Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Mail gets lost and fallback
  FAQ FAQ  Forum Search   Register Register  Login Login

Mail gets lost and fallback

 Post Reply Post Reply
Author
Bart View Drop Down
Newbie
Newbie
Avatar

Joined: 20 August 2008
Location: Holland
Status: Offline
Points: 18
Post Options Post Options   Thanks (0) Thanks(0)   Quote Bart Quote  Post ReplyReply Direct Link To This Post Topic: Mail gets lost and fallback
    Posted: 04 November 2008 at 4:25pm

i've got a problem with some attachements.

 

When someone mails me i can see the mail ariving at the server running spamfilterISP but it never gets into my mailbox.

mails without an attachement are delivered without a problem.

 

I tried the debug option but i can't see something wrong.

 

>>EHLO mx2.elka.nl

<<250-8BITMIME

<<250 HELP

>>MAIL FROM:<tns@elka.nl>

<<250 Address Okay

>>RCPT TO:<bart@tns-online.nl>

<<250 bart@tns-online.nl Address Okay

>>DATA

<<354 Start mail input; end with <CRLF>.<CRLF>

>>Received: from 10.200.0.11 ([10.200.0.11]) by iis1dmz.elka.local ([10.0.0.20]) with Microsoft Exchange Server HTTP-DAV ;

>>-face

>>yle=3D=

>>ramE>de</SPAN> register informaticus de heer=

>>7yC0acsDUMAQD/2PU0LN4OAMEuWX

>>90o0Wt2rHncSq50mYPiVdwcl0WcQtcLRgMpveuye47l+JWjf3ZL3TzceoQ

>>dsofV4hNLHRk+f0+7nDb0XeNNdEWa5rNPM

>>KnyedkNnvbfI2EKXNzHhq+2OMPji+i5+BrFU9jotxbK190CtpczMd31M2ZUpbIg871nt4FnaO9JX

>>4deY4WIHxwinNukGKxur/e/OQdqr

>>0bCS8Fxhf6DSFCD5tmGnTAWXSZ/kUCuNoElr3kUBMwXt1x5Te9zFu8xKu3

>>Y5aWkMjehn

>>dyeb

 
I cut a lot of lines

>>16wD63PrDfWw9Abf9+y77QYfF3l82J4ZhY

>>7i8EnBhzShRjdJcY7enwTcBLsHNu9Wr7PJ+SMz1urKoTW/XqDsLLOIvNqEux5dKY

>>gGmbYYVYFTsx4vyenGjrRSVvlbbX

>>2TpWFW9bOstCrcI2ND3uaEh/ES8t5sLstakQCOoBhEBSiODEbHaKMmeq1U

>>YoK8UApRJt

>>Yx8V7KvUMGxlb9BtVACXNbdcr0PL3YqTeivsZoud

>>Jib3V3aW5nX2dlZHJhZ19Wb3MtV2l0bWVyXzI0MTAyMDA4IF80Xy5wZGZQSwECFAAUAAIA

<<250 Ok

>>QUIT

<<221 Signing Off

Looks to me that mails is deliverd normaly but i don't recieve it.
This is the third time this problem came up, once with about 10 documents attached to the message, once with a zip archive of 3 MB and thistime it only was 2 MB
The zip archive contains only .doc, .xls and .pdf files without virus or macro
How can i determine where the mail had gone ????
 
 
 
Question 2
We have a registered enterprise version of spamfilterISP
the server is running fine but there is a lot of spam comming in thru our fallback server. Whats the best way to solve this ? i only have 1 license but need 2 servers in case my primary server fails.
 
Tnx
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 04 November 2008 at 4:37pm
Bart,

If you can please zip and email us at support at logsat.com your SpamFilter's activity file for the day the above email was received, we'll try to see what's going on. The "250 OK" at the end usually indicates the email was received successfully by SpamFilter and should be forwarded to your mail server, however the "send to NULL" or "NO NDR" options that can be enabled (they are always off by default) do cause spam emails to be received and then dropped immediately, without providing indication to the sender that they were not delivered (that behavior is discouraged, which is why the options to do so are disabled by default).
If the file is over 5MB I will send you a PM with our FTP upload login info.

In regards to the backup server question, please see our reply to a similar forum question earlier today:
http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6575#12466
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Bart View Drop Down
Newbie
Newbie
Avatar

Joined: 20 August 2008
Location: Holland
Status: Offline
Points: 18
Post Options Post Options   Thanks (0) Thanks(0)   Quote Bart Quote  Post ReplyReply Direct Link To This Post Posted: 06 November 2008 at 6:49am
i can send you the file if you want, no problem.
 
11-04-08 20:30:22:671 -- (384) Received MAIL FROM: <XXX@exxxa.nl>
11-04-08 20:30:22:703 -- (384) Received RCPT TO: xxx@tnxxxxxxxxx.nl
11-04-08 20:30:23:125 -- (384) - SPF analysis for elka.nl done: - none
11-04-08 20:30:23:125 -- (384) Mail from: xxx@exxxxa.nl
11-04-08 20:30:23:125 -- (384) - MAPS search done...
11-04-08 20:30:23:125 -- (384) RCPT TO: xxxx@tnxxxxxx.nl accepted
11-04-08 20:30:29:375 -- (384) Bypassed all rules for: xxx@tnxxxxxxx.nl from xxx@exxxa.nl (Whitelisted - Email size exceeded MaxMsgSizeForSpamFiltering)
11-04-08 20:30:29:875 -- (384) Start virus scan
11-04-08 20:30:30:156 -- (384) Starting queueing procedures
11-04-08 20:30:30:187 -- (384) EMail from xxx@exxxxxxa.nl to xxxx@tnxxxxxx.nl was queued. Size: 2866 KB, 2934784 bytes
11-04-08 20:30:30:218 -- (2568) Sending email from xxx@exxxx.nl to xxxxxx@tnxxxxxxxx.nl --
 
These are the lines in the timeframe i retried to send the message, now i see there is a max size for Filtering and my guess is thats why the mail is dropped.
 
Where can i set the max Size ?? i'll setup  a bigger size and after that i'll try again, if the problem then is stil the same i'll send you that logfile.
 
Can you tell me where to setup the vualue for max size ? In the Interface the max email size is set to 0 (Disbled)
 
If you need information, please notify me.


Edited by Bart - 06 November 2008 at 6:52am
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 06 November 2008 at 5:29pm
Actually the email was not stopped at all, the message you see, "Whitelisted - Email size exceeded MaxMsgSizeForSpamFiltering", simply means that, since the email is over a certain minimum threshold size, most likely it is *not* spam, and thus it is being whitelisted for content and delivered.

The email is received successfully, and then SpamFilter asttempts to deliver it to your mail server. This is seen in the line:

1-04-08 20:30:30:218 -- (2568) Sending email from xxx@exxxx.nl to xxxxxx@tnxxxxxxxx.nl --

If you are not receiving it, it's possible that your mail server rejected it for some reason. You can verify by continuing looking at log entries below the above one, the relevant ones will have the ID (2568) in them, and will show if the forwarding attempt to your mail server was successful or resulted in an error.

In regards to the FTP, please note that the site is protected in that it allows you to upload files, but not download them. If you try to upload using Internet Explorer for example, rather than an real FTp client, your IE may cause an error as it will not be able to read the directory listing. If you can try to upload the file again using a regular FTp client (or command line) it should work.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Bart View Drop Down
Newbie
Newbie
Avatar

Joined: 20 August 2008
Location: Holland
Status: Offline
Points: 18
Post Options Post Options   Thanks (0) Thanks(0)   Quote Bart Quote  Post ReplyReply Direct Link To This Post Posted: 06 November 2008 at 6:48pm
i'm verry sorry to inform you that the problem wasn't spamfilterISP
 
sorry for your time, good thing is that i now know the 2568 Code so next time i search better myself and won't open a topic.
 
 
Back to Top
2CNL View Drop Down
Newbie
Newbie
Avatar

Joined: 09 May 2005
Location: Netherlands
Status: Offline
Points: 6
Post Options Post Options   Thanks (0) Thanks(0)   Quote 2CNL Quote  Post ReplyReply Direct Link To This Post Posted: 07 November 2008 at 2:50am
Bart, just out of interest. What caused the problem and what was the solution.
It always nice to follow up on a story. We can all learn ;)
Back to Top
Bart View Drop Down
Newbie
Newbie
Avatar

Joined: 20 August 2008
Location: Holland
Status: Offline
Points: 18
Post Options Post Options   Thanks (0) Thanks(0)   Quote Bart Quote  Post ReplyReply Direct Link To This Post Posted: 07 November 2008 at 7:20am
while moving the server running spamfilterISP to another datacenter mail was rerouted thru another server, this server was configured to drop mail over 2MB and therefor mail never arived at my exchange server.
 
In the time we tested spamfilterISP mail was deliverd directly and there where no problems at all.
 
I removed the temporarly rerouting and everything works just fine.
 
I don't know how i could be so stupid to not think about that but i can't turn back time :)
 
 
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.047 seconds.