
Not sure that you received this email as I have not received a response.  This issue is still happening for me in the new build.  The logs below are from the newest version.  It is more than one email that is subject to constant redelivery.  I would really like to get down to the bottom of this if possible.  I did end up blocking the address in question until resolution is found.  Once I blocked the domain it did finally send the last command to end the connection.  I did lose this log, though I will try to do it with another email/IP in question.


Below email was sent 12/21/05:

Hi Roberto,

I have upgraded to the newest release and still having the same issues, so you help is very much appreciated.

I have done the debug you have requested and here is the logs:

>>HELO mail.homebistro.qm4.net
MAIL FROM:<return_0_1985632_103127@homebistro.qm4.net>
RCPT TO:<WJMEAD@MEADCOMPANY.COM>
DATA
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; d=qm4.net; s=2005_1;
>>
>>HELO mail.homebistro.qm4.net
MAIL FROM:<return_0_1985632_103127@homebistro.qm4.net>
RCPT TO:<WJMEAD@MEADCOMPANY.COM>
DATA
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; d=qm4.net; s=2005_1;
>>
>>g=
HELO mail.homebistro.qm4.net
MAIL FROM:<return_0_1985632_103127@homebistro.qm4.net>
RCPT TO:<WJMEAD@MEADCOMPANY.COM>
DATA
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; d=qm4.net; s=2005_1;
>>
>>g=
>>HELO mail.homebistro.qm4.net
MAIL FROM:<return_0_1985632_103127@homebistro.qm4.net>
RCPT TO:<WJMEAD@MEADCOMPANY.COM>
DATA
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; d=qm4.net; s=2005_1;
>>
>>g=
HELO mail.homebistro.qm4.net
MAIL FROM:<return_0_1985632_103127@homebistro.qm4.net>
RCPT TO:<WJMEAD@MEADCOMPANY.COM>
DATA
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; d=qm4.net; s=2005_1;
>>
>>g=
>>HELO mail.homebistro.qm4.net
MAIL FROM:<return_0_1985632_103127@homebistro.qm4.net>
RCPT TO:<WJMEAD@MEADCOMPANY.COM>
DATA
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; d=qm4.net; s=2005_1;
>>
>>g=
<<250 Ok

Please let me know what you think as soon as possible.  

Thanks

Sara
Sling Shot
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 23 December 2005 at 10:09am
Actually we didn't.. it was stopped by SpamFilter, fault of one of our keywords (which we just removed!). I've responded to you by email just minutes ago.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
scharette View Drop Down
Newbie
Newbie


Joined: 20 December 2005
Location: United States
Status: Offline
Points: 16
Post Options Post Options   Thanks (0) Thanks(0)   Quote scharette Quote  Post ReplyReply Direct Link To This Post Posted: 23 December 2005 at 10:33am
Hi Roberto,

Thank you for your quick response....I have an email going to you shortly.  Sorry about my last post as I read through it, it is very short and to the point (could be seen as rude). Please know this wasnt intentional nor directed toward you, I know you are very responsive, and knew there had to be an issue with the email getting to you, just was in a hurry to get that posted and handle a few other things ..... Your assistance is very much appreciated!
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 23 December 2005 at 10:38am
Sara,

I hope you're joking about the posting being rude! If we loook at all my "short" posts then I should be banned from our own forum :-)

We'll wait for the email then, and hope we'll be able to provide an answer.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
scharette View Drop Down
Newbie
Newbie


Joined: 20 December 2005
Location: United States
Status: Offline
Points: 16
Post Options Post Options   Thanks (0) Thanks(0)   Quote scharette Quote  Post ReplyReply Direct Link To This Post Posted: 06 January 2006 at 10:02am
Well Roberto,

These last few weeks have been more than hectic in my office, due to the holidays and people being on vacation.  So I haven't had as much time as I like to put towards the spam software....but for whatever reason it is indeed still happening.  Unforutantely I have had very little luck using the debug feature as the emails duplicate themselves within a small period of time so by the time I find out about them, the duplicates have stopped.  I again, got duplicates of the BMG newsletter this month (which is the same one that duplicated for me last month).....and I see that the wjmead address I gave you is still getting multiple duplicate newsletters. 

Here is a couple headers from the BMG one that just duplicated for me this morning and last night....

Date: Thu, 05 Jan 2006 20:05:55 -0500
From: "BMG Music Service" <bmgmusic@bmgmusicservice.com>
Subject: Your COMMON Featured Selection is here!
Reply-to: "BMG Music Service" <bmg.1996107@bmgmusic.ed10.net>
To: scharette@sst-ltd.net
Received: from spam02 [192.168.50.39] by mail.inct.net with ESMTP  (SMTPD32-8.00) id A55182005FC; Fri, 06 Jan 2006 08:49:05 -0500
Received: from 216.74.160.10 by my_mailserver.mydomain.com (LogSat Software SMTP Server) Fri, 6 Jan 2006 08:32:38 -0500
Received: from ([127.0.0.1:51490]) by bm1-1.ed10.com (ecelerity 1.2.12.3 r(6451)) with ECSTREAM id 2B/21-01811-372CDB34 for <scharette@sst-ltd.net>; Thu, 05 Jan 2006 20:05:55 -0500
Content-Type: text/html
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
Message-Id: <3762-64093-FBJOY-LQF5NB-89VSZB-H@e-dialog.com>
X-Mail-From: FBJOY-LQF5NB-89VSZB-H@bmg.bounce.ed10.net
X-RCPT-To: scharette@sst-ltd.net
X-Mailer: EDMAIL R6.00.02
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <FBJOY-LQF5NB-89VSZB-H@bmg.bounce.ed10.net>
X-SF-HELO-Domain: bmg.outbound.ed10.com
Status: U
X-UIDL: 436472710

Date: Thu, 05 Jan 2006 20:05:55 -0500
From: "BMG Music Service" <bmgmusic@bmgmusicservice.com>
Subject: Your COMMON Featured Selection is here!
Reply-to: "BMG Music Service" <bmg.1996107@bmgmusic.ed10.net>
To: scharette@sst-ltd.net
Received: from spam02 [192.168.50.39] by mail.inct.net with ESMTP  (SMTPD32-8.00) id A0093DF005E4; Fri, 06 Jan 2006 07:18:17 -0500
Received: from 216.74.160.10 by my_mailserver.mydomain.com (LogSat Software SMTP Server) Fri, 6 Jan 2006 07:01:52 -0500
Received: from ([127.0.0.1:51490]) by bm1-1.ed10.com (ecelerity 1.2.12.3 r(6451)) with ECSTREAM id 2B/21-01811-372CDB34 for <scharette@sst-ltd.net>; Thu, 05 Jan 2006 20:05:55 -0500
Content-Type: text/html
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
Message-Id: <3762-64093-FBJOY-LQF5NB-89VSZB-H@e-dialog.com>
X-Mail-From: FBJOY-LQF5NB-89VSZB-H@bmg.bounce.ed10.net
X-RCPT-To: scharette@sst-ltd.net
X-Mailer: EDMAIL R6.00.02
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <FBJOY-LQF5NB-89VSZB-H@bmg.bounce.ed10.net>
X-SF-HELO-Domain: bmg.outbound.ed10.com
Status: U
X-UIDL: 436472707

Date: Thu, 05 Jan 2006 20:05:55 -0500
From: "BMG Music Service" <bmgmusic@bmgmusicservice.com>
Subject: Your COMMON Featured Selection is here!
Reply-to: "BMG Music Service" <bmg.1996107@bmgmusic.ed10.net>
To: scharette@sst-ltd.net
Received: from spam02 [192.168.50.39] by mail.inct.net with ESMTP  (SMTPD32-8.00) id AAC386CD05C2; Fri, 06 Jan 2006 05:47:31 -0500
Received: from 216.74.160.10 by my_mailserver.mydomain.com (LogSat Software SMTP Server) Fri, 6 Jan 2006 05:31:07 -0500
Received: from ([127.0.0.1:51490]) by bm1-1.ed10.com (ecelerity 1.2.12.3 r(6451)) with ECSTREAM id 2B/21-01811-372CDB34 for <scharette@sst-ltd.net>; Thu, 05 Jan 2006 20:05:55 -0500
Content-Type: text/html
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
Message-Id: <3762-64093-FBJOY-LQF5NB-89VSZB-H@e-dialog.com>
X-Mail-From: FBJOY-LQF5NB-89VSZB-H@bmg.bounce.ed10.net
X-RCPT-To: scharette@sst-ltd.net
X-Mailer: EDMAIL R6.00.02
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <FBJOY-LQF5NB-89VSZB-H@bmg.bounce.ed10.net>
X-SF-HELO-Domain: bmg.outbound.ed10.com
Status: U
X-UIDL: 436472706

I know what you are staying in regards to the X-UIDL number being defferent....but something just isnt adding up here.....as I wasn't getting duplicates like this with the much earlier version of SpamFilter (I will have to go back and check which version it was)......Is there any other way we can troubleshoot this, versus relying on the debug feature (again it is been really hard to get the IP in question entered before it quits duplicating.......The BMG email above I have received 13 times since yesterday evening, though it stopped at 8am so I haven't been able to get the debug logs. I am trying to capture some logs right now for another email that is being duplicated as well....hope to have that by the end of the day today.


Back to Top
scharette View Drop Down
Newbie
Newbie


Joined: 20 December 2005
Location: United States
Status: Offline
Points: 16
Post Options Post Options   Thanks (0) Thanks(0)   Quote scharette Quote  Post ReplyReply Direct Link To This Post Posted: 06 January 2006 at 10:26am
Just as I finished up the last post....I was able to pull one debug log on a particular email that is duplicating itself......

>>EHLO jasper-cc.upromise.com
<<250-8BITMIME
<<250 HELP
>>EHLO jasper-cc.upromise.com
<<250-8BITMIME
<<250 HELP
>>MAIL FROM:<mailer-vd02@vd02.upromise.com>
<<250  Address Okay
>>RCPT TO:<hillcrest@mail.inct.net>
>>MAIL FROM:<mailer-vd02@vd02.upromise.com>
<<250  Address Okay
>>RCPT TO:<daustrom@tpaconsulting.com>
<<250 hillcrest@mail.inct.net Address Okay
>>DATA
<<354 Start mail input; end with <CRLF>.<CRLF>
<<250 daustrom@tpaconsulting.com Address Okay
>>Received: from bomber-cc (bomber-app.prod.upromise.com [172.24.36.140])
>>n. Save 1% for college
>>ers  in-stores, online, or by phone.
>>57698096
>>DATA
<<354 Start mail input; end with <CRLF>.<CRLF>
>>alt="" border="0"></td>
>>s/mc/spacer.gif' width='1' height='2' alt='' border='0'></td>
>>eight='4' ></td>
>>Received: from bomber-cc (bomber-app.prod.upromise.com [172.24.36.140])
>>ise.com/browse.php?olmcat=home_kitchen&ax=ase_ 20051228_03_20224
>>
>>-800-462-3966). <table cellpadding="0" cellspacing="0" border="0"><tr><td><font face="verdana, sans-serif" size="2" color="#333333"><a href="http://www.upromise.com/8364 .do?ax=ase_20051228_03_10109">Learn more</a> &nbsp;</td>
>>border="0"><tr><td><font face="verdana, sans-serif" size="2" color="#333333"><a href="http://www.upromise.com/8365 .do?ax=ase_20051228_03_10119">Learn more</a> &nbsp;</td>
>>://www.upromise.com/survey-mm/2503995520/ase01_200 51228">Take this short survey</a>&nbsp;</font></td><td va lign="bottom"><a href="http://www.upromise.com/survey -mm/2503995520/ase0120051228"><img src='http://im.upr omise.com/images/mc/buttons/arrow_yellow.gif' width='20' height='11' alt='' border='0' vspace='1'></a></td></tr>&l t;/table></td></tr>
>> cellpadding='0' cellspacing='0' border='0'><tr><td>
>>order='0'></td>
>><td width='1' bgcolor='#dddddd'><img src='http://im.upromise.com/im ages/mc/spacer.gif' width='1' height='4' ></td>
>>ing free shipping... all in one place? <a href="http://shop.upromise.com/browse.php?olmcat=Free %20Shipping&ax=ase_20051228_03_20204">Click here now</a>.</td>
>>href="http://shop.upromise.com/browse.php?olmcat=t ravel&ax=ase_20051228_03_20069">upromise.com</a> ;.</td>
>>f" size="2" color="#666666"><li>Buying or selling your home?
<<250 Ok
<<250 Ok

What is really odd, is that the emails that are duplicating themselves all have one thing in common and that is that they all end in the <<250 Ok
<<250 Ok
Even though I can confirm the email has been delivered to the recipient.  Instead of the standard <<250 Ok
>>QUIT
<<221 Signing Off
response which is given if the email is properly deliverd and not duplicated. 

Header for the particular Debug log above.
Header Information HIDE ]

Received: from spam02 [192.168.50.39] by mail.inct.net with ESMTP
  (SMTPD32-8.00) id A4B853505FA; Fri, 06 Jan 2006 09:54:48 -0500
Received: from 12.130.29.196 by my_mailserver.mydomain.com (LogSat Software SMTP Server) Fri, 6 Jan 2006 09:53:07 -0500
Received: from bomber-cc (bomber-app.prod.upromise.com [172.24.36.140])
by jasper-cc.upromise.com (Postfix) with ESMTP id CFC63A16C
for <daustrom@tpaconsulting.com>; Sun,  1 Jan 2006 23:23:22 -0500 (EST)
Message-ID: <1.1ppbrt.8toe.rx.0.77fexo.2dyiq@dialog>
Date: Sun, 1 Jan 2006 23:21:09 -0500 (EST)
From: Upromise <accountsummary@upromise.com>
Reply-To: accountsummary@upromise.com
To: <daustrom@tpaconsulting.com>
Subject: Douglas, Your Monthly Upromise Account Summary as of 12/24/2005
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_587594_719563.1136175802828"
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <mailer-vd02@vd02.upromise.com>
X-SF-HELO-Domain: jasper-cc.upromise.com
X-RCPT-TO: <daustrom@tpaconsulting.com>
Status: R
X-UIDL: 426987481

Header from a previous instance of this email.

Header Information HIDE ]

Received: from spam02 [192.168.50.39] by mail.inct.net with ESMTP
  (SMTPD32-8.00) id A12651F05FC; Fri, 06 Jan 2006 08:31:18 -0500
Received: from 12.130.29.196 by my_mailserver.mydomain.com (LogSat Software SMTP Server) Fri, 6 Jan 2006 08:29:42 -0500
Received: from bomber-cc (bomber-app.prod.upromise.com [172.24.36.140])
by jasper-cc.upromise.com (Postfix) with ESMTP id CFC63A16C
for <daustrom@tpaconsulting.com>; Sun,  1 Jan 2006 23:23:22 -0500 (EST)
Message-ID: <1.1ppbrt.8toe.rx.0.77fexo.2dyiq@dialog>
Date: Sun, 1 Jan 2006 23:21:09 -0500 (EST)
From: Upromise <accountsummary@upromise.com>
Reply-To: accountsummary@upromise.com
To: <daustrom@tpaconsulting.com>
Subject: Douglas, Your Monthly Upromise Account Summary as of 12/24/2005
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_587594_719563.1136175802828"
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <mailer-vd02@vd02.upromise.com>
X-SF-HELO-Domain: jasper-cc.upromise.com
X-RCPT-TO: <daustrom@tpaconsulting.com>
Status: R
X-UIDL: 426987475

Hopefully this helps......

Thanks

Sara

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 06 January 2006 at 11:19am

Roberto,

I too am getting 3 or 4 reports of duplicated messages in the last 2 days.

Dan

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
scharette View Drop Down
Newbie
Newbie


Joined: 20 December 2005
Location: United States
Status: Offline
Points: 16
Post Options Post Options   Thanks (0) Thanks(0)   Quote scharette Quote  Post ReplyReply Direct Link To This Post Posted: 06 January 2006 at 1:45pm
Hi

This is just another instance of that same email.  Please let me know if I should be providing you headers for each Debug log.  This email has been sent to two of our users more than 20 times today.  The problem seems to be getting worse......though it is really hard to tell....

>>EHLO jasper-cc.upromise.com
<<250-8BITMIME
<<250 HELP
>>EHLO jasper-cc.upromise.com
<<250-8BITMIME
<<250 HELP
>>MAIL FROM:<mailer-vd02@vd02.upromise.com>
<<250  Address Okay
>>RCPT TO:<hillcrest@mail.inct.net>
>>MAIL FROM:<mailer-vd02@vd02.upromise.com>
<<250  Address Okay
>>RCPT TO:<daustrom@tpaconsulting.com>
<<250 hillcrest@mail.inct.net Address Okay
>>DATA
<<354 Start mail input; end with <CRLF>.<CRLF>
<<250 daustrom@tpaconsulting.com Address Okay
>>Received: from bomber-cc (bomber-app.prod.upromise.com [172.24.36.140])
>>n. Save 1% for college
>>ers  in-stores, online, or by phone.
>>57698096
>>DATA
<<354 Start mail input; end with <CRLF>.<CRLF>
>>alt="" border="0"></td>
>>s/mc/spacer.gif' width='1' height='2' alt='' border='0'></td>
>>eight='4' ></td>
>>Received: from bomber-cc (bomber-app.prod.upromise.com [172.24.36.140])
>>ise.com/browse.php?olmcat=home_kitchen&ax=ase_ 20051228_03_20224
>>
- Have a new credit card?
>>
>>-800-462-3966). <table cellpadding="0" cellspacing="0" border="0"><tr><td><font face="verdana, sans-serif" size="2" color="#333333"><a href="http://www.upromise.com/8364 .do?ax=ase_20051228_03_10109">Learn more</a> &nbsp;</td>
>>border="0"><tr><td><font face="verdana, sans-serif" size="2" color="#333333"><a href="http://www.upromise.com/8365 .do?ax=ase_20051228_03_10119">Learn more</a> &nbsp;</td>
>>://www.upromise.com/survey-mm/2503995520/ase01_200 51228">Take this short survey</a>&nbsp;</font></td><td va lign="bottom"><a href="http://www.upromise.com/survey -mm/2503995520/ase0120051228"><img src='http://im.upr omise.com/images/mc/buttons/arrow_yellow.gif' width='20' height='11' alt='' border='0' vspace='1'></a></td></tr>&l t;/table></td></tr>
>> cellpadding='0' cellspacing='0' border='0'><tr><td>
>>order='0'></td>
>>ing free shipping... all in one place? <a href="http://shop.upromise.com/browse.php?olmcat=Free %20Shipping&ax=ase_20051228_03_20204">Click here now</a>.</td>
>>'#F3F3DE'><td colspan=5><img src='http://im.upromise.com/images/mc/ spacer.gif' width='10' height='10'></td></tr></tr>
>></td></tr></table></td>
>>80/ct?g=1.1ppbrt.8toe.rx.0.77fexo.2dyiq&i=2188 97&a=%26ux%3ddaustrom&h=1">upromise.com</a> to learn more.<br><br>
<<250 Ok
<<250 Ok

Thanks

Sara

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 06 January 2006 at 4:05pm
Dan,

Sara's duplicates were different than yours in the past. If you (Dan) can send me the logs showing the duplicates, along with the to/from emails I'll be able to see if the issues are related or not.

Sara,

Unfortunately the only list I was able to susbscribe to last time still has not sent me emails, so that is a dead end so far. The missing >>QUIT
<<221 Signing Off should not be an issue, but in this case I'm not going to discard anything, and will look into it. One possibilty could in theory be that the sender never sees the "250 OK" so thinks that the email was not successful. If you can please zip and email us your SpamFilter logs from today so we can correlate your posting entries with them, that will help. We may need to prepare a special debug build for you, but we need first to understand "where" to put extra debug code. Please allow us 12/24 hours once we have your logs to try to come up with a way to better see what is causing this.

Are you familiar with either Windows' Network Monitor utility, or with Etherreal? They both perform packet sniffing on a server, and the raw TCP data may help to shed some light onto this. If you're familiar with them please let us know so we can ask you to run them on the server.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 06 January 2006 at 4:37pm

Roberto,

I sent my info by email.

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 08 January 2006 at 7:00pm
Sara,

One of SpamFilter's many filters is the SURBL check. This filter looks at every single URL inside a message, and checks each one against DNS blacklists to see if domain name has been used to spam before. If so, the email is blocked. This filter is very, very efficient and powerful.
 
The email you forwarded us from Sony BMG contains 321 URLs in it. This causes SpamFilter to perform 321 DNS lookups. Normally this should take about 10 seconds (we tested it on our servers just now), so it is not a problem. However, should your DNS server experience problems, or timeouts, SpamFilter has a DNS lookup timeout of 15 seconds. After 15 seconds, if a response from ther DNS server is not received, SpamFilter will ignore the lookup and continue with the next one. Unfortunately, in the BMG email, should the DNS server be unavailable, it will mean that SpamFilter will timeout once per URL, so in this case 321 x 15 seconds = 4815 seconds. This means that it could take up to 80 minutes for SpamFilter to "test" all 321 URLs should the DNS server have issues. This very well explains the 20-30 minutes we've observed in your logs that it has taken to process these emails. The remote server, seing this long delay, is most likely interpreting it as a failure in sending its email, and will thus try again multiple times. Now with hindsight, going back thru your logs we also do see several DNS timeouts, indicating problems.
 
While it's easy to blame a DNS server for the problems, hopefully you'll have noticed that this is not how to operate... Please allow us a few more hours to come up with a solution, so that even with DNS problems the tests won't take that long. We'll also try to improve the SURBL DNS checks by avoiding duplicate lookups. We'll be testing the new build as fast as possible, and then will provide you with a "beta" build for you to test as well.

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
mikek View Drop Down
Senior Member
Senior Member
Avatar

Joined: 22 February 2005
Location: Switzerland
Status: Offline
Points: 133
Post Options Post Options   Thanks (0) Thanks(0)   Quote mikek Quote  Post ReplyReply Direct Link To This Post Posted: 09 January 2006 at 2:44am
Originally posted by LogSat LogSat wrote:

The email you forwarded us from Sony BMG contains 321 URLs in it. This causes SpamFilter to perform 321 DNS lookups.
 
321 URLs with different domains? I shouldn't think so. I guess a solution would be to filter out duplicates before checking them against SURBL, or set up a cache of SURBL lookups (for 10 minutes or so).
 
Just my 2 cents.
 
Cheers!
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 09 January 2006 at 7:18am
Yeap, we agree, thus to address the problem we release yesterday build 516 as follows :

// New to VersionNumber = '2.7.1.516';
{TODO -cFix : SURBL filter could take several minutes to be process emails with hundreds of URLs if DNS server is down, possibly causing re-sends of the email. Improved lookups by removing duplicate TLDs and added global timeout to avoid problem}
{TODO -cFix : SpamFilter version number and blacklist/whitelist loading indicators are missing in logs when SpamFilter service is started}
{TODO -cNew : Added "Notice - IdleDisconnectMinutesTimeout reached. Removing threadID" log entry when disconnecting idle threads}

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.098 seconds.