Print Page | Close Window

autowhitelistforcedelivery.txt file weird entries

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7130
Printed Date: 22 November 2017 at 4:15am


Topic: autowhitelistforcedelivery.txt file weird entries
Posted By: Terry
Subject: autowhitelistforcedelivery.txt file weird entries
Date Posted: 23 November 2015 at 10:38am
Our autowhitelistforcedelivery file appears to continue to get corrupted after the latest spamfilter upgrade...not sure what is going on here but these kind of entries continue to show up...
 

਍     ㄀㐀挀戀㔀 ㄀搀昀 攀ⴀ㜀㈀ 戀㘀㘀昀㐀ⴀ愀㌀㤀挀ⴀ㐀㄀愀 ⴀ愀㤀挀㌀ⴀ㘀㄀㤀戀搀㔀㠀㐀㈀㤀㈀攀ⴀ      䀀甀猀ⴀ眀攀猀琀ⴀ㈀⸀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀搀攀愀渀⸀渀漀爀氀椀渀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍     ㄀㐀搀㤀㈀㘀㌀㈀㘀搀㄀ⴀ攀 愀愀㤀挀愀愀ⴀ戀㐀㄀㜀ⴀ㐀㜀㔀㤀ⴀ㠀挀愀昀ⴀ㐀愀搀㄀㠀昀搀昀愀 ㄀㄀ⴀ      䀀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀樀攀爀爀礀⸀洀挀挀愀爀琀栀礀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍     ㄀㐀攀㈀戀㜀㔀㄀ 㜀㔀ⴀ搀㤀戀戀㐀攀㌀㈀ⴀ㘀㄀昀㤀ⴀ㐀㜀攀㌀ⴀ㤀挀㘀愀ⴀ搀㐀㠀㈀㌀㔀㄀㄀㔀㌀昀㌀ⴀ      䀀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀氀椀猀攀⸀栀愀爀眀椀渀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍     ㄀㐀昀㌀搀㜀 愀 㜀㠀ⴀ搀㜀㔀戀愀 戀㤀ⴀ愀㈀㤀 ⴀ㐀㠀搀挀ⴀ㤀㤀㐀㘀ⴀ挀㤀戀㜀㔀㄀㔀㜀㔀挀㘀㈀ⴀ      䀀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀猀琀攀瘀攀⸀栀愀爀氀攀礀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍     ㄀㐀㘀㘀愀㐀戀㠀㈀戀 ⴀ挀搀㘀愀㤀㜀挀㜀ⴀ㌀㄀攀㐀ⴀ㐀㐀㤀 ⴀ㠀 ㄀㘀ⴀ㤀㔀愀㐀㄀昀愀㄀㤀㠀昀㔀ⴀ      䀀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀洀椀挀栀愀攀氀⸀栀甀最最椀渀猀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍     ㄀㐀㜀挀㘀㘀㌀㈀愀攀搀ⴀ戀昀㘀㌀㄀㈀㄀㌀ⴀ㠀昀㜀攀ⴀ㐀 㐀㌀ⴀ㠀 搀㤀ⴀ㜀㐀昀㌀㘀挀 挀㐀㤀昀㔀ⴀ      䀀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀愀渀搀爀攀愀⸀猀攀最攀爀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍     ㄀㔀 㜀㔀㜀㌀㠀㐀戀㜀ⴀ攀戀挀㌀㄀㈀㈀攀ⴀ 㘀攀㈀ⴀ㐀㘀昀㠀ⴀ㠀㄀㘀 ⴀ㄀㤀昀愀㘀挀㄀愀攀愀戀昀ⴀ      䀀愀洀愀稀漀渀猀攀猀⸀挀漀洀簀瀀愀琀琀椀⸀猀挀栀洀椀搀琀ⴀ猀栀漀瘀攀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍  㔀ⴀ欀瀀猀ⴀ㈀㈀㔀⸀ ⸀㄀㐀㘀㔀 ⸀ ⸀ ⸀㜀㔀㔀㘀⸀㜀⸀㐀㐀㘀㌀㌀㈀㔀ⴀ ⴀ㔀㘀㘀䀀挀漀渀渀攀挀琀⸀最爀漀瘀漀⸀挀漀洀簀洀愀渀甀攀氀愀⸀洀愀爀挀甀氀攀猀挀甀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍㄀ 㐀攀㌀攀㌀㌀㜀氀愀礀昀漀瘀挀椀愀㌀渀焀㜀㔀椀愀愀愀愀愀戀礀挀搀礀愀栀搀椀㈀漀戀瀀㐀礀愀愀愀愀愀䀀昀爀攀搀洀攀礀攀爀洀愀椀氀⸀挀漀洀簀戀椀氀氀⸀猀挀栀洀椀搀琀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍ 㔀 ⴀ甀眀琀ⴀ㠀㠀㠀⸀ ⸀㐀㌀㤀㄀㜀⸀ ⸀ ⸀㈀㄀㄀㈀ ⸀㜀⸀㐀㜀㤀㘀 㘀㄀䀀瀀漀琀漀洀愀挀㄀ 㔀 ⸀洀欀琀漀洀愀椀氀⸀挀漀洀簀樀愀猀漀渀⸀氀攀攀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍ 㜀㌀ⴀ猀昀焀ⴀ㈀ ㄀⸀ ⸀㈀㤀㔀㄀⸀ ⸀ ⸀㈀㈀㘀㔀⸀㜀⸀㄀ 㘀㜀㤀㈀㜀䀀攀洀ⴀ猀樀ⴀ㜀㜀⸀洀欀琀漀洀愀椀氀⸀挀漀洀簀礀椀欀眀椀渀最⸀猀栀甀洀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍ 㠀㤀ⴀ稀猀攀ⴀ㠀㔀㜀⸀ ⸀㜀㔀㘀㠀⸀ ⸀ ⸀㜀㐀㄀㘀⸀㜀⸀㐀㈀ 㐀㠀



Replies:
Posted By: LogSat
Date Posted: 23 November 2015 at 11:45am
Terry, can you please let us know if you're using SpamFilter Enterprise or the ISP standard edition?

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Terry
Date Posted: 23 November 2015 at 1:09pm
We are on Standard Edition


Posted By: LogSat
Date Posted: 23 November 2015 at 4:36pm
Terry,

If you know the latest date for which you know for certain that the autowhitelistforcedelivery file was fine, could you please zip and provide to us all of SpamFilter's activity logfiles starting from the day before the above date up until today? By going thru the activity logfiles one-by-one from before the file became corrupted until it does become corrupted hopefully will allow us to find out when the problem occurred and why.

If you are unsure of a date when the autowhitelistforcedelivery file was fine, then let's try by collecting the last 30 days of activity logs.

I'll send you via a PM a link of where you can upload the zip to us. If you prefer that we download the file from your website we can of course do that as well.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Terry
Date Posted: 23 November 2015 at 7:34pm
we are going to try to restore the whitelist to before the upgrade (about Oct 31 timeframe) and see if it stabilizes...at this time new entries are not getting correctly made..at least that is what it looks like..


Posted By: Terry
Date Posted: 24 November 2015 at 8:53am
Okay...here is what we have to date...yesterday we restored the contents of the autowhitelistforcedelivery file from before the upgrade...we copied the contents over the contents of the existing file.  at that time it looked okay and for at least an hour it stayed okay...this morning it is unreadable again
਍㄀ 戀㈀昀㠀㄀搀㄀氀愀礀昀漀瘀挀椀愀㌀洀樀栀搀椀愀愀愀愀愀挀昀漀瘀樀搀栀搀椀最㌀㜀砀焀礀愀愀愀愀愀䀀椀渀昀漀⸀挀漀洀攀渀椀琀礀⸀渀攀琀簀猀甀猀愀渀⸀栀愀渀最愀爀琀渀攀爀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍ 眀瀀琀漀㐀樀㤀瀀漀搀樀㔀漀最漀昀猀搀攀爀洀攀猀戀㄀瀀搀挀最㤀ⴀ戀䀀戀漀甀渀挀攀⸀戀爀漀渀琀漀⸀挀漀洀簀爀愀昀愀攀氀⸀挀愀渀挀椀漀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍ 㐀㈀ⴀ挀樀栀ⴀ㔀㔀㐀⸀ ⸀㄀㤀㠀㠀㔀⸀ ⸀ ⸀㄀㜀㈀㔀 ⸀㜀⸀㔀  ㌀㜀㔀 䀀攀洀ⴀ猀樀ⴀ㜀㜀⸀洀欀琀漀洀愀椀氀⸀挀漀洀簀琀栀攀爀攀猀愀⸀洀愀猀猀攀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍ 㜀㌀ⴀ猀昀焀ⴀ㈀ ㄀⸀ ⸀㈀㤀㔀㄀⸀ ⸀ ⸀㈀㈀㘀㔀⸀㜀⸀㄀ 㘀㜀㤀㈀㜀䀀攀洀ⴀ猀樀ⴀ㜀㜀⸀洀欀琀漀洀愀椀氀⸀挀漀洀簀礀椀欀眀椀渀最⸀猀栀甀洀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍㄀㄀ 㠀㜀㔀㘀㄀⸀㄀㌀㘀㔀㜀 㔀䀀攀㈀洀愀⸀渀攀琀簀搀眀椀最栀琀⸀氀攀椀猀氀攀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍ 㠀㤀ⴀ稀猀攀ⴀ㠀㔀㜀⸀ ⸀㘀㌀㜀㔀⸀ ⸀ ⸀㔀㜀㔀 ⸀㜀⸀㄀㘀㌀㔀㄀㈀㄀䀀攀洀ⴀ猀樀ⴀ㜀㜀⸀洀欀琀漀洀愀椀氀⸀挀漀洀簀搀攀瘀漀渀⸀眀攀戀猀琀攀爀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
਍㄀ ㄀㤀㐀 ⴀ爀㌀ⴀ㌀㐀㄀㈀㌀䀀爀攀琀甀爀渀⸀猀愀氀攀猀渀攀砀甀猀⸀挀漀洀簀爀椀挀栀愀爀搀⸀眀栀攀攀氀攀爀䀀瀀漀爀琀漀昀瀀漀爀琀氀愀渀搀⸀挀漀洀ഀഀ
mailto:*@1-st.com|ryan.admiral@portofportland.com" rel="nofollow - *@1-st.com|ryan.admiral@portofportland.com
mailto:*@aircargonewscom.b.topica.com|rick.aizawa@portofportland.com" rel="nofollow - *@aircargonewscom.b.topica.com|rick.aizawa@portofportland.com
mailto:*@alerts.bounces.google.com|alex.lauber@portofportland.com" rel="nofollow - *@alerts.bounces.google.com|alex.lauber@portofportland.com


Posted By: LogSat
Date Posted: 24 November 2015 at 9:22am
That was a very quick corruption! Could you please zip us both of SpamFilter's logfiles for yesterday and today, along with the original autowhitelistforcedelivery that you had restored yesterday?

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Terry
Date Posted: 24 November 2015 at 12:49pm
the upload site does not appear to work for me...


Posted By: LogSat
Date Posted: 24 November 2015 at 1:00pm
Did you receive any specific errors? I just re-tried the link I sent you via PM and it seems to work fine. If you'd like for me to pickup the files from your website, or a dropbox/skydrive etc location we can do that too.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Terry
Date Posted: 24 November 2015 at 3:05pm
after I type the password in I get a basic white screen...one of the buttons on the top says add to your cloud...when I click that nothing happens


Posted By: LogSat
Date Posted: 24 November 2015 at 3:55pm
I was able to duplicate the problem with two different browsers - we took the website down and are upgrading it, but it will take a few hours to complete.

If the zip are smaller than 10MB you can email them to us at support at logsat dot com. If not, I've just activated our FTP site at:
ftp.logsat.com
username: LogSatUser
password: the same password I sent you for the upload site

I apologize for the issues!


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Terry
Date Posted: 25 November 2015 at 12:23pm
I cannot connect through ftp either


Posted By: LogSat
Date Posted: 25 November 2015 at 1:31pm
The FTP site is protected by only allowing uploads - it does not allow neither downloads not directory listings. Can you please try to use an actual FTP program, and not a browser-based FTP client like Internet Explorer?

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Terry
Date Posted: 25 November 2015 at 4:55pm
finally got through our work network with ftp://ftp...the" rel="nofollow - ftp...the file name is 20151123.zip


Posted By: LogSat
Date Posted: 25 November 2015 at 5:17pm
Received - thank you. We'll start looking at the logs shortly.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: LogSat
Date Posted: 26 November 2015 at 4:12am
Terry,

It looks as if the autowhitelist file is being locked by another process while SpamFilter is trying to write to it, which causes it to become corrupted. Here is what we found.

These partial logs show the times when that file is being reloaded, along with its size.:

11/23/15 12:09:19:334 -- (257103168) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (1427336 bytes)
11/23/15 13:23:20:350 -- (257103168) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (1427538 bytes)
11/23/15 13:55:20:791 -- (248137824) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (1428490 bytes)
11/23/15 13:58:20:831 -- (130939120) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (1428668 bytes)
11/23/15 14:16:50:961 -- (119332528) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152750 bytes)
11/23/15 14:16:51:351 -- (134384064) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2151990 bytes)
11/23/15 14:25:56:930 -- (119660208) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2151990 bytes)
11/23/15 14:26:57:973 -- (144532064) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152278 bytes)


As you can see, the line in red suddenly shows a huge increase in the AutoWhiteListForceDelivery.txt size, which tells us that the corruption occurred shortly before the entry in red. Looking further in the logs, we then see this errors:

11/23/15 14:12:00:862 -- (247981504) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:info99@service.govdelivery.com|bill.xxxxxxxx@xxxxxxxxxx.com
11/23/15 14:12:01:003 -- (247981504) Exception occurred during TFilterObject.AddToFile (7): Cannot create file "d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt". The process cannot access the file because it is being used by another process 
11/23/15 14:12:01:034 -- (247981504) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:brad@shop.bradsdeals.com|bill.xxxxxxxx@xxxxxxxxxx.com
11/23/15 14:12:01:159 -- (247981504) Exception occurred during TFilterObject.AddToFile (7): Cannot create file "d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt". The process cannot access the file because it is being used by another process
11/23/15 14:12:01:502 -- (247981504) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:bounces+911411-7cb6-bill.xxxxxxxx=xxxxxxxxxx.com@delivery.klaviyomail.com|bill.xxxxxxxx@xxxxxxxxxx.com
11/23/15 14:12:01:596 -- (247981504) Exception occurred during TFilterObject.AddToFile (7): Cannot create file "d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt". The process cannot access the file because it is being used by another process
11/23/15 14:12:01:658 -- (247981504) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:email@responsewise.com|bill.xxxxxxxx@xxxxxxxxxx.com
11/23/15 14:12:01:752 -- (247981504) Exception occurred during TFilterObject.AddToFile (7): Cannot create file "d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt". The process cannot access the file because it is being used by another process

The error in bold show us what most likely happened. Is there anything that can be locking that file? Backups, antivirus, etc?




-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Terry
Date Posted: 26 November 2015 at 9:52am
I am not sure about what could lock it...we probably opened it with notepad to look at it but our understanding is that process will not lock a file...I will see about excluding these directories from antivirus and see if that makes a difference.  I have now set the file back to good contents again and will watch it closely.  Thank you for the help on this.


Posted By: Terry
Date Posted: 27 November 2015 at 12:33pm
turned off antivirus yesterday...stopped the spamfilter service...replaced the autowhitelist file with a good one...this morning it was bad again...looked in the log files for yesterday and today and could find no instances of the messages you found before about files in use...


Posted By: LogSat
Date Posted: 27 November 2015 at 1:21pm
Could you please send us both yesterday's and today's logfiles (using the FTP site) so we can check again?

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Terry
Date Posted: 27 November 2015 at 5:10pm
tried ftp and cloud uploads to no avail...went ahead and emailed files to you since they were less than 8mb


Posted By: LogSat
Date Posted: 28 November 2015 at 11:26am
Terry,

Are you certain there is nothing else interfering with that autowhitelist text file? As you said, there are no more sharing errors in the new logs, but there are still unexplained entries.

SpamFilter will automatically add to that file a new line every time a user forces the delivery of a quarantined email out of the database. This means that the AutoWhiteListForceDelivery.txt file should always increase in size, never shrink. Yet, if you look at the file size that is being logged when SpamFilter reloads the file, you can see how the size sometimes increases and sometimes decreases:

11/26/15 04:00:49:581 -- (130920416) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2237633 bytes)
11/26/15 04:01:49:329 -- (130315792) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2220886 bytes)
11/26/15 06:00:12:879 -- (118719776) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2220886 bytes)
11/26/15 06:30:25:993 -- (121079072) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152750 bytes)
11/26/15 06:30:26:492 -- (136509120) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2151990 bytes)
11/26/15 07:34:27:936 -- (137372816) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152858 bytes)
11/26/15 17:25:36:018 -- (186592832) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152962 bytes)
11/27/15 04:00:44:670 -- (252549760) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2153172 bytes)
11/27/15 04:01:44:605 -- (137164816) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2183844 bytes)
11/27/15 06:00:15:441 -- (118588704) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2183844 bytes)
11/27/15 07:02:17:342 -- (131300320) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2184036 bytes)
11/27/15 07:03:39:149 -- (119964960) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152750 bytes)
11/27/15 07:03:39:617 -- (134780672) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2151990 bytes)
11/27/15 07:32:40:580 -- (134780672) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152122 bytes)
11/27/15 09:28:42:154 -- (193144368) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152256 bytes)
11/27/15 09:29:42:214 -- (189912352) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152376 bytes)


While we can't discard SpamFilter having issues when the file becomes corrupted (or if SpamFilter itself is corrupting the file), what points to an external application making changes to the file is the following.

SpamFilter will log whenever it adds an entry to the AutoWhiteListForceDelivery.txt file, and will log another entry when it reloads that file if it has been modified within the last 60 seconds.

In this list, you can see that while there are several instances where SpamFilter has added an entry to the AutoWhiteListForceDelivery.txt file and then reloaded it, there are also several entries where that file was detected as having been modified without any traces of SpamFilter having added entries to it. I've marked all those reloads caused by an external factor in red, and the reloads caused by SpamFilter having added one or more entries to that file in blue

11/26/15 04:00:49:409 -- (130920416) Notice - List had duplicate entries. Fixed: d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt
11/26/15 04:00:49:581 -- (130920416) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2237633 bytes)
11/26/15 04:01:49:329 -- (130315792) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2220886 bytes)
11/26/15 06:00:12:879 -- (118719776) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2220886 bytes)
11/26/15 06:30:25:837 -- (121079072) Notice - List had duplicate entries. Fixed: d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt
11/26/15 06:30:25:993 -- (121079072) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152750 bytes)
11/26/15 06:30:26:492 -- (136509120) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2151990 bytes)
11/26/15 07:34:25:518 -- (137372528) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:bounce-mc.us5_11718631.2979697-jessica.hxxxxxxx=pnnnnnnnnnnnn.com@mail8.atl111.rsgsv.net|jessica.hxxxxxxx@pnnnnnnnnnnnn.com
11/26/15 07:34:25:674 -- (137372528) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:bounced@paperlesspost.com|jessica.hxxxxxxx@pnnnnnnnnnnnn.com
11/26/15 07:34:25:736 -- (137372528) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:bounced@paperlesspost.com|jessica.hxxxxxxx@pnnnnnnnnnnnn.com
11/26/15 07:34:25:799 -- (137372528) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:bounce-md_30237331.5654ac7e.v1-e09dfd8601ee40a0b89f44287b68b21c@mandrillapp.com|jessica.hxxxxxxx@pnnnnnnnnnnnn.com
11/26/15 07:34:26:017 -- (137372528) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:bounce-mc.us8_31569859.1410113-jessica.hxxxxxxx=pnnnnnnnnnnnn.com@mail196.suw12.mcsv.net|jessica.hxxxxxxx@pnnnnnnnnnnnn.com
11/26/15 07:34:26:345 -- (137372528) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:deals@ifly.alaskaair.com|jessica.hxxxxxxx@pnnnnnnnnnnnn.com
11/26/15 07:34:27:936 -- (137372816) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152858 bytes)
11/26/15 17:24:45:053 -- (186594704) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:orders@dsw.com|susan.hxxxxxxx@pnnnnnnnnnnnn.com
11/26/15 17:25:36:018 -- (186592832) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152962 bytes)

11/27/15 04:00:44:514 -- (252549760) Notice - List had duplicate entries. Fixed: d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt
11/27/15 04:00:44:670 -- (252549760) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2153172 bytes)
11/27/15 04:01:44:605 -- (137164816) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2183844 bytes)
11/27/15 06:00:15:441 -- (118588704) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2183844 bytes)
11/27/15 07:02:10:930 -- (131284336) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:bounce-anon-jeff.exxxxxxx=pnnnnnnnnnnnn.com@craigslist.org|jeff.exxxxxxx@pnnnnnnnnnnnn.com
11/27/15 07:02:17:342 -- (131300320) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2184036 bytes)
11/27/15 07:03:38:993 -- (119964960) Notice - List had duplicate entries. Fixed: d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt
11/27/15 07:03:39:149 -- (119964960) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152750 bytes)
11/27/15 07:03:39:617 -- (134780672) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2151990 bytes)
11/27/15 07:31:40:379 -- (139072864) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:delivery@ao.techproductupdate.com|terry.cxxxx@pnnnnnnnnnnnn.com
11/27/15 07:32:40:580 -- (134780672) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152122 bytes)
11/27/15 09:28:40:454 -- (189912640) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:support@bounce.vitalsmarts.com|robert.axxxxxxxx@pnnnnnnnnnnnn.com
11/27/15 09:28:42:154 -- (193144368) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152256 bytes)
11/27/15 09:28:45:524 -- (247828400) Adding to d:\program files\spamfilter\domains\SFI\AutoWhiteListForceDelivery.txt:mailer@infusionmail.com|robert.axxxxxxxx@pnnnnnnnnnnnn.com
11/27/15 09:29:42:214 -- (189912352) Reloading file for tblWL_AutoWhiteListForceDelivery: domains\SFI\AutoWhiteListForceDelivery.txt (2152376 bytes)
11/27/15 10:22:27:772 -- (135871552) Email Subject: autowhitelistforcedelivery.txt file weird entries


Note that on both the 26th and the 27th at 4:00AM, 4:01AM and at 6:00AM SpamFilter logs multiple reloads of the AutoWhiteListForceDelivery.txt at almost the same time as it detected changes in that file's timestamp. On the 27th there are additional reloads at 7:03AM unrelated to SpamFilter having added an entry.

Can you think of anything that may be happening on that server (or more specifically to that file) that causes it to change? Do you have any automated process or database process that is writing to it? 


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Terry
Date Posted: 28 November 2015 at 12:16pm
we do have one process that runs at 4am that we can shut off...it was designed to fix whitelist entries that are from all the "bounce" messages and consolidate them to "*" wildcard entries...that would reduce the size of the file and I guess could be causing a problem....at 6 am we really don't do anything that I know of to the whitelist...we do some greylist work where we append your  daily entries to our greylist file.  I will shutdown the whitelist task and see if that stops the problem...thank you for your research...


Posted By: Terry
Date Posted: 01 December 2015 at 8:36am
it appears that our custom 4am consolidation process was causing the problem.  Changing the format to utf16 really whacked us on several items...I think we are past the problems now however...



Print Page | Close Window