Hi Will, We just had this problem twice in the past week. We're running IMail 8.05 and Declude Junkmail/Virus 1.82.
The first took us most of the day to recover, with significant effort on our part, and a delay in delivery of about 4 hours for some email. It was caused by a new customer sending out a large newsletter through the wrong server. Outbound scanning overloaded Declude, so we turned that off by commenting out the lines in the Global.CFG file, moved all of the newsletter messages in overflow back to the IMail spool directory for normal delivery (bypassing scanning), and manually got rid of spam messages from overflow. After all of that we only ended up with a few hundred messages in overflow, which Declude processed in about 4 hours. The second time was due to backscatter from a joe job. Thousands of messages were being bounced back to one of our users. The attack was distributed, so we could not block by IP, but fortunately it only lasted about 15 minutes. We removed the bounce messages from the overflow and were able to process all overflow messages in about 45 minutes after the attack. So, to your problem... You might consider turning off outbound scanning or directing outbound mail through a separate server. You also might look for DNSBLs and RHSBLs that are timing out (might need to go to Log High or Debug for this). <rant on> During the second incident we called Declude support, but were disappointed in their lack of knowledge and support for the 1.82 product, despite the fact that they are recommending to customers to use it instead of 2.0x. We were told that "it was Scott's code", so they would have to go look at the code and call us back. When they called back, the answer was either incomplete or incorrect...as we were told that 1.82 would use the number of processes specified in IMail's settings. From that we figured they had to mean Queue Manager settings, but that didn't match at all since we were seeing a max of 30 declude processes, and IMail was set for 60. We later upped IMail to 100 processes as a test, restarted services, and the number of declude processes remained relatively constant at 30. We were also given no indication as to why declude processes were hanging around for hours.... just told, "oh you can kill those" without any concern over what might happen to the messages. At one point we were also told "the messages would be delivered eventually". We tried to explain that our customers depended on timely delivery of all legitimate email, but the explanation seemed to fall on deaf ears. The only thing the support tech seemed to want to talk about was the 3.0 release he was working on, not on assisting with a resolution to a problem with the last stable product released by Declude. Anyway, my apologies for the rant, but for the one time in two years to call for support, I was extremely disappointed in Declude support, with their lack of knowledge of the product they are selling, with the attention to the customer problem, and with the cavalier attitude throughout the process. This is inexcusable, but has been a growing concern throughout the year with all of the woes regarding the 2.0x product. <rant off> Darin. ----- Original Message ----- From: "Will" <[EMAIL PROTECTED]> To: <Declude.JunkMail@declude.com> Sent: Thursday, July 28, 2005 9:35 AM Subject: [Declude.JunkMail] Declude Woes A number of years ago I purchased Declude and ultimately abandoned it due to the crippling problem that would leave our spool directory overfilled with mail and a mail server that was delivering mail late. Sometimes up to 24 to 48 hours late in the worst cases. Last year I decided to give Declude a chance again and repurchased the software upgrade. It's been over a year now and I still have the same problem. It's killing me. Declude will create an overflow directory and mail will just pile up, customers will get angry, and we look the fool. I have spoken with Declude support about this and they had me change a value in my virus.cfg to "MAXATONCE 1". I still see a number of declude.exe processes when the overflow directory comes into use and the overflow directory is never used when I disable Declude. Right now, my mail server is a couple hours behind with over a hundred thousand messages in cue. I have disabled Declude so the server can catch up, but I still want antivirus and spam protection. I am all out of ideas and resources. I had thought the antivirus was taking too long to process at one point and my last concern was that DNS resolution was not fast enough for the SPAM tests, however, when enabled, the Imail integrated black lists resolve fast enough that I do not see this problem. Does anyone have any suggestions? Or better yet experience with this issue and know of a cause or resolution. I've grown to fear the overflow directory and I would have thrown out Declude already if not for the lack of chatter about this issue on the list. Will --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
