We are having simular issues, Scott even added the ability to log the PID so
I could associate the offending process with log entries, since other
declude instances would still execute normally even while resources are
spiked. My server decided to behave for nearly a week, then last night one
locked. Running a log level of high this is the only entries the offending
process made:
09/12/2001 20:03:36 Q05e6040 000276 Start
09/12/2001 20:03:36 Q05e6040 000276 Locking d:\spool\Q05e6040.SMD.
09/12/2001 20:03:36 Q05e6040 000276 d:\spool\Q05e6040.SMD locked.
It was still running a 8:30 am 9/13/2001, no other log entries.
I had to reboot the system to kill it. I may just forget about the drive
space and run log level debug to hopefully trap more details. Here is D
file that was being processed, (Scott, I do not know the rename convention
for decludes locking or I'd include the Q file, can't find it.)
-------- Begin File ---------
Received: from server1.sesc.local [213.48.47.108] by argolink.net with ESMTP
(SMTPD32-6.06) id A5E61C340040; Wed, 12 Sep 2001 20:03:34 -0500
Received: from 03-155.023.popsite.net_[206.57.114.155] ([206.57.114.155]) by
server1.sesc.local with Microsoft SMTPSVC(5.0.2195.2966);
Thu, 13 Sep 2001 01:59:04 +0100
Received: from mail.mecom.net by 03-155.023.popsite.net with ESMTP; Wed, 12
Sep 2001 19:55:07 -0500
Message-ID: <0000247c70c0$000068da$[EMAIL PROTECTED]>
To: <ombev>
From: [EMAIL PROTECTED]
Subject: Strong Secured Return of 2.5% Month-Prepaid
23022
Date: Wed, 12 Sep 2001 19:55:00 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
Errors-To: [EMAIL PROTECTED]
Return-Path: [EMAIL PROTECTED]
X-Mailer: Mozilla 4.75 [en] (Win98; U)
X-OriginalArrivalTime: 13 Sep 2001 00:59:07.0329 (UTC)
FILETIME=[4A537310:01C13BEF]
LENDERS ALERT!!!
30% RETURN ANNUALLY FULLY SECURED!
*That's Up to 2.5% Per-Month Payable Every Month.
*Renewable Every 30-60 Days.
*Provide Bridge Funding For Pre-Manufactured Housing
And Land.
*How Would You Like To Earn 18-30% On Your Money With
No Work.
*You Can Now Be The Bank.
*Lend Money Backed Fully By Collateral -IRA Approved
*Its The Bankers Best Kept Secret.
*What Are You Currently Earning AT Your Bank?
CONTACT US:
FOR YOUR FREE IN-DEPTH INFORMATION PACKAGE.
LOOK INTO OUR SAFE HAVEN!
http://www.market-watcher.com/lender.htm
(Opt-Out INSTRUCTIONS)
This mailing is done by an independent marketing company.
Please do not reply to this e-mail, an e-mail reply cannot
be read. If you would like to be excluded from our mailing
list, just click below and send us an opt-out request email.
mailto:[EMAIL PROTECTED]?subject=RemoveLending-Please
-------- End File -----------
Hope this helps at least a little.
Chuck Frolick
ArgoNet, Inc.
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Frank
Sent: Thursday, September 13, 2001 8:15 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Declude crashing and taking up 99% CPU
We are also have a problem with Declude recently. It doesn't crash our
system per say but it causes our system to go to 100% CPU utilization,
memory usage goes way up and SMTP timesout (even though there are a lot of
STMP & Declude processes showing up). We have had to reboot our mail server
once a day because of this.
----- Original Message -----
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, September 12, 2001 10:24 PM
Subject: Re: [Declude.JunkMail] Declude crashing and taking up 99% CPU
>
> > >other similar information? What *exactly* does the error message say,
the
> > >complete text of it? I can't recall ever seeing NT/2000 report a crash
> > >without at least the memory address that the crash occurred at.
> >
> >user32.dll is the main text of the message. There is just the pop up
> >window reporting that user32.dll has failed.
>
> What you describe cannot be distinguished with the Microsoft
> "Too-many-service-started-processes" problem. Unless I get the exact text
> of the message, I'll have to assume that that is the problem. The links
> are http://support.microsoft.com/directory/article.asp?ID=KB;EN-US;Q142676
> and http://support.microsoft.com/directory/article.asp?ID=kb;en-us;Q126962
.
>
> There are several sources of this problem. One is that Microsoft has an
> apparently undocumented type of memory that it allocates to (again,
> apparently) all processes. It apparently allocates a certain amount of
> memory to each process, which can differ based on whether the process was
> started normally or through a service. Microsoft says it allocates this
> memory to force ill-behaved programs from consuming too much resources --
> but doesn't explain why it allocates all those precious resources even if
> they are not needed. It sounds like they are used for GUI stuff (icons,
> palettes, mouse pointers, etc.) that aren't used in most services anyways.
>
> So this problem can exist with any programs. The reason it is so apparent
> in IMail (with or without Declude) is that IMail [1] runs as a service and
> [2] creates a new process (rather than thread) for each E-mail that needs
> to be delivered. The problem gets even worse with Declude creating extra
> processes for the virus scanning.
>
> We are trying to find a way to prevent this problem, which may or may not
> be possible to do (it may only be possible to offload it, so that it can
> only happen once the smtp32.exe process is started, for example).
However,
> this is a difficult process since Microsoft is referring to undocumented
> memory (their >1gig MSDN knowledge base references to "desktop heap", the
> term they use for this type of memory, only brings up articles about this
> problem, no documentation of the memory type).
>
> -Scott
> ---
> Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
> IMail. http://www.declude.com
>
> ---
>
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". You can E-mail
> [EMAIL PROTECTED] for assistance. You can visit our web
> site at http://www.declude.com .
>
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
