My spam filter, some times, do this:

10/19/03 01:00:20:056 -- (243) Connection from: 200.161.254.80  -  Originating country : Brazil
10/19/03 01:00:20:216 -- (231) Connection from: 68.213.4.242  -  Originating country : United States
10/19/03 01:00:20:707 -- (243) Disconnect
10/19/03 01:00:21:798 -- (231) Disconnect
10/19/03 01:00:22:169 -- (252) Connection from: 62.248.116.139  -  Originating country : Turkey
10/19/03 01:00:22:730 -- (184) - MAPS search done... .
10/19/03 01:00:22:730 -- (184) RCPT TO: mailto:marinho@cpovo.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - marinho@cpovo.net accepted
10/19/03 01:00:23:791 -- (143) Connection from: 64.70.22.104  -  Originating country : United States
10/19/03 01:00:23:992 -- (143) Disconnect
10/19/03 01:00:24:642 -- (210) Connection from: 24.42.26.137  -  Originating country : Canada
10/19/03 01:00:25:013 -- (210) Disconnect
10/19/03 01:00:26:575 -- (190) Connection from: 200.158.106.62  -  Originating country : Brazil
10/19/03 01:00:26:856 -- (190) Disconnect
10/19/03 01:00:27:907 -- (252) Disconnect
10/19/03 01:00:28:198 -- (242) Connection from: 200.140.67.169  -  Originating country : Brazil
10/19/03 01:00:28:318 -- (220) Connection from: 200.141.184.133  -  Originating country : Brazil
10/19/03 01:00:28:358 -- (164) Connection from: 64.156.213.55  -  Originating country : United States
10/19/03 01:00:28:498 -- (220) Disconnect
10/19/03 01:00:28:558 -- (164) Disconnect
10/19/03 01:00:29:710 -- (219) Connection from: 146.82.38.127  -  Originating country : United States
10/19/03 01:00:30:601 -- (150) Disconnect
10/19/03 01:00:30:901 -- (184) Disconnect
10/19/03 01:00:31:873 -- (44) Connection from: 200.168.93.139  -  Originating country : Brazil
10/19/03 01:00:32:073 -- (242) Disconnect

The normal log is something like:

09/07/03 00:00:59:470 -- (182) Connection from: 196.28.20.65  -  Originating country : South Africa
09/07/03 00:01:00:652 -- (267) Disconnect
09/07/03 00:01:02:124 -- (281) Resolving 200.164.10.177 - Not found
09/07/03 00:01:02:124 -- (281) Mail from: mailto:reiser@ambra.ro" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - reiser@ambra.ro
09/07/03 00:01:02:595 -- (281) - MAPS search done... 521 ATENCAO !!! Sua mensagem foi bloqueada pelo nosso filtro Anti-Spam. Isto ocorreu porque o seu servidor de emails ( 200.164.10.177 ) foi inserido em uma lista internacional ANTI-SPAM ( dnsbl.njabl.org.), por ter sido usado para envio de spam ou estar configurado inadequadamente. Para liberar seu servidor, ENCAMINHE esta mensagem para < mailto:whitelist@cpovo.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - whitelist@cpovo.net > para que possamos verificar a situacao do mesmo. open proxy -- 1062884403 .
09/07/03 00:01:02:595 -- (281) 200.164.10.177 - Mail from: mailto:reiser@ambra.ro" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - reiser@ambra.ro To: mailto:lvh@cpovo.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - lvh@cpovo.net will be disconnected
09/07/03 00:01:02:595 -- (281) Disconnect
09/07/03 00:01:02:845 -- (144) Connection from: 4.4.115.138  -  Originating country : United States
09/07/03 00:01:03:095 -- (285) Connection from: 208.57.69.122  -  Originating country : United States
09/07/03 00:01:05:709 -- (147) Resolving 217.136.226.143 - 143.226-136-217.adsl-fix.skynet.be
09/07/03 00:01:05:709 -- (147) Mail from: mailto:millpointewestdog@betterthanhotmail.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - millpointewestdog@betterthanhotmail.com
09/07/03 00:01:05:709 -- (147) - MAPS search done... 521 ATENCAO !!! Sua mensagem foi bloqueada pelo nosso filtro Anti-Spam. Isto ocorreu porque o seu servidor de emails ( 217.136.226.143 ) foi inserido em uma lista internacional ANTI-SPAM ( bl.spamcop.net.), por ter sido usado para envio de spam ou estar configurado inadequadamente. Para liberar seu servidor, ENCAMINHE esta mensagem para < mailto:whitelist@cpovo.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - whitelist@cpovo.net > para que possamos verificar a situacao do mesmo.9Blocked - see http://spamcop.net/bl.shtml?217.136.226.143" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://spamcop.net/bl.shtml?217.136.226.143" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://spamcop.net/bl.shtml?217.136.226.143 .
09/07/03 00:01:05:709 -- (147) 217.136.226.143 - Mail from: mailto:millpointewestdog@betterthanhotmail.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - millpointewestdog@betterthanhotmail.com To: mailto:dreck@cpovo.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - dreck@cpovo.net will be disconnected
09/07/03 00:01:05:709 -- (147) Disconnect
09/07/03 00:01:06:200 -- (251) Connection from: 200.158.14.218  -  Originating country : Brazil
09/07/03 00:01:06:440 -- (251) Resolving 200.158.14.218 - 200-158-14-218.dsl.telesp.net.br
09/07/03 00:01:06:440 -- (251) Mail from: mailto:virtusbc3s000@bol.com.br" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - virtusbc3s000@bol.com.br
09/07/03 00:01:06:460 -- (144) Resolving 4.4.115.138 - wbar8.tampa1-4-4-115-138.tampa1.dsl-verizon.net

See the diference?

In the first case i have some problems in the mail delivery, then i restart the spamfilter, and he start to work fine!

Any idea?

thanks

Luciano,

Connection attempts followed by disconnects are normal, remote machines are checking to see if port 25 is open on your IP address. But your log shows more than a dozen in just a few seconds, and that does not look right. If you can either post or email us at mailto:support@logsat.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - support@logsat.com a full copy of the log so we can see if anything unusual happened prior to those entries we'll take a look. Please let us know what version of SpamFilter you are using.

Roberto F.
LogSat Software