[xmail] Re: [SPAM] Re: crazy spams

[Jeffrey Laramie]

On Wednesday 22 February 2006 18:07, Eric Garnice wrote:
> Spam detection software, running on the system "WebServer3.DMZ", has
> identified this incoming email as possible spam.  The original message
> has been attached to this so you can view it (if it isn't spam) or label
> similar future email.  If you have any questions, see
> [EMAIL PROTECTED] for details.
>
> Content preview:  Here's a fine attempt: X-Spam-Flag: YES
>   X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on
>   kermit.ms.comstock.com X-Spam-Level: X-Spam-Status: Yes, score=175.5

Very impressive! Just the headers alone were enough to trigger my filter.

>   required=6.5 tests=BAYES_99,DCC_CHECK,
>   DIGEST_MULTIPLE,DNS_FROM_RFC_ABUSE,ENTITY_DEC_ALPHANUM,HTML_90_100,
>   HTML_MESSAGE,J_WEEDS_A,J_WEEDS_B,J_WEEDS_C,J_WEEDS_D,J_WEEDS_E,
>   J_WEEDS_F,J_WEEDS_G,J_WEEDS_H,J_WEEDS_L,J_WEEDS_M,J_WEEDS_N,J_WEEDS_O,
>   J_WEEDS_P,J_WEEDS_R,J_WEEDS_S,J_WEEDS_T,J_WEEDS_U,J_WEEDS_V,J_WEEDS_W,
>   J_WEEDS_Y,MIME_BOUND_DD_DIGITS,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,
>   MISSING_MIMEOLE,MSGID_SPAM_CAPS,PYZOR_CHECK,RATWARE_EGROUPS,
>   RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,
>   RCVD_IN_BL_SPAMCOP_NET,RCVD_NUMERIC_HELO,SARE_FORGED_EBAY,
If you check the scores this one got 104 points ->   ^
I've never seen that one but you're also using some modules I don't have 
installed.

Jeff
-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]

[xmail] Re: crazy spams

[Eric Garnice]

Here's a fine attempt:

X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on
kermit.ms.comstock.com
X-Spam-Level: **
X-Spam-Status: Yes, score=175.5 required=6.5 tests=BAYES_99,DCC_CHECK,
DIGEST_MULTIPLE,DNS_FROM_RFC_ABUSE,ENTITY_DEC_ALPHANUM,HTML_90_100,
HTML_MESSAGE,J_WEEDS_A,J_WEEDS_B,J_WEEDS_C,J_WEEDS_D,J_WEEDS_E,
J_WEEDS_F,J_WEEDS_G,J_WEEDS_H,J_WEEDS_L,J_WEEDS_M,J_WEEDS_N,J_WEEDS_O,
J_WEEDS_P,J_WEEDS_R,J_WEEDS_S,J_WEEDS_T,J_WEEDS_U,J_WEEDS_V,J_WEEDS_W,
J_WEEDS_Y,MIME_BOUND_DD_DIGITS,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,
MISSING_MIMEOLE,MSGID_SPAM_CAPS,PYZOR_CHECK,RATWARE_EGROUPS,
RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,
RCVD_IN_BL_SPAMCOP_NET,RCVD_NUMERIC_HELO,SARE_FORGED_EBAY,
SARE_SPOOF_COM2COM,SARE_SPOOF_OURI,SPF_SOFTFAIL,SPOOF_OURI,
UNPARSEABLE_RELAY,URIBL_AB_SURBL,URIBL_SC_SURBL,USER_IN_WHITELIST,
X_PRIORITY_HIGH autolearn=no version=3.1.0
X-Spam-Report:
*  0.4 X_PRIORITY_HIGH Sent with 'X-Priority' set to high
*  4.5 MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary
*  2.6 RATWARE_EGROUPS Bulk email fingerprint (eGroups) found
*  4.4 MSGID_SPAM_CAPS Spam tool Message-Id: (caps variant)
* -6.0 USER_IN_WHITELIST From: address is in the user's white-list
*  1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
*  [SPF failed: Please see 
http://www.openspf.org/why.html?sender=suspension%40ebay.com&ip=63.95.15.5&receiver=kermit.ms.comstock.com]
*  1.5 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
*  0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay
*  lines
*  0.1 SPOOF_OURI URI: URI has items in odd places
*  2.5 SARE_SPOOF_COM2COM URI: a.com.b.com
*  2.5 SARE_SPOOF_OURI URI: URL has items in odd places
*  0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
*  0.0 HTML_MESSAGE BODY: HTML included in message
*   15 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
*  [score: 1.]
*  0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
*  0.1 ENTITY_DEC_ALPHANUM RAW: HTML contains needlessly encoded
*  characters
*  1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]
*  1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]
*  1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]
*  1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]
*  1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]
*  1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]
*  1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]
*  1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]
*  1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]
*  1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]
*  1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]
*  1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]
*  1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]
*  1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]
*  1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]
*  1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]
*  1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]
*  1.0 J_WEEDS_B FULL: Dec/Hex char Enc [Bb]
*  1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]
*  1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]
*  2.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
*  1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
*  above 50%
*  [cf: 100]
*  0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
*  [cf: 100]
*  3.7 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
*  2.2 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
*  0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org
*  1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in 
bl.spamcop.net
*  [Blocked - see ]
*  3.8 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
*  [URIs: westtec.net]
*  4.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
*  [URIs: westtec.net]
*  0.8 DIGEST_MULTIPLE Message hits more than one network digest check
*  104 SARE_FORGED_EBAY Message appears to be forged, (ebay.com)
*  0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME
*  parts
*  1.6 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
Received: from relay3.iworld.com ([63.95.15.5]:40762)
by xmail.ms.comstock.com with [XMail 1.21 ESMTP Server]
id  for <[EMAIL PROTECTED]> from <[EMAIL PROTECTED]>;
Wed, 22 Feb 2006 16:39:53 -0500
X-RBL: Mail.from.72.11.69.150.refused.by.blackhole.site.bl.spamcop.net
Received: from 72.11.69.150 ([72.11.69.150])
by relay3.iworld.com (8.12.10/8.12.10) with SMTP id k1MLc6x1004958
for <[EMAIL PROTECTED]>; Wed, 22 Feb 2006 16:38:27 -0500 (EST)
Received: from 68.52.220.50 by ; Wed, 22 Feb 2006 23:43:35 +0200
Message-ID: <[EMAIL PROTECTED]>
From: "[EMAIL PROTECTED]" <[EMAIL PRO

[xmail] Re: crazy spams

[Jorn Hass]

Hello Mr,

Wednesday, February 22, 2006, 5:56:42 PM, you wrote:


> I made it available here for anyone who wants the full deal.

> http://thebatchfile.com:8080/junk/spamemail/

> This one is labled with ***spam*** cause I use ASSP and this email was
> in the catch all account, but you can clearly see its contruction.



> On 2/22/06, Jorn Hass <[EMAIL PROTECTED]> wrote:
>>
>>
>> > Dunno what my own mail will rate, as it has the full erectile (:P)
>> > names in there... :)
>>
>> Ok, so I'm obviously a better spammer than I thought, when it comes to
>> evading spamassassin rules... :) Spamassassin shows:
>> X-Spam-Status: No, score=3D2.2 required=3D7.0 tests=3DAWL,DRUGS_ANXIETY,
>>
>> DRUGS_ANXIETY_EREC,DRUGS_ERECTILE,DRUG_ED_CAPS,RCVD_IN_WHOIS_BOGO=
> NS,
>> SPF_HELO_PASS,SPF_PASS,UNPARSEABLE_RELAY autolearn=3Dno version=
> =3D3.1.0
>> A measly 2.2...
>>
>> So, maybe we should have a contest to see who can create an email to
>> score the highest against spamassasssin? The award of lousiest spammer
>> is up for grabs... :)
>>
>>
>> --
>> Best regards,
>>  Jornmailto:[EMAIL PROTECTED]
>>
>> -
>> To unsubscribe from this list: send the line "unsubscribe xmail" in
>> the body of a message to [EMAIL PROTECTED]
>> For general help: send the line "help" in the body of a message to
>> [EMAIL PROTECTED]
>>
>>
> -
> To unsubscribe from this list: send the line "unsubscribe xmail" in
> the body of a message to [EMAIL PROTECTED]
> For general help: send the line "help" in the body of a message to
> [EMAIL PROTECTED]

Ok, according to the logfiles, spamassassin rejected the message:
"2006-02-22 19:53:06"   "SPAM"  14.0"S: [EMAIL PROTECTED]""R: [EMAIL 
PROTECTED]"
Not bad, a 14.0... We reject from 7.00 onwards... :)

Spamassassin logfile says:

Feb 22 19:53:06 mailbox spamd[61912]: spamd: result: Y 13 - 
NO_RELAYS,URIBL_AB_SURBL,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL 
scantime=1.2,size=1312,user=root,uid=65534,required_score=7.0,rhost=localhost,raddr=127.0.0.1,rport=63813,mid=<[EMAIL
 PROTECTED]>,autolearn=no

Which basically means it got rejected mostly based in the URL that the
email contained... I am going to play a bit more with this, and see if
it can pick up the embedded stuff, without the url...

Spamassassin might need to be taught some extra tricks...

-- 
Best regards,
 Jornmailto:[EMAIL PROTECTED]

-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]

[xmail] Re: crazy spams

[Mr Sexy]

well like i said in a previous email I had no luck with SA on windoze.


On 2/22/06, Alexander Hagenah <[EMAIL PROTECTED]> wrote:
> [EMAIL PROTECTED] schrieb am Wednesday, February 22, 2006 4:57
> PM:
>
> > I made it available here for anyone who wants the full deal.
> >
> > http://thebatchfile.com:8080/junk/spamemail/
> >
> > This one is labled with ***spam*** cause I use ASSP and this email was
> > in the catch all account, but you can clearly see its contruction.
>
> Just look the inside the mail-body. The E-Mail is full of div/span tags and
> floats with plain ASCII-Chars.
> No wonder, that your SPAM-Filter didn't recognize it.
>
> Use SA with Bayes-Filter and your problem will be gone with the wind after
> few mails kind of that.
>
> --
>
> Regards,
> Alexander Hagenah
> http://xmail.topconcepts.net
>
>
> -
> To unsubscribe from this list: send the line "unsubscribe xmail" in
> the body of a message to [EMAIL PROTECTED]
> For general help: send the line "help" in the body of a message to
> [EMAIL PROTECTED]
>
>
-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]

[xmail] Re: crazy spams

[Jorn Hass]

Hello Mr,

Wednesday, February 22, 2006, 5:56:42 PM, you wrote:


> I made it available here for anyone who wants the full deal.

> http://thebatchfile.com:8080/junk/spamemail/

> This one is labled with ***spam*** cause I use ASSP and this email was
> in the catch all account, but you can clearly see its contruction.

Yeah, it's a general spammer trick...
They use hidden HTML tags to break up the word, so that "straight"
word filters do not pick it up...
If you actually look at the source it shows:

CaIjAbLsIzSr  as normal
characters, hence the junk... I can see the characters between the
span tags on the right of the screen on that page, so I presume that
the span and style float right makes it to "float" to the right,
leaving the rest behind... Neat trick...

Try and "bounce" the message directly to my address, (Copy and paste,
as reply will send to list...) and check what
happens. I want to see what spamassassin says. If it gets seen as
full spam, it will be rejected outright, otherwise it will pass it on
to me and I can see what "rating" it gets.

Do note that you will have to pass the grey-listing process first...

Obviously the bouncing waters down spamassassin, as it would look at
many more things, so it's not a true reflection...

-- 
Best regards,
 Jornmailto:[EMAIL PROTECTED]

-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]

[xmail] Re: crazy spams

[Mr Sexy]

yep html emails.

I tried to configure spam assassin on the server and failed at it.


On 2/22/06, Jorn Hass <[EMAIL PROTECTED]> wrote:
>
> Hello Mr,
>
> Wednesday, February 22, 2006, 3:24:20 PM, you wrote:
>
>
> > I get spam emails that are getting through.
>
> > They have cialis and viagra in em and if I try and select only the
> > work cialis and copy and paste it this is what you get in notepad.
>
> > VjAiLelwUcMj s$t1n,l2k1f
> > CwIxApLxIgSl a$g3u,z3l3m
> > VpIuAxGcRiAz v$y3s,h7o5v
>
> This is how they obfuscate their adverts. I presume that this spam is
> in HTML format? If you read every second character, you can se th
> words VALIUM, CIALIS, VIAGRA. Not sure where the funny rest gets
> added.
>
> Sometimes it is also marked as GAPPY text, although true gappy text
> w o u ld   b e   l i k e   t h i s . . .
>
> The easiest way to control spam is greylisting... Once they pass that,
> there is always spamassassin, although I have to admit that I am out
> of my depth with Windoze machines, and how to get things working on
> there...
>
> spamassasin rates your email as follows:
>
> X-Spam-Status: No, score=1.0 required=7.0 tests=DRUGS_ERECTILE
>
> Dunno what my own mail will rate, as it has the full erectile (:P)
> names in there... :)
>
> --
> Best regards,
>  Jornmailto:[EMAIL PROTECTED]
>
> -
> To unsubscribe from this list: send the line "unsubscribe xmail" in
> the body of a message to [EMAIL PROTECTED]
> For general help: send the line "help" in the body of a message to
> [EMAIL PROTECTED]
>
>
-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]

[xmail] Re: crazy spams

[Alexander Hagenah]

[EMAIL PROTECTED] schrieb am Wednesday, February 22, 2006 4:57
PM:

> I made it available here for anyone who wants the full deal.
>
> http://thebatchfile.com:8080/junk/spamemail/
>
> This one is labled with ***spam*** cause I use ASSP and this email was
> in the catch all account, but you can clearly see its contruction.

Just look the inside the mail-body. The E-Mail is full of div/span tags and
floats with plain ASCII-Chars.
No wonder, that your SPAM-Filter didn't recognize it.

Use SA with Bayes-Filter and your problem will be gone with the wind after
few mails kind of that.

--

Regards,
Alexander Hagenah
http://xmail.topconcepts.net


-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]

[xmail] Re: crazy spams

[Jeffrey Laramie]

On Wednesday 22 February 2006 10:47, Jorn Hass wrote:
> > Dunno what my own mail will rate, as it has the full erectile (:P)
> > names in there... :)
>
> Ok, so I'm obviously a better spammer than I thought, when it comes to
> evading spamassassin rules... :) Spamassassin shows:
> X-Spam-Status: No, score=2.2 required=7.0 tests=AWL,DRUGS_ANXIETY,
>
> DRUGS_ANXIETY_EREC,DRUGS_ERECTILE,DRUG_ED_CAPS,RCVD_IN_WHOIS_BOGONS,
> SPF_HELO_PASS,SPF_PASS,UNPARSEABLE_RELAY autolearn=no version=3.1.0 A
> measly 2.2...
>
> So, maybe we should have a contest to see who can create an email to
> score the highest against spamassasssin? The award of lousiest spammer
> is up for grabs... :)

A couple days ago I saw one that got a Spamassassin score of 58.4. All I could 
think of is: "Man, you really suck at this"

Jeff
-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]

[xmail] Re: crazy spams

[Mr Sexy]

I made it available here for anyone who wants the full deal.

http://thebatchfile.com:8080/junk/spamemail/

This one is labled with ***spam*** cause I use ASSP and this email was
in the catch all account, but you can clearly see its contruction.



On 2/22/06, Jorn Hass <[EMAIL PROTECTED]> wrote:
>
>
> > Dunno what my own mail will rate, as it has the full erectile (:P)
> > names in there... :)
>
> Ok, so I'm obviously a better spammer than I thought, when it comes to
> evading spamassassin rules... :) Spamassassin shows:
> X-Spam-Status: No, score=2.2 required=7.0 tests=AWL,DRUGS_ANXIETY,
> DRUGS_ANXIETY_EREC,DRUGS_ERECTILE,DRUG_ED_CAPS,RCVD_IN_WHOIS_BOGONS,
> SPF_HELO_PASS,SPF_PASS,UNPARSEABLE_RELAY autolearn=no version=3.1.0
> A measly 2.2...
>
> So, maybe we should have a contest to see who can create an email to
> score the highest against spamassasssin? The award of lousiest spammer
> is up for grabs... :)
>
>
> --
> Best regards,
>  Jornmailto:[EMAIL PROTECTED]
>
> -
> To unsubscribe from this list: send the line "unsubscribe xmail" in
> the body of a message to [EMAIL PROTECTED]
> For general help: send the line "help" in the body of a message to
> [EMAIL PROTECTED]
>
>
-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]

[xmail] Re: crazy spams

[Alexander Hagenah]

Hi,

[EMAIL PROTECTED] schrieb am Wednesday, February 22, 2006 2:24
PM:

> They have cialis and viagra in em and if I try and select only the
> work cialis and copy and paste it this is what you get in notepad.
>
> VjAiLelwUcMj s$t1n,l2k1f
> CwIxApLxIgSl a$g3u,z3l3m
> VpIuAxGcRiAz v$y3s,h7o5v

Let me expect - it was a HTML-Mail with a different Char-Set?

--

Regards,
Alexander Hagenah
http://xmail.topconcepts.net


-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]

[xmail] Re: FreeBSD woes...

[David Lord]

On 22 Feb 2006, at 9:47, Jorn Hass wrote:

> 
> Hello decker,
> 
> Wednesday, February 22, 2006, 2:14:00 AM, you wrote:
> 
> 
> > Hellos,
> 
> > I think this is the same patch yall are trying with, I couldn't
> > verify since the bug/pr database was "busy" when I just tried to
> > look. http://xmail.n3t.net/kern_event.c.patch
> 
> Yep, that's exactly the same patch.
> My box however, originally didn't last more than a day and then
> bombed... Haven't stop/started since...
> 5 days later:
>  Fri09AM  18:45.35 /var/MailRoot/bin/XMail
> 
> lsof output:
> 
> XMail   639 root  cwd   VDIR   4,27512  2 /
> XMail   639 root  rtd   VDIR   4,27512  2 /
> XMail   639 root  txt   VREG   4,37 323656  26940
> /var/MailRoot/bin/XMail XMail   639 root  txt   VREG  
> 4,27 142236  32165 /libexec/ld-elf.so.1 XMail   639 root 
> txt   VREG   4,27  20228 51 /lib/libkvm.so.2 XMail  
> 639 root  txt   VREG   4,27  28644 50
> /lib/libcrypt.so.2 XMail   639 root  txt   VREG   4,31
> 102568  47181 /usr/lib/libc_r.so.5 XMail   639 root  txt  
> VREG   4,31 834584  47354 /usr/lib/libstdc++.so.4 XMail  
> 639 root  txt   VREG   4,27 120004 52 /lib/libm.so.3
> XMail   639 root  txt   VREG   4,31 136020  47297
> /usr/lib/libpthread.so.1 XMail   639 root  txt   VREG  
> 4,27 884716 61 /lib/libc.so.5 XMail   639 root0u 
> IPv4 0xc1e46de00t0TCP mailbox:XMailCTL (LISTEN) XMail 
>  639 root1u  VCHR2,20t0 22 /dev/null XMail
>   639 root2u  VCHR2,20t0 22 /dev/null
> XMail   639 root3u  PIPE 0xc1d3d600  16384   
> ->0xc1d3d6ac XMail   639 root4u  PIPE 0xc1d3d6ac 
> 0->0xc1d3d600 XMail   639 root5u  IPv4 0xc1e47000 
>   0t0TCP mailbox:pop3 (LISTEN) XMail   639 root6u 
> IPv4 0xc1e47c240t0TCP mailbox:smtp (LISTEN) XMail  
> 639 root7u  IPv4 0xc1e47a680t0TCP localhost:finger
> (LISTEN) XMail   639 root8w  VREG   4,27  0 
> 32217 / (/dev/mirror/gm0s1a)
> 
> Not a single KQUEUE in sight... :)
> 
> David, just check if "lsof" gives you a similar output, or if there
> are glaring differences. Maybe something is not quite right in the
> garden of eden...
> 
> And please note that I tied the finger port to localhost only... :P

Above lsof output is similar to what I get now.

The patch certainly prevents kqueue entries but seems to destabilise 
the system. Since I'd been able to mostly get round the problem by 
restart of xmail at intervals of a couple of weeks or so I was then 
finding that once in a while there would be a kernel panic on 
stopping xmail. I'd decided it was a hardware related problem, either 
fault or incompatibility with FreeBSD > 4.7.

Before moving xmail to the 586-133 I had it running for some months 
on a Celeron 2400 box with FreeBSD 4.10 -> 5.2.1 -> 5.3 (GENERIC 
kernels), I had no problem at all but on checking now and starting 
xmail I can see that within about 30 minutes lsof indicates the 
KQUEUE problem is present.

More recently I'd seen mention of a disk/filesystem problem confirmed 
in FreeBSD 6, subsequently identified and supposedly fixed, and  that 
bug had been present through 5.x but I've not followed this up as I'm 
in process of moving back onto NetBSD anyway.

David

-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]

[xmail] Re: FreeBSD woes...

[decker]

Here's the output of lsof on this server without problems. hopefully sylpheed 
won't format it all funny for long lines..

: lsof -n -p 405
COMMAND PID USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
XMail   405 root  cwd   VDIR   4,12  512  2 /
XMail   405 root  rtd   VDIR   4,12  512  2 /
XMail   405 root  txt   VREG   4,17   323656
353338 /var/email/bin/XMail XMail   405 root  txt   VREG   4,12
141724  33040 /libexec/ld-elf.so.1 XMail   405 root  txt   VREG
4,1220228 51 /lib/libkvm.so.2 XMail   405 root  txt
VREG   4,1228644 50 /lib/libcrypt.so.2 XMail   405 root
txt   VREG   4,18   102568 707209 /usr/lib/libc_r.so.5 XMail   405
root  txt   VREG   4,18   834196 707423 /usr/lib/libstdc++.so.4
XMail   405 root  txt   VREG   4,12   120004 52 /lib/libm.so.3
XMail   405 root  txt   VREG   4,18   136020
707352 /usr/lib/libpthread.so.1 XMail   405 root  txt   VREG
4,12   883812 56 /lib/libc.so.5 XMail   405 root0u  IPv4
0xc27b0378  0t0TCP *:6017 (LISTEN) XMail   405 root1u
VCHR2,2  0t0 22 /dev/null XMail   405 root2u
VCHR2,2  0t0 22 /dev/null XMail   405 root3u  PIPE
0xc265c00016384->0xc265c0ac XMail   405 root4u  PIPE
0xc265c0ac0->0xc265c000 XMail   405 root5u  IPv4
0xc27b0534  0t0TCP *:pop3 (LISTEN) XMail   405 root6u  IPv4
0xc27b0a68  0t0TCP *:smtp (LISTEN) XMail   405 root7u  IPv4
0xc28a4000  0t0TCP *:finger (LISTEN)

they are pretty much identical..
note that i ipfw finger/79 from anywhere :P
if there is any other info that might help just lemme know.

-darren
-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]