Re: [Declude.JunkMail] re: Strange logging
I don't know about log analyzers, but there's a way around message interlacing for manual log review. BBEdit shows search results in a new window, so I search for the messages code (like D06f811ed0094f08e) and every line with the code is isolated and displayed in a sigle concise package. I don't know if text editors for Windows have similar functionality. A more labor intensive way to do the same thing is wiping out the time in the mixed entries and then auto sorting. Dan On Wednesday, July 2, 2003 17:57, Kevin Bilbee <[EMAIL PROTECTED]> wrote: >Note some of the log lines in the attached log snip are merged together I >caught this when my log analyser told me that I have a test called >SPAM07/02/2003 > >LOGLEVELHIGH >Declude version 1.70i14 > >Look at the time slice if 09:24:32 - 09:24:33 it looks like 6 processes were >trying to write to the log at the same time. > > >Kevin Bilbee >Network Administrator >Standard Abrasives, Inc. >[EMAIL PROTECTED] >(805) 520-5800 x7332 > >Changing the way industry works. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] re: Strange logging
>>I caught this when my log analyser told me that I have a test called >>SPAM07/02/2003 >This does seem to happen occasionally when several processes >are appending >to a text file in a very short period of time (not just with >Declude; it >happens with IMail SMTP32.exe processes as well). My guess is >that when an >internal OS buffer gets hit, rather than waiting for it to >clear, the OS >just saves part of what it is supposed to. > >-Scott We also see this quite a bit with Message Sniffer logs. Consistently the logs from Winx systems have these kinds of "odd mergers". The only way to solve it is to serialize access to the log files - which slows things down so we don't do it. _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] re: Strange logging
I love email, I received your reply about an hour and a half before I received my post, and the headers show the delay was in delivery to my mail server from declude.com, yet I received 4 other posts between. Don't worry about finding what happened, I'm sure it is temporary errors (my server busy) combined with 30 queue times. Just making an observation. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, July 03, 2003 9:54 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] re: Strange logging >Does anyone know if Virus has the same issue? Yes, it should. >Scott, ever thought about sending writes to the console app and using it >as a buffer to prevent overlaps? That still might not work (although probably would) -- if the OS can mangle writes from two separate processes, it could also mangle two consecutive writes from the same process. The amount of testing that would be required would be quite high (since it isn't an easily reproducible situation). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] re: Strange logging
When I wrote the stats grapher app, I ran across the same problem at all log levels (I generally run MID). When I mentioned it on the list, some otheres who wrote log analyzers had noticed the same thing. I'm sure it has to do with the volume of mail received, since more mail means more declude processes running and increased likelyhood of two or more trying to write to the logs at the same time. Does anyone know if Virus has the same issue? Scott, ever thought about sending writes to the console app and using it as a buffer to prevent overlaps? Of course then there's the issue of resetting Hijack by killing deccon.exe, so you would have to look at some way of sending a reset signal to Hijack counts instead. Just a thought for the very long suggestion database. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, July 02, 2003 7:58 PM To: JunkMail Declude Subject: [Declude.JunkMail] re: Strange logging Note some of the log lines in the attached log snip are merged together I caught this when my log analyser told me that I have a test called SPAM07/02/2003 LOGLEVELHIGH Declude version 1.70i14 Look at the time slice if 09:24:32 - 09:24:33 it looks like 6 processes were trying to write to the log at the same time. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] re: Strange logging
Does anyone know if Virus has the same issue? Yes, it should. Scott, ever thought about sending writes to the console app and using it as a buffer to prevent overlaps? That still might not work (although probably would) -- if the OS can mangle writes from two separate processes, it could also mangle two consecutive writes from the same process. The amount of testing that would be required would be quite high (since it isn't an easily reproducible situation). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] re: Strange logging
Note some of the log lines in the attached log snip are merged together I caught this when my log analyser told me that I have a test called SPAM07/02/2003 LOGLEVELHIGH Declude version 1.70i14 Look at the time slice if 09:24:32 - 09:24:33 it looks like 6 processes were trying to write to the log at the same time. This does seem to happen occasionally when several processes are appending to a text file in a very short period of time (not just with Declude; it happens with IMail SMTP32.exe processes as well). My guess is that when an internal OS buffer gets hit, rather than waiting for it to clear, the OS just saves part of what it is supposed to. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
