RE: DCC problems
On Tue, July 7, 2009 23:15, Rosenbaum, Larry M. wrote: > Thanks. It was a firewall issue. with now turns into a html issue on maillist :) -- xpoint
RE: DCC problems
Thanks. It was a firewall issue. From: Michael Scheidell [mailto:scheid...@secnap.net] Sent: Tuesday, July 07, 2009 2:54 PM To: Rosenbaum, Larry M. Cc: users@spamassassin.apache.org Subject: Re: DCC problems Rosenbaum, Larry M. wrote: Recently I've started seeing message like this in our log files: Jul 7 13:22:48 ornl73 dccifd[21907]: [ID 702911 mail.notice] no working DCC serversdcc1.dcc-servers.net dcc2.dcc-servers.net dcc3.dcc-servers.net ... at 64.124.52.232 208.201.249.2 Jul 7 13:22:48 ornl73 dccifd[21907]: [ID 702911 mail.error] no working DCC serversdcc1.dcc-servers.net dcc2.dcc-servers.net dcc3.dcc-servers.net ... at 64.124.52.232 208.201.249.2 Jul 7 13:22:52 ornl73 last message repeated 4 times Jul 7 13:22:55 ornl73 dccifd[21907]: [ID 702911 mail.error] continue not asking DCC 2045 seconds after failure Jul 7 13:23:00 ornl73 dccifd[21907]: [ID 702911 mail.error] continue not asking DCC 2040 seconds after failure Try doing a cdcc rtt then find out if someone monitoring the ornl.gov firewalls mucked with the udp settings. if you are using the public servers and are doing more then 100,000 'opts' a day, you might have gotten rate limited. oh, and if you are inside of a freebsd jail, you need version .111 or better of DCC. -- Michael Scheidell, CTO Phone: 561-999-5000, x 1259 > | SECNAP Network Security Corporation * Certified SNORT Integrator * 2008-9 Hot Company Award Winner, World Executive Alliance * Five-Star Partner Program 2009, VARBusiness * Best Anti-Spam Product 2008, Network Products Guide * King of Spam Filters, SC Magazine 2008 This email has been scanned and certified safe by SpammerTrap(r). For Information please see www.secnap.com/products/spammertrap/<http://www.secnap.com/products/spammertrap/>
Re: DCC problems
Rosenbaum, Larry M. wrote: Recently I've started seeing message like this in our log files: Jul 7 13:22:48 ornl73 dccifd[21907]: [ID 702911 mail.notice] no working DCC serversdcc1.dcc-servers.net dcc2.dcc-servers.net dcc3.dcc-servers.net ... at 64.124.52.232 208.201.249.2 Jul 7 13:22:48 ornl73 dccifd[21907]: [ID 702911 mail.error] no working DCC serversdcc1.dcc-servers.net dcc2.dcc-servers.net dcc3.dcc-servers.net ... at 64.124.52.232 208.201.249.2 Jul 7 13:22:52 ornl73 last message repeated 4 times Jul 7 13:22:55 ornl73 dccifd[21907]: [ID 702911 mail.error] continue not asking DCC 2045 seconds after failure Jul 7 13:23:00 ornl73 dccifd[21907]: [ID 702911 mail.error] continue not asking DCC 2040 seconds after failure Try doing a cdcc rtt then find out if someone monitoring the ornl.gov firewalls mucked with the udp settings. if you are using the public servers and are doing more then 100,000 'opts' a day, you might have gotten rate limited. oh, and if you are inside of a freebsd jail, you need version .111 or better of DCC. -- Michael Scheidell, CTO Phone: 561-999-5000, x 1259 > *| *SECNAP Network Security Corporation * Certified SNORT Integrator * 2008-9 Hot Company Award Winner, World Executive Alliance * Five-Star Partner Program 2009, VARBusiness * Best Anti-Spam Product 2008, Network Products Guide * King of Spam Filters, SC Magazine 2008 _ This email has been scanned and certified safe by SpammerTrap(r). For Information please see http://www.secnap.com/products/spammertrap/ _
DCC problems
Recently I've started seeing message like this in our log files: Jul 7 13:22:48 ornl73 dccifd[21907]: [ID 702911 mail.notice] no working DCC serversdcc1.dcc-servers.net dcc2.dcc-servers.net dcc3.dcc-servers.net ... at 64.124.52.232 208.201.249.2 Jul 7 13:22:48 ornl73 dccifd[21907]: [ID 702911 mail.error] no working DCC serversdcc1.dcc-servers.net dcc2.dcc-servers.net dcc3.dcc-servers.net ... at 64.124.52.232 208.201.249.2 Jul 7 13:22:52 ornl73 last message repeated 4 times Jul 7 13:22:55 ornl73 dccifd[21907]: [ID 702911 mail.error] continue not asking DCC 2045 seconds after failure Jul 7 13:23:00 ornl73 dccifd[21907]: [ID 702911 mail.error] continue not asking DCC 2040 seconds after failure I don't see any messages on the DCC home page http://www.rhyolite.com/dcc/ to indicate any problems with the DCC servers. Does anybody have any ideas what's wrong? Thanks, Larry
Re: Upgrade my rules to Steroid Strength? - amavisd-new stats/dcc problems
Hi Johan, Johan Barelds wrote: > > Op maandag 13 december 2004 21:08, schreef Sam Nilsson: > >>SpamAssassin version 3 is amazing when combined with network tests. >> >>These are my top tests. This shows percentage of spam that each test >>correctly marked as such: >> >>98.21 % 275 : BAYES_99 >>96.43 % 270 : RAZOR2_CF_RANGE_51_100 >>96.43 % 270 : RAZOR2_CHECK >>91.07 % 255 : URIBL_WS_SURBL >> >>also very, very good: >> >>55.36 % 155 : DCC_CHECK >>52.50 % 147 : PYZOR_CHECK >> >>You already have the BAYES test running. I recommend installing Razor2, >>DCC, and Pyzor. The SURBL rules are already installed and ready to go on >>SA v3, but they won't run (and neither will Razor, DCC, or Pyzor) if >>network tests are disabled. >> >>More info on these test: >> >>http://wiki.apache.org/spamassassin/NetworkTests >> >>To get make sure these things are working I have this in my local.cf >>(spamassassin conf file): >> >>skip_rbl_checks 0 >>dns_available yes >> >> >>These network tests require that you have a network connection when you >>run SA. If you don't you should try to change that. These DNSRBL tests >>are key in removing almost all of my spam (as you can see from the >>statistics). >> >>- Sam Nilsson > > Hi Sam! I read you story and just wondered a few things: 1. How do you get this statistical info? amavislogsumm which can be found at: http://www.ijs.si/software/amavisd/#contrib 2. Don't you have problems with dcc? i didn't realize it until now, but yes. according to my logs i'm getting around 5 of those a day, sometimes less or none, since early november. i'm not on the DCC list. do you know what is going on with it? i assume that the mail is still getting delivered when dccproc fails, but i haven't checked that yet. I do get the following message all the time: -- dccproc[3421]: missing message body; fatal error -- I don't believe dcc is really working for me. Btw i use the following config: spamassassin-3.0.0-3 amavisd-new-2.1.2-5 postfix-2.1.5-3 dcc 2.4.1 i run a very similar setup on freebsd 4.10 except that i seem to have DCC version 1.2.48 installed. i simply installed it from the ports system (actually the SpamAssassin port installed it as a dependency i think), unfortunately I don't really know anything about the DCC project, nor do i know why we have drastically different version numbers. - Sam Nilsson
