Re: [Assp-test] Failure to start: assp 2.3.4 build 13229 and 13233.
Hi all, Crypt::GOST works for me: ASSP version 2.3.4(13229) Perl 5.12.4 built for amd64-freebsd-thread-multi Perl 5.14.2 built for amd64-freebsd-thread-multi Mike Hi all, is there anyone running assp 2.3.4_13229 or higher, on any Perl version between 5.10.0 and 5.15.X - having installed Crypt::GOST ? Please make a short post if so. If you use any of the above Perl versions and you want to upgrade to 2.3.4_13229 or higher - don't install Crypt::GOST - there are required some more test's on that. The XS (C) code of the module Crypt::GOST contains special hacks for this Perl versions and it is possible that these are not working on all platforms. CPAN shows no problem at all, but who knows?! I've checked Crypt::GOST on Perl 5.12.4 , 5.14.2 and 5.16.3 on Windows - without any issue. Thomas Von:James Brown jlbr...@bordo.com.au An: ASSP development mailing list assp-test@lists.sourceforge.net, Datum: 21.08.2013 08:36 Betreff:Re: [Assp-test] Antwort: Failure to start: assp 2.3.4 build 13229 and 13233. On 21 Aug 2013, at 4:19 pm, Thomas Eckardt thomas.ecka...@thockar.com wrote: James, has you installed Crypt::GOST ? Thomas Yes: cpan[8] install Crypt::GOST Reading '/Users/jlbrown/.cpan/sources/authors/01mailrc.txt.gz' DONE Reading '/Users/jlbrown/.cpan/sources/modules/02packages.details.txt.gz' Database was generated on Mon, 29 Jul 2013 17:07:56 GMT DONE Reading '/Users/jlbrown/.cpan/sources/modules/03modlist.data.gz' Unchanged. Writing /Users/jlbrown/.cpan/Metadata Crypt::GOST is up to date (1.00). James. -- Introducing Performance Central, a new site from SourceForge and AppDynamics. Performance Central is your source for news, insights, analysis and resources for efficient Application Performance Management. Visit us today! http://pubads.g.doubleclick.net/gampad/clk?id=48897511iu=/4140/ostg.clktrk ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test -- Introducing Performance Central, a new site from SourceForge and AppDynamics. Performance Central is your source for news, insights, analysis and resources for efficient Application Performance Management. Visit us today! http://pubads.g.doubleclick.net/gampad/clk?id=48897511iu=/4140/ostg.clktrk ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] fixes in assp 2.2.2 build 13080:
Hi Thomas, Configuration Synchronization and Sharing didn't work after upgrade to build 13080. There are a lot of errors in the maillog (Share Master): Mar-22-13 00:03:53 [Worker_1] SyncCFG: unable to send config for BlockReportFile to 10.0.0.11:225 - Requested action aborted: local error in processing Mar-22-13 00:04:29 [Worker_1] SyncCFG: unable to send config for BlockReportFile to 10.0.0.11:225 - Requested action aborted: local error in processing Mar-22-13 00:04:59 [Worker_1] SyncCFG: unable to send config for BlockReportFile to 10.0.0.11:225 - Requested action aborted: local error in processing ... Mar-22-13 14:38:01 [Worker_1] SyncCFG: unable to send config for whiteListedDomains to 10.0.0.11:225 - Requested action aborted: local error in processing Mar-22-13 14:38:31 [Worker_1] SyncCFG: unable to send config for whiteListedDomains to 10.0.0.11:225 - Requested action aborted: local error in processing Mar-22-13 14:39:01 [Worker_1] SyncCFG: unable to send config for whiteListedDomains to 10.0.0.11:225 - Requested action aborted: local error in processing On the Share Slave: Mar-22-13 00:03:53 [Worker_2] 10.0.0.10 [SMTP Status] 451 Requested action aborted: local error in processing Mar-22-13 00:04:29 [Worker_2] 10.0.0.10 [SMTP Status] 451 Requested action aborted: local error in processing Mar-22-13 00:04:59 [Worker_3] 10.0.0.10 [SMTP Status] 451 Requested action aborted: local error in processing ... Mar-22-13 14:38:01 [Worker_1] 10.0.0.10 [SMTP Status] 451 Requested action aborted: local error in processing Mar-22-13 14:38:31 [Worker_1] 10.0.0.10 [SMTP Status] 451 Requested action aborted: local error in processing Mar-22-13 14:39:01 [Worker_2] 10.0.0.10 [SMTP Status] 451 Requested action aborted: local error in processing Mike. Hi all, fixed in assp 2.2.2 build 13080: - some address/domain/ip matchings were no longer working since 13055 - in some cases resent files contained no valid recipient - so the resend was failing - under crash conditions it was possible that information in the 'assp_sync.cfg' were lost - the latest Net::DNS has caused exeptions in several features - under certain conditions it was possible that the rebuild spamdb thread caused an unexpected crash while reloading the configuration - on some systems (OS + PerlVersion) calls to 'MIME::QuotedPrint::encode' caused an exception changed: - if a SMTP reply condition '5xx...' was reached, assp has sent this reply, followed by a '421 transmission closed' the additional reply '421...' is no longer sent to keep the state of permanent errors Thomas -- Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_mar ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] fixes in assp 2.2.2 build 12359
Hi Thomas, Thank you very much for the new version! There is no problem during last ~2 hours, except these messages in maillog.txt: Dec-24-12 13:45:32 [Worker_1] Database select statement failed in AdminUsers(exists): MySQL server has gone away Dec-24-12 13:45:32 [Worker_1] Database select statement failed in AdminUsersRight(exists): MySQL server has gone away Dec-24-12 13:47:41 [Worker_1] Database select statement failed in AdminUsers(exists): MySQL server has gone away Dec-24-12 13:47:41 [Worker_1] Database select statement failed in AdminUsersRight(exists): MySQL server has gone away Dec-24-12 13:49:50 [Worker_1] Database select statement failed in AdminUsers(exists): MySQL server has gone away Dec-24-12 13:49:50 [Worker_1] Database select statement failed in AdminUsersRight(exists): MySQL server has gone away Dec-24-12 13:51:59 [Worker_1] Database select statement failed in AdminUsers(exists): MySQL server has gone away Dec-24-12 13:51:59 [Worker_1] Database select statement failed in AdminUsersRight(exists): MySQL server has gone away Dec-24-12 13:54:08 [Worker_1] Database select statement failed in AdminUsers(exists): MySQL server has gone away Dec-24-12 13:54:08 [Worker_1] Database select statement failed in AdminUsersRight(exists): MySQL server has gone away Dec-24-12 13:56:17 [Worker_1] Database select statement failed in AdminUsers(exists): MySQL server has gone away Dec-24-12 13:56:17 [Worker_1] Database select statement failed in AdminUsersRight(exists): MySQL server has gone away Dec-24-12 13:58:26 [Worker_1] Database select statement failed in AdminUsers(exists): MySQL server has gone away Dec-24-12 13:58:26 [Worker_1] Database select statement failed in AdminUsersRight(exists): MySQL server has gone away Dec-24-12 14:00:35 [Worker_1] Database select statement failed in AdminUsers(exists): MySQL server has gone away Dec-24-12 14:00:35 [Worker_1] Database select statement failed in AdminUsersRight(exists): MySQL server has gone away Mike. Hi all, fixed in assp 2.2.2 build 12359: - some no longer required code is removed added: - the hidden variable 'enableLockIPBox' is added (default is 1) to be able to switch off the IP-LockBox (see 12357 - 12358) Thomas -- LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial Remotely access PCs and mobile devices and provide instant support Improve your efficiency, and focus on delivering more value-add services Discover what IT Professionals Know. Rescue delivers http://p.sf.net/sfu/logmein_12329d2d ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] Multiple Connection Lockups again
Hi Colin, what are your versions of Perl and OS? Because I have the same problem under FreeBSD 8.x - 9.x amd64, for any Perl 5.10, 5.12.4, 5.14.2. Mike. I recall that this setting changed recently, but since then I have been having ASSP crash on me and each time it seems to be due to 2 similar connections being handled by two workers at the same time. I have the following in lib/CorrectASSPCfg.pm $main::delaySameIPorHelo = 5; main::mlog(0,info: delaySameIPorHelo set to 5); $main::delaySameIP = 5; main::mlog(0,info: delaySameIP set to 5); Which one should I remove as I can't remember which is the old one? Would having both in lead to the fix being negated or is something not working as it should? All the best, Colin Waring. -- Got visibility? Most devs has no idea what their production app looks like. Find out how fast your code is with AppDynamics Lite. http://ad.doubleclick.net/clk;262219671;13503038;y? http://info.appdynamics.com/FreeJavaPerformanceDownload.html ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] Multiple Connection Lockups again
I run Ubuntu 12.04 LTS with perl v5.14.2 Is your Ubuntu i386 or amd64? Mike. The only thing I haven't done in the last few months is update perl modules which I have just done through CPAN. All the best, Colin Waring. On 21/09/2012 08:44, Michael M Galapchuk wrote: Hi Colin, what are your versions of Perl and OS? Because I have the same problem under FreeBSD 8.x - 9.x amd64, for any Perl 5.10, 5.12.4, 5.14.2. Mike. I recall that this setting changed recently, but since then I have been having ASSP crash on me and each time it seems to be due to 2 similar connections being handled by two workers at the same time. I have the following in lib/CorrectASSPCfg.pm $main::delaySameIPorHelo = 5; main::mlog(0,info: delaySameIPorHelo set to 5); $main::delaySameIP = 5; main::mlog(0,info: delaySameIP set to 5); Which one should I remove as I can't remember which is the old one? Would having both in lead to the fix being negated or is something not working as it should? All the best, Colin Waring. -- Got visibility? Most devs has no idea what their production app looks like. Find out how fast your code is with AppDynamics Lite. http://ad.doubleclick.net/clk;262219671;13503038;y? http://info.appdynamics.com/FreeJavaPerformanceDownload.html ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] Multiple Connection Lockups again
Thank you, Colin. So we have in common only UNIX system, and it seems that neither Perl version nor running x64 could be reason for ASSP crash due to same connections at the same time. Mike. GNU/Linux 3.2.0-26-virtual i686 Previous discussions revealed that running x64 used twice the amount of memory for no real benefit. All the best, Colin. On 21/09/2012 09:35, Michael M Galapchuk wrote: I run Ubuntu 12.04 LTS with perl v5.14.2 Is your Ubuntu i386 or amd64? Mike. The only thing I haven't done in the last few months is update perl modules which I have just done through CPAN. All the best, Colin Waring. On 21/09/2012 08:44, Michael M Galapchuk wrote: Hi Colin, what are your versions of Perl and OS? Because I have the same problem under FreeBSD 8.x - 9.x amd64, for any Perl 5.10, 5.12.4, 5.14.2. Mike. I recall that this setting changed recently, but since then I have been having ASSP crash on me and each time it seems to be due to 2 similar connections being handled by two workers at the same time. I have the following in lib/CorrectASSPCfg.pm $main::delaySameIPorHelo = 5; main::mlog(0,info: delaySameIPorHelo set to 5); $main::delaySameIP = 5; main::mlog(0,info: delaySameIP set to 5); Which one should I remove as I can't remember which is the old one? Would having both in lead to the fix being negated or is something not working as it should? All the best, Colin Waring. -- Got visibility? Most devs has no idea what their production app looks like. Find out how fast your code is with AppDynamics Lite. http://ad.doubleclick.net/clk;262219671;13503038;y? http://info.appdynamics.com/FreeJavaPerformanceDownload.html ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] fixes in assp 2.2.2 build 12242
Hi Thomas, after upgrading to 12242 I'm getting this error at startup: Aug-30-12 10:51:09 [startup] AdminInfo: error - unable to resolve IP for hostname '10' in configuration of 'noDelay' There is in an original nodelay.txt: 127.0.0.1 # Of course we don't want to delay ourselves or local users 192.168 # Don't delay our private networks either 10 # Private net (class A) Mike. fixed in assp 2.2.2 build 12242: - If a hostname was defined in an IP-list and the hostname was starting with [a-f] - the hostip was not resolved. - Removing all entries related to an email address (u...@domain.com,*) from the Whitelist was not working in every case. - Depending on the used OS, Perl-version, LIBC/GLIBC - the rebuildspamdb task has not produced a Hidden-Markov-Model, because the internal HMM module has detected that it is running in a wrong environment. This behavior has started with version 2.2.2 build 12149 changed: - The DoDomainIP check is skipped, if the sending domain/ip are validated by the SPF check as 'pass'. -- Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] fixes in assp 2.2.2 build 12242
Hi Fritz, could you look at http://assp.cvs.sourceforge.net/viewvc/assp/assp2/files/nodelay.txt?revision=1.1, please? Mike. ASSP development mailing list assp-test@lists.sourceforge.net schrei bt: There is in an original nodelay.txt: 127.0.0.1 # Of course we don't want to delay ourselves or local users 192.168 # Don't delay our private networks either 10 # Private net (class A) The original nodelay.tx contains: 127.0.0.1 # Of course we don't want to delay ourselves or local users 192.168. # Don't delay our private networks either 10. # Private net (class A) -- Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] fixes in assp 2.2.2 build 12214
Hi Thomas,
thank you for the new features!
Could you look at a new assp-mrtg.cfg and ASSP-MIB, please?
It seems that some target descriptions (for message scoring statistics)
are missed in the assp-mrtg.cfg.
For example:
#
#
#
Target[*asspName*.currentScoredHMM]:
currentScoredHMM.0currentScoredHMM.0:*community*@*systemip*: * 12
MaxBytes[*asspName*.currentScoredHMM]: 250
Title[*asspName*.currentScoredHMM]: ASSP Analysis for *asspName* --
*systemname*
#
#
#
Target[*asspName*.currentScoredSIZE]:
currentScoredSIZE.0currentScoredSIZE.0:*community*@*systemip*: * 12
MaxBytes[*asspName*.currentScoredSIZE]: 250
Title[*asspName*.currentScoredSIZE]: ASSP Analysis for *asspName* --
*systemname*
^^
And there are different OID-Names in ASSP-MIB:
ScoredHMM OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
::= { 25}
ScoredSIZE OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
::= { 39}
and so on.
Thanks.
Mike.
fixed in assp 2.2.2 build 12214:
- The scoring statisic is no longer dynamicaly build - so it could be
stated via SNMP.
- An new 'assp-mrtg.cfg' MRTG example file is published and required for
this build and higher if you want to
stat assp via MRTG-SNMP.
- An new file ASSP-MIB is published - it is required for MRTG-SNMP-Stats
and if assp will be configured via SNMP.
Notice that some of the OID's has been changed - crosscheck your SNMP
application configuration against the new
MIB file if you work with OID's, SNMP-OID-Names are not changed.
Thomas
--
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
___
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] fixes in assp 2.2.2 build 12145:
Hi Steve, That entry with any value crashes perl on my box with a memory error... Win2k8r2 Perl 5.014002 Assp 2.2.2(12145) Latest CorrectASSPcfg.pm With that entry in CorrectASSPcfg.pm $main::delaySameIPorHelo = 3; assp is worked without any error... FreeBSD8.2 Perl 5.012004 Assp 2.2.2(12145) Mike -Original Message- From: Thomas Eckardt [mailto:thomas.ecka...@thockar.com] Sent: Thursday, May 24, 2012 7:33 AM To: ASSP development mailing list Subject: [Assp-test] fixes in assp 2.2.2 build 12145: Hi all, fixed in assp 2.2.2 build 12145: - workers were restarted or assp was dieing if the same mail from the same IP was delivered in two or more different threads at exactly the same time because it is really difficult to reproduce this mistake - this is the first try to solve this problem For those of you, who gets attacked by spammers with such mails - there is a hardcoded workaround available. $delaySameIPorHelo = 0; # number 0 - prevents accessing same storage for identical connections at the same time To prevent assp from dieing on this problem, set this variable at the commandline or in the module CorrectASSPcfg.pm to a value of between 2 and 5. Indentical IP's and/or HELO's will be delayed in processing for this number of seconds. Notice that this workaround could (will) be removed at any time, if this issue is no longer reported. - the internal handling of the DNS query handling is improved - the import of the Spamdb and/or HMMdb from the rebuildspamdb thread (10001) has shown a wrong remaining time in the log Thomas -- Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] Unexpected shutdown of ASSP - perl exited on signal 10/signal 11 (core dumped)
Hi Thomas, for a long time (from build 12003 to build 12131) I tried to catch the problem, which caused unexpected shutdown of ASSP. I think I found the reasons, that lead to crash of ASSP: - the same incoming E-mails from the same sender are sent from different IPs to the different recipients simultaneously. Could you please look at the attached crash1.txt and crash2.txt. Thanks for any suggestions. Mike. - maillog.txt: ... May-17-12 15:19:19 m1-57158-05955 [Worker_3] 209.85.213.45 s...@exx.com.ua to: olesya.g...@fcxxx.com.ua DKIM-Signature found May-17-12 15:19:19 m1-57158-05955 [Worker_3] 209.85.213.45 s...@exx.com.ua to: olesya.g...@fcxxx.com.ua Message-Score: added -15 (pbwValencePB) for In Penalty White Box, total score for this message is now -15 May-17-12 15:19:19 m1-57158-05955 [Worker_3] 209.85.213.45 s...@exx.com.ua to: olesya.g...@fcxxx.com.ua Message-Score: added -5 for 209.85.213 in griplist (0.00), total score for this message is now -20 May-17-12 15:19:19 m1-57158-05955 [Worker_3] 209.85.213.45 s...@exx.com.ua to: olesya.g...@fcxxx.com.ua [scoring] SPF: none ip=209.85.213.45 mailfrom=s...@exx.com.ua helo=mail-yw0-f45.google.com May-17-12 15:19:19 m1-57158-29168 [Worker_4] 209.85.161.173 s...@exx.com.ua to: oleg.s...@fcxxx.com.ua DKIM-Signature found May-17-12 15:19:19 m1-57158-29168 [Worker_4] 209.85.161.173 s...@exx.com.ua to: oleg.s...@fcxxx.com.ua Message-Score: added -15 (pbwValencePB) for In Penalty White Box, total score for this message is now -15 May-17-12 15:19:19 m1-57158-29168 [Worker_4] 209.85.161.173 s...@exx.com.ua to: oleg.s...@fcxxx.com.ua Message-Score: added -5 for 209.85.161 in griplist (0.00), total score for this message is now -20 May-17-12 15:19:19 m1-57158-29168 [Worker_4] 209.85.161.173 s...@exx.com.ua to: oleg.s...@fcxxx.com.ua [scoring] SPF: none ip=209.85.161.173 mailfrom=s...@exx.com.ua helo=mail-gg0-f173.google.com ... ASSP crashed - /var/log/messages May 17 15:19:42 assp.host kernel: pid 21550 (perl), uid 0: exited on signal 10 (core dumped) - maillog.txt: ... May-17-12 15:20:02 [startup] Starting in console mode May-17-12 15:20:04 [startup] ASSP-professional version 2.1.2(12131) (Perl 5.012004) (on freebsd) initializing ... May-17-12 15:20:11 [init] Warning: unclean shutdown of ASSP detected - maillog.txt: ... May-16-12 12:19:37 m1-59976-31335 [Worker_7] 98.129.4.76 mail...@em-sm5-128.mktroute.com to: yuriy.g...@fcxxx.com.ua DKIM-Signature found May-16-12 12:19:37 m1-59976-31335 [Worker_7] 98.129.4.76 mail...@em-sm5-128.mktroute.com to: yuriy.g...@fcxxx.com.ua Message-Score: added -10 (spfpValencePB) for SPF pass, total score for this message is now -10 May-16-12 12:19:37 m1-59976-31335 [Worker_7] [BlackHELO] 98.129.4.76 mail...@em-sm5-128.mktroute.com to: yuriy.g...@fcxxx.com.ua [scoring] (blacklisted HELO 'em-sm5-77.mktroute.com' - weigth 1) May-16-12 12:19:37 m1-59976-31335 [Worker_7] 98.129.4.76 mail...@em-sm5-128.mktroute.com to: yuriy.g...@fcxxx.com.ua Message-Score: added 20 for blacklisted HELO 'em-sm5-77.mktroute.com' - weigth 1, total score for this message is now 10 May-16-12 12:19:37 m1-59976-23695 [Worker_8] 98.129.4.77 mail...@em-sm5-128.mktroute.com to: elena@fcxxx.com.ua DKIM-Signature found May-16-12 12:19:37 m1-59976-23695 [Worker_8] 98.129.4.77 mail...@em-sm5-128.mktroute.com to: elena@fcxxx.com.ua Message-Score: added -10 (spfpValencePB) for SPF pass, total score for this message is now -10 ... ASSP crashed - /var/log/messages May 16 12:20:13 assp.host kernel: pid 34000 (perl), uid 0: exited on signal 11 (core dumped) - maillog.txt: ... May-16-12 12:21:02 [startup] Starting in console mode May-16-12 12:21:04 [startup] ASSP-professional version 2.1.2(12131) (Perl 5.012004) (on freebsd) initializing ... May-16-12 12:21:12 [init] Warning: unclean shutdown of ASSP detected -- Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] fixes in assp 2.1.2 build 12067
Hi Thomas, fixed in assp 2.1.2 build 12067: - fixes a possible division by zero error in sub 'BayesHMMProb' - fixes a possible SQL 'NULL' query error - reduces the time used for the 'Generating weighted Bayesian tuplets' rebuild task if 'ReplaceOldSpamdb' is set and a DB is used for spamdb I confirm that perl process is crashed by Rebuildspamdb version 3.31 started in ASSP version 2.1.2(12067) even for first 100-200 mails in errors/spam. Mike. -- Virtualization Cloud Management Using Capacity Planning Cloud computing makes use of virtualization - but cloud computing also focuses on allowing computing to be delivered as a service. http://www.accelacomm.com/jaw/sfnl/114/51521223/ ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] fixes in assp 2.1.2 build 12057:
Hi Thomas, changed: - new ASSP-MIB and mrtg config file are released With ASSP-MIB (20120226Z) and assp-mrtg.cfg (revision 1.6 by thockar, Sun Feb 26 18:33:01 2012 UTC) and ASSP Version 2.1.2(12057) we have some SNMP errors: Error status: noSuchName for the following OIDs: OID: 1.3.6.1.4.1.37058.2.4.1.44.0 OID: 1.3.6.1.4.1.37058.2.4.1.58.0 OID: 1.3.6.1.4.1.37058.2.4.1.67.0 OID: 1.3.6.1.4.1.37058.2.4.1.69.0 OID: 1.3.6.1.4.1.37058.2.4.1.78.0 OID: 1.3.6.1.4.1.37058.2.4.1.88.0 OID: 1.3.6.1.4.1.37058.2.4.1.96.0 respective human readable names: currentmxaMissing currentrcptDelayed currentrcptRelayRejected currentrcptReportHam currentrcptUnchecked currentsmtpConnDenied currentsmtpConnSSL It seems that some OIDs slipped for current stat values in 1.3.6.1.4.1.37058.2.4.1.X. Could you please look at this and update the ASSP-MIB once more? Thanks in advance. Mike. -- Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-d2d ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] Antwort: Re: new SNMP files for build 11350
Hi Thomas, new MIB done With ASSP-MIB (revision 20120214Z) and assp-mrtg.cfg (revision 1.5 from Dec 16 17:36:33 2011 UTC) and ASSP Version 2.1.2(12042) we have some SNMP errors: SNMP Error Received SNMP response with error code Error status: noSuchName for the following OIDs: index 2 (OID: 1.3.6.1.4.1.37058.2.4.1.44.0) index 2 (OID: 1.3.6.1.4.1.37058.2.4.1.58.0) index 2 (OID: 1.3.6.1.4.1.37058.2.4.1.67.0) index 2 (OID: 1.3.6.1.4.1.37058.2.4.1.69.0) index 2 (OID: 1.3.6.1.4.1.37058.2.4.1.78.0) index 2 (OID: 1.3.6.1.4.1.37058.2.4.1.88.0) index 2 (OID: 1.3.6.1.4.1.37058.2.4.1.96.0) SNMPGET Problem for currentmxaMissing.0 SNMPGET Problem for currentrcptDelayed.0 SNMPGET Problem for currentrcptRelayRejected.0 SNMPGET Problem for currentrcptReportHam.0 SNMPGET Problem for currentrcptUnchecked.0 SNMPGET Problem for currentsmtpConnDenied.0 SNMPGET Problem for currentsmtpConnSSL.0 Thanks in advance. Mike. Von:Michael M Galapchuk michael.galapc...@fcbank.com.ua An: ASSP development mailing list assp-test@lists.sourceforge.net Datum: 17.02.2012 16:17 Betreff:Re: [Assp-test] new SNMP files for build 11350 Hi Thomas, Could you please update SNMP files for current version of ASSP? Thanks in advance. Mike. Hi all, Note for those of you, who are using the SNMP feature. Because the stats are changed and new config parameters are available in build 11350, both files 'ASSP-MIB' and 'assp-mrtg.cfg' are updated ! Thomas -- Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-d2d ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] new SNMP files for build 11350
Hi Thomas, Could you please update SNMP files for current version of ASSP? Thanks in advance. Mike. Hi all, Note for those of you, who are using the SNMP feature. Because the stats are changed and new config parameters are available in build 11350, both files 'ASSP-MIB' and 'assp-mrtg.cfg' are updated ! Thomas -- Virtualization Cloud Management Using Capacity Planning Cloud computing makes use of virtualization - but cloud computing also focuses on allowing computing to be delivered as a service. http://www.accelacomm.com/jaw/sfnl/114/51521223/ ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] Problems with charset settings in report file after build 12030
Hi Thomas, ability to define any MIME-header lines in report file was introduced in 2.1.2 build 11354. But now, we have got some encoding problems in reports after upgrade ASSP from 2.1.2(12003) to 2.1.2(12031). Report file is created under GUI, and seems to be in UTF-8. Included MIME-header: Content-Type: text/plain; charset=UTF-8 May I supply additional information? Thanks in advance. Mike. -- Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-d2d ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] Question about WhitelistOnly feature
Hi Thomas, I have a favour to ask of you. Is there any way to set Reject All But Whitelisted Mail (WhitelistOnly) for particular list of local users? ASSP Version: 2.1.2(12003). Thanks in advance. Mike. -- Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex infrastructure or vast IT resources to deliver seamless, secure access to virtual desktops. With this all-in-one solution, easily deploy virtual desktops for less than the cost of PCs and save 60% on VDI infrastructure costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] Antwort: Problems with Forward The Blockreportrequest to other ASSP
Hi Thomas, The sending IP has to be in acceptAllMail We added sending IP (10.0.0.10) on the slave ASSP in acceptAllMail. BlockReportRequests and requests to resend blocked mail are processed now, but something still seems to be wrong here. Let's see the maillog. BlockReportRequest on the master ASSP: Dec-27-11 17:57:46 m1-01466-13823 [Worker_5] 10.7.240.30 x...@fcxxx.com.ua info: found message size announcement: 1.93 kByte Dec-27-11 17:57:46 m1-01466-13823 [Worker_5] 10.7.240.30 x...@fcxxx.com.ua to: asspblock@assp.local blocked email report Dec-27-11 17:57:47 [Worker_5] Info: queued blocked mail request from x...@fcxxx.com.ua Dec-27-11 17:57:50 [Worker_1] Info: processing queued blocked mail request from x...@fcxxx.com.ua and forwarded BlockReportRequest on the slave ASSP: Dec-27-11 17:57:47 m1-01467-11454 [Worker_2] 10.0.0.10 x...@fcxxx.com.ua to: asspblock@assp.local blocked email report Dec-27-11 17:57:47 [Worker_2] Info: queued blocked mail request from x...@fcxxx.com.ua Dec-27-11 17:57:47 m1-01467-02333 [Worker_2] 10.0.0.10 [SMTP Error] 500 unrecognized command Dec-27-11 17:57:48 [Worker_1] Info: processing queued blocked mail request from x...@fcxxx.com.ua Though SMTP Error is here, we received ASSP-Block-Report from the slave ASSP. Next, we requested to resend blocked mail from the slave ASSP. Request on the master ASSP: Dec-27-11 17:59:48 m1-01588-03288 [Worker_1] 10.7.240.30 x...@fcxxx.com.ua info: found message size announcement: 2.57 kByte Dec-27-11 17:59:48 m1-01588-03288 [Worker_1] 10.7.240.30 x...@fcxxx.com.ua to: RSBM_spamx2FXxD0Xx9BXxD1Xx83XxD1Xx87XxD1Xx88XxD0XxB8XxD0XxB5Xx5FXxD1Xx80XxD0XxB5XxD0XxB7XxD1Xx83XxD0XxBBXxD1Xx8CXxD1Xx82XxD0XxB0XxD1Xx82XxD1Xx8BXx5FXxD1Xx83Xx5FXxD0XxBDXxD0XxB0XxD1Xx81Xx2DXx2DX16291.eml@assp.local blocked email report Dec-27-11 17:59:48 [Worker_1] Info: queued blocked mail request from x...@fcxxx.com.ua Dec-27-11 17:59:50 [Worker_1] Info: processing queued blocked mail request from x...@fcxxx.com.ua and forwarded request on the slave ASSP: Dec-27-11 17:59:49 m1-01589-10178 [Worker_2] 10.0.0.10 x...@fcxxx.com.ua to: RSBM_spamx2FXxD0Xx9BXxD1Xx83XxD1Xx87XxD1Xx88XxD0XxB8XxD0XxB5Xx5FXxD1Xx80XxD0XxB5XxD0XxB7XxD1Xx83XxD0XxBBXxD1Xx8CXxD1Xx82XxD0XxB0XxD1Xx82XxD1Xx8BXx5FXxD1Xx83Xx5FXxD0XxBDXxD0XxB0XxD1Xx81Xx2DXx2DX16291.eml@assp.local blocked email report Dec-27-11 17:59:49 [Worker_2] Info: queued blocked mail request from x...@fcxxx.com.ua Dec-27-11 17:59:49 m1-01589-00333 [Worker_2] 10.0.0.10 [SMTP Error] 500 unrecognized command Dec-27-11 17:59:51 [Worker_1] Info: processing queued blocked mail request from x...@fcxxx.com.ua Dec-27-11 17:59:51 m1-01591-04349 [Worker_3] 10.0.0.10 x...@fcxxx.com.ua to: RSBM_spamx2FXxD0Xx9BXxD1Xx83XxD1Xx87XxD1Xx88XxD0XxB8XxD0XxB5Xx5FXxD1Xx80XxD0XxB5XxD0XxB7XxD1Xx83XxD0XxBBXxD1Xx8CXxD1Xx82XxD0XxB0XxD1Xx82XxD1Xx8BXx5FXxD1Xx83Xx5FXxD0XxBDXxD0XxB0XxD1Xx81Xx2DXx2DX16291.eml@assp.local blocked email report Dec-27-11 17:59:51 [Worker_3] Info: queued blocked mail request from x...@fcxxx.com.ua Dec-27-11 17:59:51 m1-01591-09836 [Worker_3] 10.0.0.10 [SMTP Error] 500 unrecognized command Dec-27-11 17:59:56 [Worker_1] Info: processing queued blocked mail request from x...@fcxxx.com.ua Dec-27-11 17:59:56 [Worker_1] Error: unable open /usr/local/share/assp/spam/п⌡я┐я┤я┬п╦п╣_я─п╣пЇя┐п╩я▄я┌п╟я┌я▀_я┐_пҐп╟я│--16291.eml Dec-27-11 17:59:56 [Worker_1] Info: successful sent file /usr/local/share/assp/resendmail/п⌡я┐я┤я┬п╦п╣_я─п╣пЇя┐п╩я▄я┌п╟я┌я▀_я┐_пҐп╟я│--16291.eml to 127.0.0.1:125 (smtpDestination) - Message sent We received resendmail (...16291.eml) from the slave ASSP, but also we received message about failed request: Subject: failed - request ASSP to resend blocked mail The requested email-file spam/Лучшие_результаты_Сѓ_нас--16291.eml no longer exists on ASSP-host mx2.fcxxx.com.ua. Please contact your email adminstrator, if you need more information. Maybe it happen because of SMTP Error? May I supply additional information? Thanks in advance. Mike. Hi Thomas, We have two ASSP (10.0.0.10 as master and 10.0.0.11 as slave) and have been using Block Reporting. Directly sended BlockReportRequests are processed correctly on both ASSP. But when we used BlockRepForwHost feature on the master ASSP, then forwarded requests are blocked on the slave ASSP as InvalidLocalSender (Spoofing Sender in Local Domain): Dec-27-11 15:15:22 m1-91722-14308 [Worker_3] [InvalidLocalSender] 10.0.0.10 x...@fcxxx.com.ua [spam found] Spoofing Sender in Local Domain Dec-27-11 15:15:22 m1-91722-14308 [Worker_3] 10.0.0.10 x...@fcxxx.com.ua [SMTP Error] 554 5.7.1 Spoofing Sender in Local Domain . Dec-27-11 15:15:22 m1-91722-14308 [Worker_3] 10.0.0.10 x...@fcxxx.com.ua [SMTP Status] 451 4.7.1 Please try again later If we added IP 10.0.0.10 on the slave ASSP in allowRelayCon or in noSpoofingCheckIP, then we have other error: Dec-27-11 15:25:50 m1-94148-07049 [Worker_7]
[Assp-test] Problems with Forward The Blockreportrequest to other ASSP
Hi Thomas, We have two ASSP (10.0.0.10 as master and 10.0.0.11 as slave) and have been using Block Reporting. Directly sended BlockReportRequests are processed correctly on both ASSP. But when we used BlockRepForwHost feature on the master ASSP, then forwarded requests are blocked on the slave ASSP as InvalidLocalSender (Spoofing Sender in Local Domain): Dec-27-11 15:15:22 m1-91722-14308 [Worker_3] [InvalidLocalSender] 10.0.0.10 x...@fcxxx.com.ua [spam found] Spoofing Sender in Local Domain Dec-27-11 15:15:22 m1-91722-14308 [Worker_3] 10.0.0.10 x...@fcxxx.com.ua [SMTP Error] 554 5.7.1 Spoofing Sender in Local Domain . Dec-27-11 15:15:22 m1-91722-14308 [Worker_3] 10.0.0.10 x...@fcxxx.com.ua [SMTP Status] 451 4.7.1 Please try again later If we added IP 10.0.0.10 on the slave ASSP in allowRelayCon or in noSpoofingCheckIP, then we have other error: Dec-27-11 15:25:50 m1-94148-07049 [Worker_7] 10.0.0.10 x...@fcxxx.com.ua no recipients left -- dropping connection Dec-27-11 15:25:50 m1-94148-07049 [Worker_7] 10.0.0.10 x...@fcxxx.com.ua Message-Score: added 5 for invalid address asspblock@assp.local, total score for this message is now 15 Dec-27-11 15:25:50 m1-94148-07049 [Worker_7] 10.0.0.10 x...@fcxxx.com.ua [SMTP Error] 503 5.5.2 Need Recipient Dec-27-11 15:25:50 m1-94148-07049 [Worker_7] 10.0.0.10 x...@fcxxx.com.ua [SMTP Status] 451 4.7.1 Please try again later Configuration: Master ASSP ExtraBlockReportLog:=1 EmailBlockReport:=asspblock EmailBlockReportDomain:=@assp.local EmailBlockReply:=3 QueueUserBlockReports:=0 BlockRepForwHost:=10.0.0.11:225 EmailBlockTo:=assp-repo...@fcxxx.com.ua BlockReportFile:= BlockReportSchedule:=0 BlockReportNow:= BlockMaxSearchTime:=0 BlockReportFormat:=0 BlockReportHTTPName:= BlockReportFilter:=Virus|BlackDomain BlockResendLink:=2 BlockResendLinkLeft:= BlockResendLinkRight:= Slave ASSP ExtraBlockReportLog:=1 EmailBlockReport:=asspblock EmailBlockReportDomain:=@assp.local EmailBlockReply:=3 QueueUserBlockReports:=0 BlockRepForwHost:= EmailBlockTo:=assp-repo...@fcxxx.com.ua BlockReportFile:= BlockReportSchedule:=0 BlockReportNow:= BlockMaxSearchTime:=0 BlockReportFormat:=0 BlockReportHTTPName:= BlockReportFilter:=Virus|BlackDomain BlockResendLink:=2 BlockResendLinkLeft:= BlockResendLinkRight:= ASSP Version: 2.1.2(11358), Perl 5.012004 on both. May I supply additional information? Thanks in advance. Mike. -- Write once. Port to many. Get the SDK and tools to simplify cross-platform app development. Create new or port existing apps to sell to consumers worldwide. Explore the Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join http://p.sf.net/sfu/intel-appdev ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] fixes in assp 2.1.2 build 11356
Hi Thomas, Thanks for nice features! Just small typos here in listboxes: EmailSpamLoverTo used instead of EmailNoProcessingTo and EmailBlackTo in REPLY TO: ['EmailNoProcessingReply','Reply to Add to/Remove from noProcessing','0:NO REPLY|1:REPLY TO SENDER|2:REPLY TO EmailSpamLoverTo|3:REPLY TO BOTH',\listbox,1,'(\d*)',undef, ['EmailBlackReply','Reply to Add to/Remove from BlackListed','0:NO REPLY|1:REPLY TO SENDER|2:REPLY TO EmailSpamLoverTo|3:REPLY TO BOTH',\listbox,1,'(\d*)',undef, Mike. fixed in assp 2.1.2 build 11356: - If an include file was defined in a report file - the GUI has'nt shown an edit button for the included file changed: - The reporting code is now more human readable Thomas -- Write once. Port to many. Get the SDK and tools to simplify cross-platform app development. Create new or port existing apps to sell to consumers worldwide. Explore the Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join http://p.sf.net/sfu/intel-appdev ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] Question about Email Interface
Hi Thomas, hi Guys, I have a favour to ask of you. Is there any way to set charset (say UTF-8) in Content-Type headers for email reports from Email Interface? ASSP Version: 2.1.2(11352). Thanks in advance. Mike. -- Learn Windows Azure Live! Tuesday, Dec 13, 2011 Microsoft is holding a special Learn Windows Azure training event for developers. It will provide a great way to learn Windows Azure and what it provides. You can attend the event by watching it streamed LIVE online. Learn more at http://p.sf.net/sfu/ms-windowsazure ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] Problems with Configuration Synchronization and Sharing
Hi Thomas, strange thing I have noticed with SyncCFG: only first string of the modified file from Share Master is wrote on the Share Slave. Configuration: Share Master enableCFGShare:=1 isShareMaster:=1 isShareSlave:= syncServer:=10.0.0.11:225 syncTestMode:= syncConfigFile:=file:assp_sync.cfg syncShowGUIDetails:=1 Share Slave enableCFGShare:=1 isShareMaster:= isShareSlave:=1 syncServer:=10.0.0.10:225 syncTestMode:= syncConfigFile:=file:assp_sync.cfg syncShowGUIDetails:=1 ASSP Version: 2.1.2(11345), Perl 5.012004 on both. Log from Share Master: Dec-13-11 19:05:12 [Main_Thread] SyncCFG: start synchronization of noMaxSMTPSessions Dec-13-11 19:05:12 [Worker_1] SyncCFG: request to synchronize noMaxSMTPSessions Dec-13-11 19:05:13 [Worker_1] SyncCFG: successfully sent config for noMaxSMTPSessions to 10.0.0.11:225 Log from Share Slave: Dec-13-11 19:05:14 [Main_Thread] SyncCFG: wrote file /usr/local/share/assp/files/noMaxSMTPSess.txt for noMaxSMTPSessions but now file noMaxSMTPSess.txt on Share Slave is truncated to one line (first string of the modified file from Share Master). May I supply additional information? Thanks in advance. Mike. -- Systems Optimization Self Assessment Improve efficiency and utilization of IT resources. Drive out cost and improve service delivery. Take 5 minutes to use this Systems Optimization Self Assessment. http://www.accelacomm.com/jaw/sdnl/114/51450054/ ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] Request for best practices
Hi Thomas, hi Guys, I have a favour to ask of you. For now we have two ASSP V2 instances that provide filtering for the same set of redundant MX domains, each instance has it's own set of configuration values, DBs, log files etc. Our goal is to build failover approach in Active/Active mode. There is a great feature of ASSP - Configuration Synchronization and Sharing, but some things could not be shared. So, what are best practices for sharing or bidirectional sync? Thanks in advance for Success Stories. Mike. -- Learn Windows Azure Live! Tuesday, Dec 13, 2011 Microsoft is holding a special Learn Windows Azure training event for developers. It will provide a great way to learn Windows Azure and what it provides. You can attend the event by watching it streamed LIVE online. Learn more at http://p.sf.net/sfu/ms-windowsazure ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] Antwort: Request for best practices
but some things could not be shared What could not be shared? spamdb, whitelistdb etc. Mike. Von:Michael M Galapchuk michael.galapc...@fcbank.com.ua An: ASSP development mailing list assp-test@lists.sourceforge.net Datum: 12.12.2011 12:16 Betreff:[Assp-test] Request for best practices Hi Thomas, hi Guys, I have a favour to ask of you. For now we have two ASSP V2 instances that provide filtering for the same set of redundant MX domains, each instance has it's own set of configuration values, DBs, log files etc. Our goal is to build failover approach in Active/Active mode. There is a great feature of ASSP - Configuration Synchronization and Sharing, but some things could not be shared. So, what are best practices for sharing or bidirectional sync? Thanks in advance for Success Stories. Mike. -- Learn Windows Azure Live! Tuesday, Dec 13, 2011 Microsoft is holding a special Learn Windows Azure training event for developers. It will provide a great way to learn Windows Azure and what it provides. You can attend the event by watching it streamed LIVE online. Learn more at http://p.sf.net/sfu/ms-windowsazure ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] Antwort: Question about ASSP-MIB and assp-mrtg.cfg
Hi Thomas, just released the two files for build 11340 on SF-CVS http://assp.cvs.sourceforge.net/viewvc/assp/assp2/mrtg/ http://assp.cvs.sourceforge.net/viewvc/assp/assp2/mib/ Work like a charm! You are Wizard! Thanks a lot! Mike. Von:Michael M Galapchuk michael.galapc...@fcbank.com.ua An: ASSP development mailing list assp-test@lists.sourceforge.net Datum: 07.12.2011 17:16 Betreff:[Assp-test] Question about ASSP-MIB and assp-mrtg.cfg Hi Thomas, are there a new versions of ASSP-MIB and assp-mrtg.cfg for ASSP 2.1.2(11338)? With current versions (updated in 2.0.2_3.2.23) we have some unknown OIDs (see attached maillog.txt, snmpget.txt) and some discrepancy in data between infostats and mrtg. Thanks in advance. Mike.[Anhang maillog.txt gelöscht von Thomas Eckardt/eck] [Anhang snmpget.txt gelöscht von Thomas Eckardt/eck] -- Cloud Services Checklist: Pricing and Packaging Optimization This white paper is intended to serve as a reference, checklist and point of discussion for anyone considering optimizing the pricing and packaging model of a cloud services business. Read Now! http://www.accelacomm.com/jaw/sfnl/114/51491232/ ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] Antwort: Question about ASSP-MIB and assp-mrtg.cfg
Sorry, hav'nt done it yet. Your great help will be very much appreciated. I just thought that nobody uses the SNMP interface. Maybe, nobody knows absolutely nothing about this nice feature of ASSP? ;) Mike. Hi Thomas, are there a new versions of ASSP-MIB and assp-mrtg.cfg for ASSP 2.1.2(11338)? With current versions (updated in 2.0.2_3.2.23) we have some unknown OIDs (see attached maillog.txt, snmpget.txt) and some discrepancy in data between infostats and mrtg. Thanks in advance. Mike.[Anhang maillog.txt gelöscht von Thomas Eckardt/eck] [Anhang snmpget.txt gelöscht von Thomas Eckardt/eck] -- Cloud Services Checklist: Pricing and Packaging Optimization This white paper is intended to serve as a reference, checklist and point of discussion for anyone considering optimizing the pricing and packaging model of a cloud services business. Read Now! http://www.accelacomm.com/jaw/sfnl/114/51491232/ ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test -- Cloud Services Checklist: Pricing and Packaging Optimization This white paper is intended to serve as a reference, checklist and point of discussion for anyone considering optimizing the pricing and packaging model of a cloud services business. Read Now! http://www.accelacomm.com/jaw/sfnl/114/51491232/ ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] Top10stats page has malformed string
Hi Thomas, strange thing I have noticed in Top10stats page (see attached top10stats.txt) - in Top ten blocked domains table has malformed string. This malformed string caused by that IP - 82.128.20.228 (see detail in attached maillog.txt) ASSP version 2.1.2(11338), Perl version 5.010001. Thanks in advance. Mike.Dec-05-11 10:51:32 m1-75092-03450 [Worker_6] 82.128.20.228 h16...@ml82.128.20.228.multilinks.com Message-Score: added 5 for Suspicious HELO - contains IP: 'ml82.128.20.228.multilinks.com', total score for this message is now 5 Dec-05-11 10:51:35 m1-75092-03450 [Worker_6] [Trap] 82.128.20.228 h16...@ml82.128.20.228.multilinks.com penalty trap address: lina.aksen...@dxx.fcxx.com.ua Dec-05-11 10:51:35 m1-75092-03450 [Worker_6] 82.128.20.228 h16...@ml82.128.20.228.multilinks.com Message-Score: added 50 for Suspicious HELO - contains IP: 'ml82.128.20.228.multilinks.com', total score for this message is now 55 Dec-05-11 10:51:35 m1-75092-03450 [Worker_6] 82.128.20.228 h16...@ml82.128.20.228.multilinks.com [SMTP Error] 550 5.1.1 User unknown: lina.aksen...@dxx.fcxx.com.ua Dec-05-11 10:51:35 m1-75092-03450 [Worker_6] 82.128.20.228 h16...@ml82.128.20.228.multilinks.com [SMTP Status] 451 4.7.1 Please try again later Dec-05-11 10:51:47 m1-75107-02332 [Worker_5] 82.128.20.228 puz...@ml82.128.20.228.multilinks.com Message-Score: added 5 for Suspicious HELO - contains IP: 'ml82.128.20.228.multilinks.com', total score for this message is now 5 Dec-05-11 10:51:54 m1-75107-02332 [Worker_5] 82.128.20.228 puz...@ml82.128.20.228.multilinks.com to: f...@dxx.fcxx.com.ua recipient delayed: f...@dxx.fcxx.com.ua Dec-05-11 10:51:54 m1-75107-02332 [Worker_5] 82.128.20.228 puz...@ml82.128.20.228.multilinks.com to: f...@dxx.fcxx.com.ua [SMTP Status] 451 4.7.1 Please try again later Dec-05-11 10:54:32 m1-75272-10476 [Worker_4] 82.128.20.228 7...@ml82.128.20.228.multilinks.com Message-Score: added 5 for Suspicious HELO - contains IP: 'ml82.128.20.228.multilinks.com', total score for this message is now 5 Dec-05-11 10:54:33 m1-75272-10476 [Worker_4] [Trap] 82.128.20.228 7...@ml82.128.20.228.multilinks.com penalty trap address: lina.aksen...@dxx.fcxx.com.ua Dec-05-11 10:54:33 m1-75272-10476 [Worker_4] 82.128.20.228 7...@ml82.128.20.228.multilinks.com Message-Score: added 50 for Suspicious HELO - contains IP: 'ml82.128.20.228.multilinks.com', total score for this message is now 55 Dec-05-11 10:54:33 m1-75272-10476 [Worker_4] 82.128.20.228 7...@ml82.128.20.228.multilinks.com [SMTP Error] 550 5.1.1 User unknown: lina.aksen...@dxx.fcxx.com.ua Dec-05-11 10:54:33 m1-75272-10476 [Worker_4] 82.128.20.228 7...@ml82.128.20.228.multilinks.com [SMTP Status] 451 4.7.1 Please try again later Dec-05-11 10:54:35 [Worker_5] Delayed ip 82.128.20.228, because PBBlack(115) is higher than DelayIP(100)- last penalty reason was: penaltytrap:lina.aksen...@dxx.fcxx.com.ua Dec-05-11 10:56:50 [Worker_2] Delayed ip 82.128.20.228, because PBBlack(115) is higher than DelayIP(100)- last penalty reason was: penaltytrap:lina.aksen...@dxx.fcxx.com.ua Dec-05-11 10:56:50 m1-75410-00504 [Worker_1] 82.128.20.228 xu...@ml82.128.20.228.multilinks.com Message-Score: added 5 for Suspicious HELO - contains IP: 'ml82.128.20.228.multilinks.com', total score for this message is now 5 Dec-05-11 10:56:51 m1-75410-00504 [Worker_1] [Trap] 82.128.20.228 xu...@ml82.128.20.228.multilinks.com penalty trap address: lina.aksen...@dxx.fcxx.com.ua Dec-05-11 10:56:51 m1-75410-00504 [Worker_1] 82.128.20.228 xu...@ml82.128.20.228.multilinks.com Message-Score: added 50 for Suspicious HELO - contains IP: 'ml82.128.20.228.multilinks.com', total score for this message is now 55 Dec-05-11 10:56:51 m1-75410-00504 [Worker_1] 82.128.20.228 xu...@ml82.128.20.228.multilinks.com [SMTP Error] 550 5.1.1 User unknown: lina.aksen...@dxx.fcxx.com.ua Dec-05-11 10:56:51 m1-75410-00504 [Worker_1] 82.128.20.228 xu...@ml82.128.20.228.multilinks.com [SMTP Status] 451 4.7.1 Please try again later html xmlns=http://www.w3.org/1999/xhtml; xml:lang=en head meta http-equiv=content-type content=application/xhtml+xml; charset=utf-8 / titleTop10stats ASSP Top ten statistic (emx1i.fc.x.com.ua)/title link rel=stylesheet href=get?file=images/editor.css type=text/css / /head body div class=content br /h2Top ten blocking statistic/h2br /only entries that where stated in the last 25 hours are shownbr /br /table BORDER CELLSPACING=2 CELLPADDING=4 WIDTH=25% col /col / trth colspan=2Top ten blocked domains/th/tr trtdnbsp;a href=/addraction?address=inbox.ru target=_blank title=take an action via web on address inbox.ruinbox.ru/anbsp;/tdtdnbsp;8nbsp;/td/tr trtdnbsp;a href=/addraction?address=qip.ru target=_blank title=take an action via web on address qip.ruqip.ru/anbsp;/tdtdnbsp;5nbsp;/td/tr trtdnbsp;a href=/addraction?address=nm.ru target=_blank title=take an action via web on address nm.runm.ru/anbsp;/tdtdnbsp;5nbsp;/td/tr trtdnbsp;a
[Assp-test] Two messages stored under the same filename
Hi Thomas, strange thing I have noticed in ASSP maillog (see attached maillog.txt). Messages with ID m1-24609-00874 and m1-24609-10953 stored under the same filename - notspam/Re--174757.eml. At that, why [spam found] message stored under notspam folder? ASSP version 2.1.2(11321), Perl version 5.010001. Thanks in advance. Mike. Nov-24-11 10:50:09 m1-24609-12146 [Worker_7] 82.144.192.10 shu...@voliacable.com info: found message size announcement: 5.47 kByte Nov-24-11 10:50:09 m1-24609-12146 [Worker_7] 82.144.192.10 shu...@voliacable.com to: andriy.petr...@sx.fcxxx.com.ua Whitelisted sender address: shu...@voliacable.com Nov-24-11 10:50:09 m1-24609-12146 [Worker_7] 82.144.192.10 shu...@voliacable.com to: andriy.petr...@sx.fcxxx.com.ua info: removed MSGID-signature from header Nov-24-11 10:50:09 m1-24609-12146 [Worker_7] [MessageOK] 82.144.192.10 shu...@voliacable.com to: andriy.petr...@sx.fcxxx.com.ua message ok - (whitelistdb) - [Re] - /usr/local/share/assp/notspam/Re--174755.eml Nov-24-11 10:50:09 m1-24609-06764 [Worker_7] 82.144.192.10 shu...@voliacable.com info: found message size announcement: 5.46 kByte Nov-24-11 10:50:09 m1-24609-06764 [Worker_7] 82.144.192.10 shu...@voliacable.com to: andriy.petr...@sx.fcxxx.com.ua Whitelisted sender address: shu...@voliacable.com Nov-24-11 10:50:09 m1-24609-06764 [Worker_7] 82.144.192.10 shu...@voliacable.com to: andriy.petr...@sx.fcxxx.com.ua info: removed MSGID-signature from header Nov-24-11 10:50:09 m1-24609-06764 [Worker_7] [MessageOK] 82.144.192.10 shu...@voliacable.com to: andriy.petr...@sx.fcxxx.com.ua message ok - (whitelistdb) - [Re] - /usr/local/share/assp/notspam/Re--174756.eml Nov-24-11 10:50:09 m1-24609-00874 [Worker_7] 82.144.192.10 shu...@voliacable.com info: found message size announcement: 5.46 kByte Nov-24-11 10:50:09 m1-24609-00874 [Worker_7] 82.144.192.10 shu...@voliacable.com to: andriy.petr...@sx.fcxxx.com.ua Whitelisted sender address: shu...@voliacable.com Nov-24-11 10:50:09 m1-24609-00874 [Worker_7] 82.144.192.10 shu...@voliacable.com to: andriy.petr...@sx.fcxxx.com.ua info: removed MSGID-signature from header Nov-24-11 10:50:09 m1-24609-00874 [Worker_7] [MessageOK] 82.144.192.10 shu...@voliacable.com to: andriy.petr...@sx.fcxxx.com.ua message ok - (whitelistdb) - [Re] - /usr/local/share/assp/notspam/Re--174757.eml Nov-24-11 10:50:09 m1-24609-10953 [Worker_7] 82.144.192.10 newst...@zeffo.biz info: found message size announcement: 41.46 kByte Nov-24-11 10:50:09 m1-24609-10953 [Worker_7] 82.144.192.10 newst...@zeffo.biz to: com...@fcxx.kiev.ua Message-Score: added 20 for blacklisted domain '@zeffo.biz', total score for this message is now 20 Nov-24-11 10:50:09 m1-24609-10953 [Worker_7] [BlackDomain] 82.144.192.10 newst...@zeffo.biz to: com...@fcxx.kiev.ua [spam found] (blacklisted domain '@zeffo.biz') [1 10] - /usr/local/share/assp/notspam/Re--174757.eml; Nov-24-11 10:50:10 m1-24609-10953 [Worker_7] 82.144.192.10 newst...@zeffo.biz to: com...@fcxx.kiev.ua [SMTP Error] 554 5.7.1 Mail appears to be unsolicited -- send error reports to postmas...@fcxx.kiev.ua Nov-24-11 10:50:10 m1-24609-10953 [Worker_7] 82.144.192.10 newst...@zeffo.biz to: com...@fcxx.kiev.ua [SMTP Status] 451 4.7.1 Please try again later -- All the data continuously generated in your IT infrastructure contains a definitive record of customers, application performance, security threats, fraudulent activity, and more. Splunk takes this data and makes sense of it. IT sense. And common sense. http://p.sf.net/sfu/splunk-novd2d___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] Antwort: Re: Antwort: Strange output of ps (Process Status) command under FreeBSD
I need a feedback, if build 11319 fixes this issue. Yes, it fixes this issue under FreeBSD. Uptime now about 1 hour, ps output: PID TT STAT TIME COMMAND 33845 0 SJ20:08,14 /usr/bin/perl /usr/local/share/assp/assp.pl MainLoop - next: Tue Nov 15 16:57:10 2011 (perl) Thanks a lot! Mike. Von:Michael M Galapchuk michael.galapc...@fcbank.com.ua An: ASSP development mailing list assp-test@lists.sourceforge.net Datum: 15.11.2011 08:41 Betreff:Re: [Assp-test] Antwort: Strange output of ps (Process Status) command under FreeBSD It looks like your system shows every thread as a separate process part? I don't know FreeBSD - sorry. Thomas It seems not to be only FreeBSD relative. See also ASSP Forum - Troubleshooting - Weird Process Listing: http://sourceforge.net/apps/phpbb/assp/viewtopic.php?f=10t=1513sid=bf845eb646442b40d08a6b2bee144819 Mike. Von:Michael M Galapchuk michael.galapc...@fcbank.com.ua An: ASSP development mailing list assp-test@lists.sourceforge.net Datum: 14.11.2011 17:03 Betreff:[Assp-test] Strange output of ps (Process Status) command under FreeBSD Hi Thomas, recently I have noticed a strange output of ps about assp.pl. Immediately after start of assp.pl it was: PID TT STAT TIME COMMAND 32601 2 SJ 0:08,06 /usr/bin/perl -- /usr/local/share/assp/assp.pl /usr/local/share/assp Next it was: PID TT STAT TIME COMMAND 32601 2 SJ 0:09,77 /usr/bin/perl /usr/local/share/assp/assp.pl MainLoop - next: Mon Nov 14 17:02:20 2011 (perl) And after some time: PID TT STAT TIME COMMAND 32601 2 IJ 0:36,52 /usr/bin/perl /usr/bin/perl /usr/local/share/assp/assp.pl MainLoop - next: Mon Nov 14 17:05:20 2011 MainLoop - next: Mon Nov 14 17:22:20 2011 (perl) and so on. So we have multiple repeat of /usr/bin/perl and MainLoop - next entries in ps output. For example: PID TT STAT TIME COMMAND 3485 v0- SJ 104:18,29 /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/local/share/assp/assp.pl MainLoop - next: Wed Nov 9 07:44:40 2011 MainLoop - next: Wed Nov 9 10:36:55 2011 MainLoop - next: Wed Nov 9 10:41:20 2011 MainLoop - next: Wed Nov 9 15:21:55 2011 MainLoop - next: Wed Nov 9 17:33:10 2011 MainLoop - next: Wed Nov 9 18:49:40 2011 MainLoop - next: Wed Nov 9 19:44:00 2011 MainLoop - next: Thu Nov 10 04:37:10 2011 (perl) There are no problem with ASSP itself, but it make some problems for monitoring software. System details: ASSP version 2.1.2(11316) Perl 5.10.1 FreeBSD 8.2-RELEASE amd64. Thanks for any suggestions. -- RSA(R) Conference 2012 Save $700 by Nov 18 Register now http://p.sf.net/sfu/rsa-sfdev2dev1 ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] RebuildSpamDB version 3.08 delete fresh files in errors/spam collection
Hi Thomas, RebuildSpamDB delete fresh files ( 21 age 1000 days) in errors/spam and errors/notspam collections. [assp.cfg] MaxFiles:=14000 UseSubjectsAsMaillogNames:=1 MaintBayesCollection:=1 MaxBayesFileAge:=21 MaxCorrectedDays:=1000 MaxNoBayesFileAge:=31 MaxFileAgeSchedule:=1 MaxBytes:=5000 See more details in attached rebuildrun.txt. Thanks in advance. Mike. Nov-14-11 15:56:35 RebuildSpamDB-thread rebuildspamdb-version 3.08 started in ASSP version 2.1.2(11316) Nov-14-11 15:56:35 RebuildSpamDB will create a Hidden Markov Model! Nov-14-11 15:56:35 ---ASSP Settings--- Nov-14-11 15:56:35 Do Not Collect RedRe Messages: Enabled **Messages matching the RedRe will be removed from the corpus!** Nov-14-11 15:56:35 Use Subject as Maillog Names: True Nov-14-11 15:56:35 Maxbytes: 5000 Nov-14-11 15:56:35 /usr/local/share/assp/errors/spam Nov-14-11 15:56:35 File Count: 779 Nov-14-11 15:56:35 Processing... errors/spam with 779 files Nov-14-11 15:57:22 Removed Old: 98 Nov-14-11 15:57:22 Imported Files: 681 Nov-14-11 15:57:22 Finished in 47 second(s) Nov-14-11 15:57:22 /usr/local/share/assp/errors/notspam Nov-14-11 15:57:22 File Count: 21 Nov-14-11 15:57:22 Processing... errors/notspam with 21 files Nov-14-11 15:57:23 Removed Old: 5 Nov-14-11 15:57:23 Imported Files: 16 Nov-14-11 15:57:23 Finished in 1 second(s) Nov-14-11 15:57:23 /usr/local/share/assp/spam Nov-14-11 15:57:23 File Count: 3,167 Nov-14-11 15:57:23 Processing... spam with 3167 files Nov-14-11 16:00:57 Removed White: 6 Nov-14-11 16:00:57 Removed Old: 149 Nov-14-11 16:00:57 Imported Files: 3,012 Nov-14-11 16:00:57 Finished in 214 second(s) Nov-14-11 16:00:57 /usr/local/share/assp/notspam Nov-14-11 16:01:00 File Count: 91,400 Nov-14-11 16:01:00 Processing... notspam with 91400 files Nov-14-11 16:12:07 Removed Old: 4,342 Nov-14-11 16:12:07 Imported Files: 87,058 Nov-14-11 16:12:07 Folder contents exceeded `MaxFiles`(14000). Nov-14-11 16:12:07 Finished in 670 second(s) Nov-14-11 16:12:07 Generating weighted Bayesian tuplets Nov-14-11 16:12:18 cleaning old Spamdb records Nov-14-11 16:12:20 done - cleaning old Spamdb records - removed 8092 from 67990 Nov-14-11 16:12:20 done - Generating weighted Bayesian tuplets Nov-14-11 16:12:20 Bayesian Pairs: 66,859 new, 66,859 now in list Nov-14-11 16:12:20 generating Spamdb.helo records from 1947 collected HELO's Nov-14-11 16:12:20 cleaning old Spamdb.helo records Nov-14-11 16:12:20 done - cleaning old Spamdb.helo records Nov-14-11 16:12:20 HELO Blacklist: 18 new, 108 now in list Nov-14-11 16:12:20 Spam Weight:1,936,933 Nov-14-11 16:12:20 Not-Spam Weight: 2,314,374 Nov-14-11 16:12:20 Corpus norm: 0.8369 - (ok - slighly ham heavy) Nov-14-11 16:12:20 Corpus confidence: 0.85978197 Nov-14-11 16:12:20 Recommendation: RebuildSpamDB will limit the number of used messages in your corpus. Excess files will be ingored. Nov-14-11 16:12:25 Start populating Hidden Markov Model. HMM-check is disabled for this time! Nov-14-11 16:12:27 start populating Hidden Markov Model ham chains with 760829 records! Nov-14-11 16:12:48 Finished populating Hidden Markov Model ham chains with 760829 records! Nov-14-11 16:12:48 start populating Hidden Markov Model ham totals with 635466 records! Nov-14-11 16:13:06 Finished populating Hidden Markov Model ham totals with 635466 records! Nov-14-11 16:13:06 start populating Hidden Markov Model spam chains with 446579 records! Nov-14-11 16:13:19 Finished populating Hidden Markov Model spam chains with 446579 records! Nov-14-11 16:13:19 start populating Hidden Markov Model spam totals with 400372 records! Nov-14-11 16:13:30 Finished populating Hidden Markov Model spam totals with 400372 records! Nov-14-11 16:13:30 Finished populating Hidden Markov Model. HMM-check is now enabled again! Nov-14-11 16:13:30 Total processing time: 1015 second(s) Nov-14-11 16:13:30 Total processing data: 135.12 MByte Nov-14-11 16:13:30 building new GripList records and bounce report Nov-14-11 16:13:30 processing Logfile /usr/local/share/assp/logs/maillog.txt Nov-14-11 16:13:46 processing Logfile /usr/local/share/assp/logs/11-11-13.maillog.txt Nov-14-11 16:14:08 processing Logfile /usr/local/share/assp/logs/11-11-12.maillog.txt Nov-14-11 16:14:19 processing Logfile /usr/local/share/assp/logs/11-11-11.maillog.txt Nov-14-11 16:14:40 processing Logfile /usr/local/share/assp/logs/11-11-10.maillog.txt Nov-14-11 16:14:52 bounce report for the last two days: no bounces received Nov-14-11 16:14:53 Uploading Griplist Nov-14-11 16:14:53 Submitted 10587 bytes: 0 IPv6 addresses, 1175 IPv4 addresses Nov-14-11 16:14:53 Trashlist was saved to /usr/local/share/assp/trashlist.db -- RSA(R) Conference 2012 Save $700 by Nov 18 Register now http://p.sf.net/sfu/rsa-sfdev2dev1___ Assp-test mailing list Assp-test@lists.sourceforge.net
[Assp-test] Strange output of ps (Process Status) command under FreeBSD
Hi Thomas, recently I have noticed a strange output of ps about assp.pl. Immediately after start of assp.pl it was: PID TT STAT TIME COMMAND 32601 2 SJ 0:08,06 /usr/bin/perl -- /usr/local/share/assp/assp.pl /usr/local/share/assp Next it was: PID TT STAT TIME COMMAND 32601 2 SJ 0:09,77 /usr/bin/perl /usr/local/share/assp/assp.pl MainLoop - next: Mon Nov 14 17:02:20 2011 (perl) And after some time: PID TT STAT TIME COMMAND 32601 2 IJ 0:36,52 /usr/bin/perl /usr/bin/perl /usr/local/share/assp/assp.pl MainLoop - next: Mon Nov 14 17:05:20 2011 MainLoop - next: Mon Nov 14 17:22:20 2011 (perl) and so on. So we have multiple repeat of /usr/bin/perl and MainLoop - next entries in ps output. For example: PID TT STAT TIME COMMAND 3485 v0- SJ 104:18,29 /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/local/share/assp/assp.pl MainLoop - next: Wed Nov 9 07:44:40 2011 MainLoop - next: Wed Nov 9 10:36:55 2011 MainLoop - next: Wed Nov 9 10:41:20 2011 MainLoop - next: Wed Nov 9 15:21:55 2011 MainLoop - next: Wed Nov 9 17:33:10 2011 MainLoop - next: Wed Nov 9 18:49:40 2011 MainLoop - next: Wed Nov 9 19:44:00 2011 MainLoop - next: Thu Nov 10 04:37:10 2011 (perl) There are no problem with ASSP itself, but it make some problems for monitoring software. System details: ASSP version 2.1.2(11316) Perl 5.10.1 FreeBSD 8.2-RELEASE amd64. Thanks for any suggestions. Mike. -- RSA(R) Conference 2012 Save $700 by Nov 18 Register now http://p.sf.net/sfu/rsa-sfdev2dev1 ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
Re: [Assp-test] Antwort: Strange output of ps (Process Status) command under FreeBSD
It looks like your system shows every thread as a separate process part? I don't know FreeBSD - sorry. Thomas It seems not to be only FreeBSD relative. See also ASSP Forum - Troubleshooting - Weird Process Listing: http://sourceforge.net/apps/phpbb/assp/viewtopic.php?f=10t=1513sid=bf845eb646442b40d08a6b2bee144819 Mike. Von:Michael M Galapchuk michael.galapc...@fcbank.com.ua An: ASSP development mailing list assp-test@lists.sourceforge.net Datum: 14.11.2011 17:03 Betreff:[Assp-test] Strange output of ps (Process Status) command under FreeBSD Hi Thomas, recently I have noticed a strange output of ps about assp.pl. Immediately after start of assp.pl it was: PID TT STAT TIME COMMAND 32601 2 SJ 0:08,06 /usr/bin/perl -- /usr/local/share/assp/assp.pl /usr/local/share/assp Next it was: PID TT STAT TIME COMMAND 32601 2 SJ 0:09,77 /usr/bin/perl /usr/local/share/assp/assp.pl MainLoop - next: Mon Nov 14 17:02:20 2011 (perl) And after some time: PID TT STAT TIME COMMAND 32601 2 IJ 0:36,52 /usr/bin/perl /usr/bin/perl /usr/local/share/assp/assp.pl MainLoop - next: Mon Nov 14 17:05:20 2011 MainLoop - next: Mon Nov 14 17:22:20 2011 (perl) and so on. So we have multiple repeat of /usr/bin/perl and MainLoop - next entries in ps output. For example: PID TT STAT TIME COMMAND 3485 v0- SJ 104:18,29 /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/bin/perl /usr/local/share/assp/assp.pl MainLoop - next: Wed Nov 9 07:44:40 2011 MainLoop - next: Wed Nov 9 10:36:55 2011 MainLoop - next: Wed Nov 9 10:41:20 2011 MainLoop - next: Wed Nov 9 15:21:55 2011 MainLoop - next: Wed Nov 9 17:33:10 2011 MainLoop - next: Wed Nov 9 18:49:40 2011 MainLoop - next: Wed Nov 9 19:44:00 2011 MainLoop - next: Thu Nov 10 04:37:10 2011 (perl) There are no problem with ASSP itself, but it make some problems for monitoring software. System details: ASSP version 2.1.2(11316) Perl 5.10.1 FreeBSD 8.2-RELEASE amd64. Thanks for any suggestions. -- RSA(R) Conference 2012 Save $700 by Nov 18 Register now http://p.sf.net/sfu/rsa-sfdev2dev1 ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] RebuildSpamDB version 3.01 generate empty spamdb.helo
Hi Thomas, RebuildSpamDB generate empty spamdb.helo after upgrade ASSP from 2.1.2(11295) to 2.1.2(11306). See more details in attached rebuildrun.txt. Thanks in advance. Mike. Nov-03-11 16:50:54 RebuildSpamDB-thread rebuildspamdb-version 3.01 started in ASSP version 2.1.2(11306) Nov-03-11 16:50:54 RebuildSpamDB will create a Hidden Markov Model! Nov-03-11 16:50:54 ---ASSP Settings--- Nov-03-11 16:50:54 Do Not Collect RedRe Messages: Enabled **Messages matching the RedRe will be removed from the corpus!** Nov-03-11 16:50:54 Use Subject as Maillog Names: True Nov-03-11 16:50:54 Maxbytes: 5000 Nov-03-11 16:50:54 /usr/local/share/assp/errors/spam Nov-03-11 16:50:54 File Count: 686 Nov-03-11 16:50:54 Processing... errors/spam with 686 files Nov-03-11 16:51:21 Removed Old: 33 Nov-03-11 16:51:21 Imported Files: 653 Nov-03-11 16:51:21 Finished in 27 second(s) Nov-03-11 16:51:21 /usr/local/share/assp/errors/notspam Nov-03-11 16:51:21 File Count: 22 Nov-03-11 16:51:21 Processing... errors/notspam with 22 files Nov-03-11 16:51:22 Imported Files: 22 Nov-03-11 16:51:22 Finished in 1 second(s) Nov-03-11 16:51:22 /usr/local/share/assp/spam Nov-03-11 16:51:22 File Count: 4,679 Nov-03-11 16:51:22 Processing... spam with 4679 files Nov-03-11 16:54:24 Removed White: 56 Nov-03-11 16:54:24 Removed Old: 94 Nov-03-11 16:54:24 Imported Files: 4,529 Nov-03-11 16:54:24 Finished in 182 second(s) Nov-03-11 16:54:24 /usr/local/share/assp/notspam Nov-03-11 16:54:27 File Count: 85,082 Nov-03-11 16:54:27 Processing... notspam with 85082 files Nov-03-11 16:57:08 remove /usr/local/share/assp/notspam/--3418.eml corrected spam Nov-03-11 16:57:27 remove /usr/local/share/assp/notspam/--3686.eml corrected spam Nov-03-11 16:57:43 remove /usr/local/share/assp/notspam/--3915.eml corrected spam Nov-03-11 16:57:55 remove /usr/local/share/assp/notspam/--4093.eml corrected spam Nov-03-11 16:58:23 remove /usr/local/share/assp/notspam/--4472.eml corrected spam Nov-03-11 16:58:59 remove /usr/local/share/assp/notspam/--4973.eml corrected spam Nov-03-11 17:02:22 Imported Files: 85,083 Nov-03-11 17:02:22 Folder contents exceeded `MaxFiles`(14000). Nov-03-11 17:02:22 Finished in 478 second(s) Nov-03-11 17:02:22 Generating weighted Bayesian tuplets Nov-03-11 17:02:32 cleaning old Spamdb records Nov-03-11 17:02:35 done - cleaning old Spamdb records - removed 8911 from 65851 Nov-03-11 17:02:35 done - Generating weighted Bayesian tuplets Nov-03-11 17:02:35 Bayesian Pairs: 61,063 new, 61,063 now in list Nov-03-11 17:02:35 cleaning old Spamdb.helo records Nov-03-11 17:02:35 done - cleaning old Spamdb.helo records Nov-03-11 17:02:35 HELO Blacklist: 0 new, 0 now in list Nov-03-11 17:02:35 Spam Weight:1,689,424 Nov-03-11 17:02:35 Not-Spam Weight: 1,838,794 Nov-03-11 17:02:35 Corpus norm: 0.9188 - (very good - balanced) Nov-03-11 17:02:35 Recommendation: RebuildSpamDB will limit the number of used messages in your corpus. Excess files will be ingored. Nov-03-11 17:02:40 Start populating Hidden Markov Model! Nov-03-11 17:02:40 start populating Hidden Markov Model ham chains with 721519 records! Nov-03-11 17:03:01 Finished populating Hidden Markov Model ham chains with 721519 records! Nov-03-11 17:03:01 start populating Hidden Markov Model ham totals with 614271 records! Nov-03-11 17:03:19 Finished populating Hidden Markov Model ham totals with 614271 records! Nov-03-11 17:03:19 start populating Hidden Markov Model spam chains with 515186 records! Nov-03-11 17:03:35 Finished populating Hidden Markov Model spam chains with 515186 records! Nov-03-11 17:03:35 start populating Hidden Markov Model spam totals with 461644 records! Nov-03-11 17:03:48 Finished populating Hidden Markov Model spam totals with 461644 records! Nov-03-11 17:03:48 Finished populating Hidden Markov Model! Nov-03-11 17:03:48 Total processing time: 774 second(s) Nov-03-11 17:03:48 building new GripList records and bounce report Nov-03-11 17:03:48 processing Logfile /usr/local/share/assp/logs/maillog.txt Nov-03-11 17:04:09 processing Logfile /usr/local/share/assp/logs/11-11-02.maillog.txt Nov-03-11 17:04:56 processing Logfile /usr/local/share/assp/logs/11-11-01.maillog.txt Nov-03-11 17:05:08 processing Logfile /usr/local/share/assp/logs/11-10-31.maillog.txt Nov-03-11 17:05:31 processing Logfile /usr/local/share/assp/logs/11-10-30.maillog.txt Nov-03-11 17:05:34 bounce report for the last two days: no bounces received Nov-03-11 17:05:35 Uploading Griplist Nov-03-11 17:05:35 Submitted 13719 bytes: IPv6 addresses, 1523 IPv4 addresses Nov-03-11 17:05:35 RebuildSpamDB version 3.01 ended -- RSA(R) Conference 2012 Save $700 by Nov 18 Register now http://p.sf.net/sfu/rsa-sfdev2dev1___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] RebuildSpamDB version 2.80 generate empty spamdb
Hi Thomas, See more details in attached rebuildrun.txt. Thanks in advance. Mike.Oct-20-11 14:20:03 RebuildSpamDB-thread rebuildspamdb-version 2.80 started in ASSP version 2.1.2(11291) Oct-20-11 14:20:03 ---ASSP Settings--- Oct-20-11 14:20:03 Do Not Collect RedRe Messages: Enabled **Messages matching the RedRe will be removed from the corpus!** Oct-20-11 14:20:03 Use Subject as Maillog Names: True Oct-20-11 14:20:03 Maxbytes: 5000 Oct-20-11 14:20:03 /usr/local/share/assp/errors/spam Oct-20-11 14:20:03 File Count: 230 Oct-20-11 14:20:03 Processing... errors/spam with 230 files Oct-20-11 14:20:07 Imported Files: 230 Oct-20-11 14:20:07 Finished in 4 second(s) Oct-20-11 14:20:07 /usr/local/share/assp/errors/notspam Oct-20-11 14:20:07 File Count: 8 Oct-20-11 14:20:07 Processing... errors/notspam with 8 files Oct-20-11 14:20:07 Imported Files: 8 Oct-20-11 14:20:07 Finished in 1 second(s) Oct-20-11 14:20:07 /usr/local/share/assp/spam Oct-20-11 14:20:08 File Count: 3,954 Oct-20-11 14:20:08 Processing... spam with 3954 files Oct-20-11 14:21:28 Imported Files: 3,954 Oct-20-11 14:21:28 Finished in 81 second(s) Oct-20-11 14:21:28 /usr/local/share/assp/notspam Oct-20-11 14:21:28 File Count: 26,849 Oct-20-11 14:21:28 Processing... notspam with 26849 files Oct-20-11 14:24:42 Imported Files: 26,849 Oct-20-11 14:24:42 Folder contents exceeded `MaxFiles`(14000). Oct-20-11 14:24:42 Finished in 194 second(s) Oct-20-11 14:24:42 Generating weighted Bayesian tuplets Oct-20-11 14:24:54 cleaning old Spamdb records Oct-20-11 14:24:56 done - cleaning old Spamdb records - removed 51616 from 51616 Oct-20-11 14:24:56 done - Generating weighted Bayesian tuplets Oct-20-11 14:24:56 Bayesian Pairs: 51,616 new, 0 now in list Oct-20-11 14:24:56 cleaning old Spamdb.helo records Oct-20-11 14:24:56 done - cleaning old Spamdb.helo records Oct-20-11 14:24:56 HELO Blacklist: 0 new, 210 now in list Oct-20-11 14:24:56 Spam Weight:1,362,531 Oct-20-11 14:24:56 Not-Spam Weight: 2,241,543 Oct-20-11 14:24:56 Corpus norm: 0.6079 - (ok - slighly ham heavy) Oct-20-11 14:24:56 Recommendation: RebuildSpamDB will limit the number of used messages in your corpus. Excess files will be ingored. Oct-20-11 14:24:56 Total processing time: 293 second(s) Oct-20-11 14:24:56 building new GripList records and bounce report Oct-20-11 14:24:56 processing Logfile /usr/local/share/assp/logs/maillog.txt Oct-20-11 14:25:11 processing Logfile /usr/local/share/assp/logs/11-10-19.maillog.txt Oct-20-11 14:25:45 processing Logfile /usr/local/share/assp/logs/11-10-18.maillog.txt Oct-20-11 14:25:56 processing Logfile /usr/local/share/assp/logs/11-10-17.maillog.txt Oct-20-11 14:26:18 processing Logfile /usr/local/share/assp/logs/11-10-16.maillog.txt Oct-20-11 14:26:25 bounce report for the last two days: no bounces received Oct-20-11 14:26:30 Uploading Griplist via Proxy: Oct-20-11 14:26:30 Submitted 12441 bytes: IPv6 addresses, 1381 IPv4 addresses Oct-20-11 14:26:30 RebuildSpamDB version 2.80 ended -- The demand for IT networking professionals continues to grow, and the demand for specialized networking skills is growing even more rapidly. Take a complimentary Learning@Ciosco Self-Assessment and learn about Cisco certifications, training, and career opportunities. http://p.sf.net/sfu/cisco-dev2dev___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] Exception (Malformed UTF-8 character) in ASSP version 2.1.2(11286) under Perl 5.10.1
Hi Thomas, in exception.log: Oct-16-11 09:01:06 Error: Worker_1: Malformed UTF-8 character (fatal) at sub main::CheckAttachments line 53. [assp.cfg] DoBlockExes:=1 BlockExes:=1 BlockWLExes:=1 BlockNPExes:=1 BadAttachL1:=bat|btm|cmd|com|cpl|dll|lnk|msi|p[ir]f|reg|scr|vb[es]|url|exe|js|jse|ws[fh]|sh[sb]|ht[ab]|wmv|swf|avi|mpeg|mp[ge]|asf|mp[4321]|ogg|wav|tmp BadAttachL2:= BadAttachL3:= GoodAttach:= AttachmentError:=550 5.7.1 These attachments are not allowed -'FILENAME'- Compress before mailing. npAttachLog:=7 wlAttachLog:=7 extAttachLog:=7 AttachmentLog:=1 See more details in attached files. Thanks in advance. Mike.Worker 1 - Connection Data exception detected : Malformed UTF-8 character (fatal) at sub main::CheckAttachments line 53. last debug step was: Error: Malformed UTF-8 character (fatal) at sub main::CheckAttachments line 53. last sigoff was: last sigoff in main, sub main::SMTPTraffic, 11, main::sigoffTry, 1, , , at 11-16-9 9:16 1318744866.68778 - 11 last sigon was: last sigon in main, sub main::SMTPTraffic, 13, main::sigonTry, 1, , , at 11-16-9 9:16 1318744866.68796 - 13 this -- this-prepend = this-socketcalls = 5 this-timelast = 1318744866 this-friend = IO::Socket::INET=GLOB(0x847e948b8) this-fno = 211 this-_ = this-self = IO::Socket::INET=GLOB(0x845039648) this-debug = 0 this-timestart = 1318744866 this-type = S this-getline = CODE(0x8110ec4e0) this-outgoing = friend -- friend-maximumuri = friend-allLoveBombsSpam = 0 friend-NOOPcount = 0 friend-nohelo = friend-ciphelo = friend-msgid = 999291530.20111014093...@kxx.fcxx.com.ua friend-noscan = friend-RWLokDone = friend-obfuscateduri = friend-socketcalls = 8 friend-pbblack = friend-subject = _ friend-allLoveRBLSpam = 2 friend-spamlover = 2 friend-bspams = friend-rcvdTime = 1318744866 friend-rcptNonexistent = 0 friend-delayqueue = friend-allLoveHiSpam = 2 friend-sattachdone = friend-SIZE = 34896 friend-spamconf = 0 friend-maillength = 33502 friend-averror = friend-nodamping = friend-loggedIpFromTo = 1 friend-fno = 210 friend-received = friend-tagmode = friend-localSenderOK = friend-addressedToPenaltyTrap = friend-addMSGIDsigDone = friend-maxSize = 0 friend-acceptall = friend-validHeloOK = friend-localip = 10.0.0.10 friend-noprocessing = friend-nopb = friend-localport = 225 friend-rcptValidated = 1 friend-subject3 = Ïîäàííÿ friend-rblfail = friend-islocalmailaddress = 0 friend-forgedhelodone = 1 friend-headerpassed = 1 friend-validhelodone = friend-allLoveBaysSpam = 2 friend-dkimverified = friend-dlslre = 2 friend-IPinHeloOK = friend-ispip = friend-red = friend-debug = 0 friend-msgtime = m1-44866-12712 friend-allLoveATSpam = 2 friend-attachdone = friend-rcvd = Received: from imx2.fcxx.com.ua ([10.10.240.30] helo=imx2.fcxx.com.ua) by emx1i.fcxx.com.ua with ESMTP (2.1.2); 16 Oct 2011 09:01:06 +0300 friend-FromStrictOK = 1 friend-runlvl1PL = 1 friend-timestart = 1318744866 friend-rcptlist = HASH(0x844d2ac78) friend-spamloversonly = friend-saveprepend = friend-allLoveHlSpam = 2 friend-numrcpt = 1 friend-spamfound = friend-type = C friend-msgiddone = 1 friend-skipuriblPL = friend-allLoveSpam = 2 friend-maxRealSizeExternal = friend-rwlok = 0 friend-authmethodes = HASH(0x84691f428) friend-reporttype = -1 friend-spamprob = 0 friend-nocollect = friend-cip = friend-maximumuniqueuri = friend-forgedHeloOK = friend-messagescore = 0 friend-SenderBaseOK = 1 friend-helo = imx2.fcxx.com.ua friend-outgoing = friend-testmode = friend-alllog = friend-rbldone = friend-maillog = 1 friend-greetingSent = 1 friend-signed = friend-client = IO::Socket::INET=GLOB(0x847e948b8) friend-mfn = 12712 friend-storecompletemail = 9 friend-allLoveMXASpam = 2 friend-uribldone = friend-addressedToSpamBucket = friend-nobayesian = friend-prepend = friend-formathelodone = friend-invalidSRSBounce = friend-localsenderdone = friend-spamloverdone = friend-skipnotspam = 1 friend-lastcmd = DATA friend-allLoveURIBLSpam = 2 friend-saveprepend2 = friend-userTempFail = friend-noLog = friend-nodkim = friend-timelast = 1318744866 friend-mailfrom = sergiy@kxx.fcxx.com.ua friend-allLovePBSpam = 2 friend-pbwhite = friend-BlackHeloOK = friend-rblneutral = friend-bayesdone = friend-senderok = friend-baysprob = friend-friend = IO::Socket::INET=GLOB(0x845039648) friend-subject2 = friend-ip = 10.10.240.30 friend-ScriptOK = friend-hasmallogname = friend-messagelow = friend-bayeslowconf = friend-nodelay = friend-attachcomment = no bad attachments friend-filescandone = friend-maxSizeExternal = friend-datastart = 723 friend-preheaderlength = 0 friend-allLoveDLSpam = 2 friend-isDKIM = friend-maillogbuf = Received: from imx2.fcxx.com.ua ([10.10.240.30] helo=imx2.fcxx.com.ua) by emx1i.fcxx.com.ua with ESMTP (2.1.2); 16 Oct 2011 09:01:06 +0300 Date: Fri, 14 Oct 2011 09:37:39 +0300 From: Ñåðãåé Ñòàðîâîéòîâ
Re: [Assp-test] Strange problem with Redlisting
Replace redre.txt with this:
# redre.txt 1.9.8.0
Auto-reply
auto-submitted\:
automated.response
autoreply
content-type\:.{0,60}message\/delivery-status
content-type\:.{0,60}multipart\/report
mailer-daemon
report-type.{0,60}\=.{0,60}delivery-status
report-type.{0,60}\=.{0,60}disposition-notification
Content-Type\: message\/disposition-notification
Disposition\: manual-action\/MDN-sent-automatically\; displayed
subject\:.{0,60}delivered:
subject\:.{0,60}undeliverable\:
subject\:.{0,60}out.of.office
subject\:.{0,60}auto\:
X-FC-AutoForward-By
X-FC-Forwarded-From
X-FC-Machinegenerated
Thank you, Fritz!
File redre.txt replaced as suggested.
Redlisting worked fine now!
Maybe, new redre.txt should be copied to ASSP2 repositories too?
Mike.
--
All the data continuously generated in your IT infrastructure contains a
definitive record of customers, application performance, security
threats, fraudulent activity and more. Splunk takes this data and makes
sense of it. Business sense. IT sense. Common sense.
http://p.sf.net/sfu/splunk-d2d-oct
___
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] Strange problem with Redlisting
Hi all, when I try to send such e-mail (see attached beforeASSP.eml), ASSP (ver. 2.1.2(11284)) transform it into that (see attached afterASSP.eml). In assp.cfg: redRe:=file:files/redre.txt DoNotCollectRedRe:=1 See attached redre.txt. So, here are some problems/questions: 1. Why ASSP set X-Assp-Redlisted: Yes, when matched word undeliverable occur only in the e-mail body, but not in the Subject. 2. ASSP generate incorrect header X-Assp-Redlisted in that case. 3. In the initial e-mail (see attached beforeASSP.eml) I try to describe another problem with Regex:BombRe, so please, look at it. Thanks in advance. Mike. P.S. English is not my native language; please excuse typing errors.# redre.txt 1.6.1.0 Auto-reply auto-submitted\: automated.response autoreply content-type\:.*?message\/delivery-status content-type\:.*?multipart\/report mailer-daemon report-type.*?\=.*?delivery-status report-type.*?\=.*?disposition-notification Content-Type\: message\/disposition-notification Disposition\: manual-action\/MDN-sent-automatically\; displayed subject\:.*?delivered: subject\:.*?undeliverable\: subject\:.*?out.of.office subject\:.*?auto\: X-FC-AutoForward-By X-FC-Forwarded-From X-FC-Machinegenerated-- All the data continuously generated in your IT infrastructure contains a definitive record of customers, application performance, security threats, fraudulent activity and more. Splunk takes this data and makes sense of it. Business sense. IT sense. Common sense. http://p.sf.net/sfu/splunk-d2d-oct___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
[Assp-test] Regex:BombRe log messages in duplicate
Hi all, We have: [startup] ASSP version 2.1.2(11283) (Perl 5.010001) (on freebsd) [assp.cfg] DoBombRe:=3 bombErrorReason:=1 Problem - Regex:BombRe log messages are printed in duplicate: (fragments of maillog.txt) Oct-10-1115:24:16m1-49455-10546[Worker_1] 94.100.176.xxx x...@mail.ru to: x...@fcxxx.com.ua Message-Score: added 20 for Regex:BombRe 'PB 20: for X-Spam: Not detected'bombRe: 'X-Spam: Not detected ', total score for this message is now 5 Oct-10-11 15:29:39 m1-49775-07670 [Worker_1] 67.206.88.xxx to: x...@fcxxx.com.ua Message-Score: added 20 for Regex:BombRe 'PB 20: for Undeliverable:) Hi all, We have: [startup] ASSP version 2.1.2(11283) (Perl 5.010001) (on freebsd) [assp.cfg] DoBombRe:=3 bombErrorReason:=1 Problem - Regex:BombRe log messages are printed in duplicate: (fragments of maillog.txt) Oct-10-1115:24:16m1-49455-10546[Worker_1] 94.100.176.xxx x...@mail.ru to: x...@fcxxx.com.ua Message-Score: added 20 for Regex:BombRe 'PB 20: for X-Spam: Not detected'bombRe: 'X-Spam: Not detected ', total score for this message is now 5 Oct-10-11 15:29:39 m1-49775-07670 [Worker_1] 67.206.88.xxx to: x...@fcxxx.com.ua Message-Score: added 20 for Regex:BombRe 'PB 20: for Undeliverable:'bombRe: 'Undeliverable: ', total score for this message is now 30 and so on. Is the above correctly formed log messages? Thanks in advance. Mike. -- All the data continuously generated in your IT infrastructure contains a definitive record of customers, application performance, security threats, fraudulent activity and more. Splunk takes this data and makes sense of it. Business sense. IT sense. Common sense. http://p.sf.net/sfu/splunk-d2dcopy1 ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
