Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - The SpamFilter service terminated unexpec
  FAQ FAQ  Forum Search   Register Register  Login Login

The SpamFilter service terminated unexpec

 Post Reply Post Reply
Author
sirrar View Drop Down
Groupie
Groupie
Avatar

Joined: 26 January 2005
Location: Denmark
Status: Offline
Points: 44
Post Options Post Options   Thanks (0) Thanks(0)   Quote sirrar Quote  Post ReplyReply Direct Link To This Post Topic: The SpamFilter service terminated unexpec
    Posted: 23 July 2007 at 10:07am

Hi

 

Yesterday evening spamfilter service stopped.

It has never done this before.

This is from my event viewer.

The SpamFilter service terminated unexpectedly. It has done this 1 time(s).

Whe you reply you can of course get the full logfile from yesterday.

running spamfilter 3.5.4.692 on Windows 2003 R2 Enterprise with SP2 againt SQL Server 2005 Enterprise with SP2. Have been running with these version since 3.5.4.692 was released.

 

Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 23 July 2007 at 11:26am

Torsten,

I have seen this occasionally and have the service set to automatically restart in the service recovery options.  That way, it simply restarts and I can later look at logs to attempt to see what nailed me.

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
quat.net View Drop Down
Newbie
Newbie


Joined: 24 July 2007
Location: Germany
Status: Offline
Points: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote quat.net Quote  Post ReplyReply Direct Link To This Post Posted: 24 July 2007 at 2:01am

Hi,

I have the same problem like Torsten.
From time to time the SpamFilter stops unexpectedly.
The service stops too but recovers, if restart is activated.

It looks like the SpamFilter have problems scanning .PDFs

here is the Log

07.22.07 01:21:55:328 -- (3712) - MAPS search done...
07.22.07 01:21:55:328 -- (3712) RCPT TO: XXX@porsche-wuppertal.de accepted
07.22.07 01:21:55:484 -- (844) Connection from: 84.58.144.96  -  Originating country : Germany
07.22.07 01:21:55:531 -- (3712) Scanning PDF for spam:12762082999752.pdf
07.22.07 01:21:55:671 -- (3712) Warning: error scanning image for spam - Access violation at address 004047A4 in module 'SpamFilterSvc.exe'. Read of address 00000218
07.22.07 01:21:55:671 -- (3712) Warning: error (1) scanning PDF for spam - Access violation at address 00405C17 in module 'SpamFilterSvc.exe'. Read of address 00000218
07.22.07 11:53:37:843 -- SpamFilter ISP v3.5.4.692 Listening on 195.210.48.201:25,
07.22.07 11:53:37:843 -- (8784) Found new domain in tbl_LocalDomains: SFI. Creating new FilterObject
07.22.07 11:53:37:843 -- (8784) Detected differences in file timestamps - forcing DB export
07.22.07 11:53:37:843 -- (8784) Reloading filter.ini: domains\SFI\Filters.ini
07.22.07 11:53:37:968 -- (8784) Reloading file for tblBL_Domains: BlackDomain

I have tried another hardware and OSs but it happens again and again.
Even the lastest SpamFilter (.697) makes problems.

Any ideas ??

Franky 

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 24 July 2007 at 4:11pm
Franky,

The error you reported in red above should have been addressed in build 3.5.4.697 (please see following release notes). If you can post the errors relative to that latest build we'll be able to see if there's a different issue you are experiencing.

// New to VersionNumber = '3.5.4.697';
{TODO -cNew : PDF image filter now scans, in addition to content type "application/pdf", also "application/x-pdf"}
{TODO -cNew : The keywords filter now also scans for text contained within PDF attachments}
{TODO -cNew : In SFE, a new table "tbl_logindomains" is added and a new field is added to the tbl_logins to prepare for the new ASP-based web interface for SFE}
{TODO -cFix : Exception occurred during DumpLog: Cannot open file "nnnnnnn.log". The process cannot access the file because it is being used by another process}
{TODO -cFix : Spam emails with multiple recipients, where one of them caused a match in the AutoWhiteListedForceDelivery, were not split correctly and were delivered to every recipient instead of just the whitelisted one}
{TODO -cFix : Warning: error (1) scanning PDF for spam - Access violation at address 005BEEED in module 'SpamFilterSvc.exe'}
{TODO -cFix : Exception occurred during TTerminateIdleThreads.Execute: Invalid floating point operation}
{TODO -cFix : Exception occurred during TTerminateIdleThreads.Execute: Access violation at address 0040A753 in module 'SpamFilterSvc.exe'}

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
jerbo128 View Drop Down
Senior Member
Senior Member
Avatar

Joined: 06 March 2006
Status: Offline
Points: 178
Post Options Post Options   Thanks (0) Thanks(0)   Quote jerbo128 Quote  Post ReplyReply Direct Link To This Post Posted: 24 July 2007 at 6:13pm

I have also had this issue of the service shutting down.  Now running SFE 697.  Has happened 3-4 times.  Not enough for me to squeel about, but thought I'd mentioin it now so you can tally.

Smile

 

Back to Top
sgeorge View Drop Down
Senior Member
Senior Member


Joined: 23 August 2005
Status: Offline
Points: 178
Post Options Post Options   Thanks (0) Thanks(0)   Quote sgeorge Quote  Post ReplyReply Direct Link To This Post Posted: 25 July 2007 at 1:04am
jerbo, if you too could post some of the errors generated after your upgrade to the 697, it sounds like that's what Roberto's looking for.

Stephen
Back to Top
jerbo128 View Drop Down
Senior Member
Senior Member
Avatar

Joined: 06 March 2006
Status: Offline
Points: 178
Post Options Post Options   Thanks (0) Thanks(0)   Quote jerbo128 Quote  Post ReplyReply Direct Link To This Post Posted: 25 July 2007 at 9:01am

Here's the logfile from the thread that failed and caused the restart.  I did omit other threads in between.  Let me know if you need more of the logfile.

Running SFE .697
I do have the option turned on to receive full message body, even when message is determined to be spam.

07/24/07 08:45:37:140 -- (3460) Connection from: 82.159.35.62  -  Originating country : Spain
07/24/07 08:45:37:828 -- (3460) - IP address is from a blacklisted country...
07/24/07 08:45:37:828 -- (3460) 82.159.35.62 - Mail from: wqafo@joneswardlaw.com To: smaxine@domain.us will be rejected
07/24/07 08:45:39:375 -- (3460) Exception occurred during RECEIVEMESSAGE: ( 1) Access violation at address 00405CA8 in module 'SpamFilterSvc.exe'. Read of address 0009C2EF --
07/24/07 08:46:51:828 -- SpamFilter ISP v3.5.4.697 Listening on 192.168.0.6:25

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 25 July 2007 at 10:42pm
jerbo128,

On the line:

07/24/07 08:45:39:375 -- (3460) Exception occurred during RECEIVEMESSAGE: ( 1) Access violation at address 00405CA8 in module 'SpamFilterSvc.exe'. Read of address 0009C2EF --

Is that actually all there is in the log? In theory there should be more "stuff" after the two dashes... If so, could you please post that as well?
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
quat.net View Drop Down
Newbie
Newbie


Joined: 24 July 2007
Location: Germany
Status: Offline
Points: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote quat.net Quote  Post ReplyReply Direct Link To This Post Posted: 26 July 2007 at 1:49pm

Opps... it happens again...

First I thought my SF is running fine after upgrading to .697,
but from time to time it is crashing down. 40-100 times a day.

The service automaticly is restarting after a few seconds.
but while restarting the service, mails a running in the backupMX
and this is just a simple mailrelay without SF.
So a few dozend spams are slipping through it.

Here is one part of the logs

07.26.07 18:05:06:885 -- (6184) Connection from: 193.174.9.254  -  Originating country : Germany
07.26.07 18:05:07:026 -- (6184) Resolving 193.174.9.254 - mailout10.fw.porsche.de
07.26.07 18:05:07:417 -- (6184) Mail from: porsche.financial@porsche.de
07.26.07 18:05:07:932 -- (6184) - MAPS search done...
07.26.07 18:05:07:932 -- (6184) RCPT TO: dirk.brincks@porsche-essen.de accepted
07.26.07 18:05:08:089 -- (6184) Scanning PDF for spam:response.pdf
07.26.07 18:05:08:182 -- (6184) Warning: error (1) scanning PDF for spam - Unexpected PDF object encountered
07.26.07 18:05:08:182 -- (6184) Warning: error scanning image for spam - Access violation at address 004047A4 in module 'SpamFilter.exe'. Read of address 00000108
07.26.07 18:05:08:198 -- (6184) Warning - Message exceeds MaxMsgSizeForKeywordScan, skipping statistical scan
07.26.07 18:05:08:198 -- (6184) Checking SURBL
07.26.07 18:05:08:198 -- (6184) EMail from porsche.financial@porsche.de to dirk.brincks@porsche-essen.de passes Bayesian filter - 0% spam  (0ms)
07.26.07 18:05:08:386 -- (6184) Start virus scan
07.26.07 18:05:08:417 -- (6184) Starting queueing procedures
07.26.07 18:05:08:432 -- (6184) EMail from porsche.financial@porsche.de to dirk.brincks@porsche-essen.de was queued. Size: 89 KB, 91136 bytes
07.26.07 18:05:08:448 -- (6184) Disconnect
Disconnecting: 84.125.69.169
07.26.07 18:06:12:466 -- SpamFilter ISP v3.5.4.697 Listening on 195.210.48.201:25,
07.26.07 18:06:12:466 -- (2908) Found new domain in tbl_LocalDomains: SFI. Creating new FilterObject
....

This happens whiles scanning PDFs but not all PDFs.
Maybe there is a bug in SF or the PDFs ?? 

I have set the SpamPDFMaxPixelHeight from 800 to 1600
but now the most mails with PDF are running in quarantine
and that is  because there are 300-500/hour good mails
with PDFs running in quarantine.

Setting size to 800 SF is crashing more often, to 1600 there
is to much PDF in quarantine. Now I set it to 1200... tomorrow I
know if this is better...

have a nice day

Franky

QUAT.NET GmbH
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 26 July 2007 at 8:32pm
Franky,

If you can please zip and email us the entire logfile for SpamFilter we'll be able to find out with more certainty what is happening. It does appear that there is however a problem from your section of log, possibly with certain formats of PDFs. Currently the only way to disable the PDF image filter is to disable the entire image filter in SpamFilter. We'll create a new build shortly that will allow to disable the PDF image filter independently from the image filter.

If you are able to forward us one of the emails containing the PDF that is appearing to cause this problem, we'll be able to find immediately if there is indeed a bug, and if so, patch it right away. If for example you are able to retrieve the email from porsche.financial@porsche.de to dirk.brincks@porsche-essen.de above, that should contain the PDF attachment in question.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
quat.net View Drop Down
Newbie
Newbie


Joined: 24 July 2007
Location: Germany
Status: Offline
Points: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote quat.net Quote  Post ReplyReply Direct Link To This Post Posted: 27 July 2007 at 4:38pm

Hi Roberto,

Logs are in your FTP-box.
Im sorry, but I cannot give you customers PDFs
because security reason.

Have a nice weekend.
Franky

QUAT.NET GmbH
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.211 seconds.