Print Page | Close Window

SF shutting down for no reason..

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5307
Printed Date: 09 May 2025 at 8:32am


Topic: SF shutting down for no reason..
Posted By: Dan B
Subject: SF shutting down for no reason..
Date Posted: 12 August 2005 at 6:02pm

SF shutting down for no reason

 

Roberto,

 

Since July 28th when I put on the .475 SF has been shutting down on 3 of the 5 servers we have running for no reason. There is no rhyme or reason to the shutdowns. It can shut down anywhere after a few minutes to hours.  When it shuts down I quickly check the log file to see if it reports anything.  It doesn’t.  I do notice that the log file doesn’t show the latest activity.  It’s about 1 to 11/2 mins off of the current time that the system reports.  So I’m guessing that when SF shuts down whatever is in the buffer is lost.  I have the service set to restart automatically after 1 min if that service shuts down improperly.  Is there a setting to have the buffer write more often to see what’s going on.

 

The 3 servers that this is affecting are our heaviest usage domain.  I do know that all three do not shut down at the same time.  All 5 servers are using the same database server for quarantine and I have them balanced on 4 dns servers to resolve requests.  I haven’t tried reverting back to version 473 due to the few domains that we receive with "line break" in their TXT records.

Can you give me some suggestions?

 

Thanks,
Dan B

 


Replies:
Posted By: LogSat
Date Posted: 13 August 2005 at 6:59pm
Dan,

If the logs don't show anything, could you please try changing/addingthe following entry in the SpamFilter.ini under the [server settings] section:
RealtimeDiskLogging=1

This will cause the activity logto be flushed to disk in almost realtime. Hopefully this will provide more info on what is happening. In the meantime, can you please email us one of the logs anyhow, in case we're able to see something? Also, can you please check the SpamFilter\temp and SpamFilter\queue directories for any files that were left wen the service stopped? If there's any, we'd like to have a copy please, as they may help also.

If possible, can you check those directories after the service stops, and *before* SpamFilter reatarts?




-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Dan B
Date Posted: 13 August 2005 at 7:29pm

Roberto,

My logfiles are very very large.  I have zipped the temp and the logfiles directories.  The logfiles I included start from the 28th.  My zip file is 217MB.  Can you send me ftp info to upload this instead of sending it via email.  You can email directly to the email address that you have on file.

Thanks,

Dan

Posted By: Dan B
Date Posted: 15 August 2005 at 1:14pm

Roberto,

I have an update for you.. 

Above when I said that " I do know that all three do not shut down at the same time."  Most of the time that is wrong.  According to the temp files that remain.  98% of the time they all 3 shuw down at the same time or seconds apart..  It's only a few times that they do not.  I hope this helps.

Thanks,
Dan B

Posted By: Dan B
Date Posted: 17 August 2005 at 10:36pm

Roberto,

Status Update!

For some strange reason, today all 3 servers stopped shutting down automatically and they are working flawlessly again.  No changes have been made to the servers. Have you found anything in the log or the temp files that I sent you?

Thanks,
Dan

Posted By: Guests
Date Posted: 25 August 2005 at 6:12am

I reported to Roberto the same issue with shutdowns happening on our two spamfilters.  I monitor port 25 and when I don't get a response from the server for 60 seconds I restart the service.  If this happens again Dan, see if the spamfilter staps responding to port 25 before the service starts.

Regarding the random nature, I also have my server run for a long period without one problem then they start acting up again. My server share the same database also.

Please let me know if you find a solution.  I am running the ;atest beta version.

Dwight

 

 

 

Posted By: vrspock
Date Posted: 26 August 2005 at 12:00am
I have a similar issue with 2.6.3.473 and I have noticed a consistency in the logs.  The service doesn't shut down per say...but the spam filter desktop window becomes non-responsive and I end up rebooting the server to correct it.  Upon inspecting the log files, the logs have always stopped with the same message:

08/25/05 17:53:17:171 -- (3796) - EMail To is in honeypot emails -

The spamfilter has stopped responding on several occasions and this is always the last entry in the log files prior to it becoming unresponsive.

I should also note that telnetting into port 25 yeilds the standard banner repsonse...however, no email is passing through while spamfilter is in this state.

Posted By: Guests
Date Posted: 26 August 2005 at 1:02am

Roberto,
This is the erro in the Event log the occurs at the time of the lockup. The server ran fine until I logged in to the server, then SF froze. All the was displayed was the lower rh toolbar icon. The desktop window and icon were gone. When I went to stop the service it took 3 mins for it to stop and reported the following errors.

Hope this helps.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7011
Date:  8/25/2005
Time:  6:36:08 PM
User:  N/A
Computer: NONAME
Description:
Timeout (30000 milliseconds) waiting for a transaction response from the  service.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7011
Date:  8/25/2005
Time:  6:35:38 PM
User:  N/A
Computer: NONAME
Description:
Timeout (30000 milliseconds) waiting for a transaction response from the SpamFilter service.

Event Type: Error
Event Source: SpamFilterSvc.exe
Event Category: None
Event ID: 1
Date:  8/25/2005
Time:  6:33:32 PM
User:  N/A
Computer: NONAME
Description:
The description for Event ID ( 1 ) in Source ( SpamFilterSvc.exe ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: Access violation at address 00425515 in module 'SpamFilterSvc.exe'. Read of address 00000019.

Posted By: LogSat
Date Posted: 26 August 2005 at 10:57am
Everyone,

Thank you all for your reports and patience. While we have to date not been able to pinpoint the problem(s), we have located some possible "weak spots" in SpamFilter's source that could have been improved for stability. We have added further exception handling to several sections of our source.

A new build (2.6.3.479) is available as a pre-release in the registered user area. Please note that while on the surface nothing has changed, we did make relevant changes to the code, and thus more testing than usual will be required before this build is officially released.

The major changes from the previous pre-release are as follows.

// New to VersionNumber = '2.6.3.479';
{TODO -cFix : Added more exception handling code to try preventing crashes being reported}
{TODO -cFix : Fixed problem with SPF retrieving the HELO domain when the MAIL FROM is empty}
{TODO -cNew : Added the HELO host name to the email X-SF-HELO-Domain email header}


// New to VersionNumber = '2.6.3.478';
{TODO -cNew : More user-friendly functionality for the "Custom Domain Filters" grid when saving the current entry}
{TODO -cNew : DoNotAddIPToHoneypot list now works with :Hoenypot tags as well}
{TODO -cFix : The "Do not quarantine" option was not disconnecting the remote server immediately before receiving the email body, but was waiting till the end of message}
{TODO -cFix : Logfiles were missing entries from SPF logs and a few other events that were showing on activity screen. Bug introduced from build 461}



-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Guests
Date Posted: 01 September 2005 at 3:33pm

Roberto,

My frozen unresponsive GUI problem is now almost resolved with 2.6.3.481.  I was having to restart the spamfilter service up to 15 times a day when port 25 did not reply.  I used a server monitoring program called IPsentry for the tests and for restarting the service.  Now the service will run for days without a glitch.  

FYI: One thing I did notice was that the spamfilter starts up with the activity log tab displayed.  My server is very busy and there are a lot of screen writes. My system did run longer when left in the configuration tab display.  Could the activity screen writes add to the issue?  Should the service start with a less active display? I got the system to run longer by clicking on the config tab and then closing the GUI. 

 

Posted By: _Eric
Date Posted: 01 September 2005 at 4:20pm
and always make sure spamfilter is under service control from windows.... check services and action on failure.(recovery tab)

i always check restart - restart - reboot 1 day - 5 minutes.

the nature of the above problem was within spamfilter,
this is a hint only.

Posted By: LogSat
Date Posted: 01 September 2005 at 4:26pm
Dwight,

I'm *very* glad that this build is working out better. Would you mind zipping us one of your SpamFilter logs for this build for a day? We'd like to see if there are errors being caught by SpamFilter that could have caused your crashes in the past.

As far as the activity is concerned, we keep just a few thousand lines in the "scroll area" of the log display, and clear it up when it's over the limit, to use less resources. We'll do some more testing however to see if that could cause too much CPU usage on high loads.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window