Regarding the relationships between Imail logs, Junkmail logs and Virus logs:
In the Imail logs: - A single process ID represents all of the work for a single message in a single direction. - If a message is received from a remote server, the log lines for that message will reference a spool\D######.SMD file (an inbound connection, process=SMTPD). - If a message is received from a local authenticated user (for example: sending through Outlook), the log lines for that message will reference a spool\D######.SMD file (an inbound connection, process=SMTPD). Subsequently, a separate set of log lines will reference a spool\Q######.SMD file (an outbound connection, process=SMTP-) for the outbound connection to send that message to a remote server (if the message is bound for a remote domain). The Q and D files for this entire message will have the same file name other than the Q and D. - A message sent from a local user to another local user will only have a spool\D######.SMD file (an inbound connection, process=SMTPD). - To accurately count the number of messages processed, one only needs to count the inbound messages b/c any outbound messages must have been preceeded by an inbound message. In the Junkmail and Virus logs: - The set of log lines representing work done on a single message will have the Q file specified (minus the .SMD) on each associated line. This identifier is "mated" with the Imail log entry which references the D version of the same name. - All Junkmail/Virus processing is done on the inbound connection, either from a remote server or the user client app (ie. Outlook). No processing is done on the outbound connection; hence no D files are specified. --------------------------------------- I wrote this as a number of statements that indicate my understanding. Please comment on any incorrect statements. Thanks, Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Tuesday, October 14, 2003 11:03 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Understanding Imail logs document > > > >A link to this was posted recently. Can someone please repost the link? > > It's http://www.declude.com/info/logs.htm . > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
