I met with a problem with long mail timeout (probably). We have a hw firewall with antivirus in front of spamfilter. Sometimes - probably long mails - the connection is disconnected after 60 seconds and the mail is not received. I think it could be done by the AV feature of firewall - it must receive the whole message before scanning.

Is there anz settings for connection timeout ?

Thanks.

Jan

There is a part of log:

06.07.04 15:24:45:593 -- (4216) Connection from: 62.209.229.236  -  Originating country : Czech Republic
06.07.04 15:24:46:109 -- (4216) Resolving 62.209.229.236 - mail.protherm.cz
06.07.04 15:24:46:109 -- (4216) Mail from: XXXX
06.07.04 15:24:46:671 -- (4216) - MAPS search done...
06.07.04 15:24:46:671 -- (4216) RCPT TO: AAAAAAAAAA accepted

Another connections here............

06.07.04 15:25:46:671 -- (4216) Disconnect

Jan,

In SpamFilter ISP there should be the following setting in the SpamFilter.ini file :

;Force disconnect of sessions after they have remained connected fro this long
IdleDisconnectMinutesTimeout=15

Can you check to ensure it is not set to 1 (60 seconds) as it appears that this is the interval that causes the disconnect? If it's at a higher value (recommended), it would seem at first sight that SpamFilter is not the issue. Have you double-checked your AV and firewall settings/logs?

The above name is misleading, as it is not an "idle" timeout, but rather a "max connected" time. If any SMTP server is remaining connected for more than those "n" number of minutes, for whatever reason, they will be disconnected. This was done to prevent abuse of your system by mass mailers.

SpamFilter has a "command" timeout as well, meaning that if no SMTP commands have been received in the last 60 seconds the remote host will be disconnected. This is not configurable right now.

Roberto F.
LogSat Software

Yes, it seems the reason is command timeout. I used debug mode of SF and I learned this:

FW+AV works as SMTP proxy. It receives incoming port 25 request and passes it to SF. I saw the initial communication is succesfully done - MAIL FROM and RCPT TO. The message itself must be received by FW as a whole to perform AV check. During time of receiving data there is the connection to SF opened but without any communication. If the mail is large enough (2-3 MB+) no data will flow in 60 sec to SF and the connection is dropped.

So, is it possible to make "command timeout" setable ? In case of yes, how fast? We are running without SMTP AV protection now.

Thanks.

Jan,

We've just released the new official build 2.0.1.357 tonite. However if you log in the registered user are you'll be able to download pre-release build 358. This latter build contains a new SpamFilter.ini parameter in the [server settings] section:

ReadTimeout=60

It is what you ask for, a timeout for the reception of commands from the remote server, after which SpamFilter disconnects when none are received.

You can either manually add that value to the ini file, or run the new build 358 once, and click on "Save Settings". This will cause the new parameter to be written to the ini file with the default value of 60 (seconds). Close SpamFilter, edit the ini file changing the value as you wish, then restart.

Please note that this change was made specifically to solve your issue today, and has not been tested thoroughly. Please let us know if it works out for you.

Roberto F.
LogSat Software

Hi,

it is great, version 358 is functional. The 60 seconds barrier is overcomed. Thank you for your quick response.

Jan.