Re[4]: [Declude.JunkMail] Log file errors
Hello David, Friday, June 24, 2005, 12:16:23 PM, you wrote: DFRD> I will get back to you (and the list) on this by Monday. I have to scan the DFRD> entire Declude source tree for these types of messages and will let you DFRD> know. Thanks. That will be very helpful. BTW - Another thanks to whoever recommended ks-soft for monitoring. We've been using it to monitor SMTP, POP, system utilization, etc and just started using it's log file monitoring. -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] Log file errors
David, I will get back to you (and the list) on this by Monday. I have to scan the entire Declude source tree for these types of messages and will let you know. David Franco-Rocha Declude Technical Support - Original Message - From: "David Sullivan" <[EMAIL PROTECTED]> To: Sent: Friday, June 24, 2005 10:13 AM Subject: Re[2]: [Declude.JunkMail] Log file errors Hello Dan, Friday, June 24, 2005, 9:50:10 AM, you wrote: DH> SERVFAIL means that the domain does exist and the root name servers have DH> information on this domain, but that the authoritative name servers are DH> not answering queries for this domain. Great, thanks Dan. Now, Declude...are there any other conditions whereby Declude puts a "Warning" in the log file that is related to the functioning of the actual Declude software? We monitor log files for the words "ERROR" or "WARNING". In this case, this warning is fairly normal operation of Declude. If software related issues are only logged under "ERROR" then we'll drop the "WARNING" monitoring. DS>> 06/22/2005 00:39:15 Qeb72438900c4923f WARNING: DNS server DS>> 66.179.12.115 returned a SERVER FAILURE error for MX or A for DS>> fadmail.com. -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Log file errors
Hello Dan, Friday, June 24, 2005, 9:50:10 AM, you wrote: DH> SERVFAIL means that the domain does exist and the root name servers have DH> information on this domain, but that the authoritative name servers are DH> not answering queries for this domain. Great, thanks Dan. Now, Declude...are there any other conditions whereby Declude puts a "Warning" in the log file that is related to the functioning of the actual Declude software? We monitor log files for the words "ERROR" or "WARNING". In this case, this warning is fairly normal operation of Declude. If software related issues are only logged under "ERROR" then we'll drop the "WARNING" monitoring. DS>> 06/22/2005 00:39:15 Qeb72438900c4923f WARNING: DNS server DS>> 66.179.12.115 returned a SERVER FAILURE error for MX or A for DS>> fadmail.com. -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log file errors
SERVFAIL means that the domain does exist and the root name servers have information on this domain, but that the authoritative name servers are not answering queries for this domain. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Sullivan Sent: Friday, June 24, 2005 9:20 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Log file errors Wednesday, June 22, 2005, 11:04:22 AM, you wrote: DS> I've seen these errors for years, but never bothered to ask DS> Does this mean my DNS server had a failure, or just that the domain DS> it looked up does not have MX or A records? DS> 06/22/2005 00:39:15 Qeb72438900c4923f WARNING: DNS server DS> 66.179.12.115 returned a SERVER FAILURE error for MX or A for DS> fadmail.com. AnyoneAnyoneBueller? Seriously, anybody know what this really means? -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Log file errors
Wednesday, June 22, 2005, 11:04:22 AM, you wrote: DS> I've seen these errors for years, but never bothered to ask DS> Does this mean my DNS server had a failure, or just that the domain it DS> looked up does not have MX or A records? DS> 06/22/2005 00:39:15 Qeb72438900c4923f WARNING: DNS server DS> 66.179.12.115 returned a SERVER FAILURE error for MX or A for DS> fadmail.com. AnyoneAnyoneBueller? Seriously, anybody know what this really means? -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] custom delivery executable?
Darrell, This would not work with Declude because Declude uses imail1.exe to send out the notification messages for viruses. All such notifications, instead of going to the intended recipient, would likewise go to this text file. There may be other ways in which it might interfere with Declude, but this struck me as the most obvious. David Franco-Rocha Declude Technical Support - Original Message - From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> To: Sent: Thursday, June 23, 2005 11:44 AM Subject: Re: [Declude.JunkMail] custom delivery executable? Or another thought to try is renaming your custom delivery app to imail1.exe and replacing theirs. Althought I am not sure what else this would break. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Darin Cox writes: You could change all email addresses to be program aliases. The batch file run by the program alias could then dump the message into a text file, or even post the message straight into your database. Darin. - Original Message - From: Chase Seibert To: Declude.JunkMail@declude.com Sent: Thursday, June 23, 2005 9:53 AM Subject: [Declude.JunkMail] custom delivery executable? Hey guys, We have a very non-standard iMail/Declude install. Basically, we only us the system for the SMTP protocol, as well as virus and spam filtering. Once a message has passed through those systems, it's delivered to a mailbox as normal. However, we don't allow POP or IMAP access to our systems. Instead, we parse the mailboxes when they change, pull out new mail and insert it into a SQL Server database for access in our web-based CRM. Messed up, huh? We are looking to skip the whole step of delivering the mail to a mailbox and then chunking it out. It's not a speed problem, but rather a reliability concern. Our current solution has about a .1% failure rate, meaning that some messages are not delivered until the next message comes along into that folder to knock it out. Ok, here is my question. I am wondering if there is some way to setup iMail/Declude so that it delivers a message right to a stand alone file, as apposed to a mailbox. Qmail, for example, can do this. I doubt there is any out of the box support for this, so I started investigating using a custom Declude filter for this. From the manual: For more flexibility, you can have Declude JunkMail pass parameters to your program, using variables. For example, you can set up the test as 'TESTNAME external returnvalue "filename %INOROUT%"', which would send the %INOROUT% variable as a parameter to your program (which would be "incoming" for an incoming E-mail, or "outgoing" for an outgoing E-mail). Presumably, we could write a custom executable and define a rule for it in Junkmail. The custom executable would get the entire message body and just pipe it to a stand-alone file. If the message was later also delivered to an iMail mailbox, that's fine. However, I think the issue with that idea is that the filters will not have executed when that custom executable is called. Accoring to the Declude manaul, the order of execution is: 1. IMail's Control Access file (to block IPs) 2. IMail's Kill List (to block return addresses) 3. IMail v8 anti-spam (most tests) 4. Declude Virus 5. Declude Hijack 6. Declude JunkMail 7. IMail's filters and extra IMail v8 anti-spam tests *we want to insert a custom exectuable here Is this even possible, or should I just start looking as Linux mail systems? -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Problems with versions 2.0.6.16
1. Declude EVA (already posted to the Virus List): I have updated Declude to version 2.0.6.16 yesterday. Since installing the update i got no more notification mails to my postmaster account when an Outlook vulnerability was detected. I can see the detected mail in my hold folder, but no mail to postmaster is sent. I still get notifications for detected viruses. I only have an postmaster.eml in my declude directory and i have the pro version licensed. In version 2.0.6.10 the notifications for vulnerabilities have worked. 2. Declude JunkMail: Mail sent to an alias triggers a test called JUNK-RDNS (Action=ROUTETO)and one of our WEIGHT tests (Action=COPYTO). Since installing 2.0.6.16 both actions are applied to the mail. IMAIL log: SMTPD (c01801240c33) [61.218.17.34] HELO queenpuo.com.tw SMTPD (c01801240c33) [61.218.17.34] MAIL FROM:<[EMAIL PROTECTED]> SMTPD (c01801240c33) [61.218.17.34] RCPT TO:<[EMAIL PROTECTED]> SMTPD (c01801240c33) [61.218.17.34] f:\SPOOL\Dc01801240c33.SMD 31238 SMTPD (c01801240c33) performing antispam checks SMTP (c01801240c33) processing f:\SPOOL\Qc01801240c33.SMD SMTP (c01801240c33) ldeliver cadfem.org spamtest-rdns (1) [EMAIL PROTECTED] 31686 SMTP (c01801240c33) ldeliver cadfem.org spamtest-weight10 (1) [EMAIL PROTECTED] 31686 SMTP (c01801240c33) finished f:\SPOOL\Qc01801240c33.SMD status=1 Heinrich --- This E-mail was scanned for viruses by CAD-FEM GmbH * Join the FEM Parliament! 23. CADFEM Users´ Meeting International Congress on FEM Technology with ANSYS CFX & ICEM CFD Conference November 9 - 11, 2005 Bundeshaus Bonn, Germany www.usersmeeting.com * * This message and any attachment are confidential. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system. If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person. For further information about CADFEM please see our website: http://www.cadfem.de. * --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
