Hello Andy,


Friday, August 3, 2007, 5:16:32 PM, you wrote:


>

Sorry for cross-posting. I’m not sure whether Declude and/or Sniffer still rely on the Paged Pool – and whether their usage would be reported under the Imail QueueMgr.exe or under some other .exes? So I have 3 possible culprits…

The symptom started as a Webmail problem because customers noticed they couldn't send emails any longer due to "Bad Socket State". However, when I log into the physical machine, the REAL problem is that I cannot open ANY TCP/IP connections to any IP address (on that same machine or on neighboring machines). I can still PING (is ICMP works), but TELNET, FTP, HTTP - all are unable to create a socket.

FTP.exe reported that it doesn't have enough buffer space. 

That caused me to turn on "Task Manager" and add the columns for "VM Size" and "Paged Pool". Normally, the various processes only use less than 100K of "Paged Pool" - even the IIS Web Process uses only 300K.

However, QueueManager was up to 4500K.  Restarting QueueMgr.exe service reset it to 200K or so. But, I there are time spans where it consumes an extra K every second - now already up to 800 K again - before it levels off for a while and then keeps doing it again.

Oddly enough, this problem only started yesterday - even though 2006.21 has been running since 7/16/2007 - and now seems to accelerate (happened twice today!)

My obvious suspicion is that there is a 'certain' email or type of spam that's causing this QueueMgr behavior - what else would account for this to start happening NOW.

 


This doesn't sound like something SNF would do. Every message is processed exactly the same way regardless of the type of message - so it is extremely unlikely that a change in data would effect SNFs memory footprint. The rulebase changes every few hours - but there are no other new reported problems like this so here again it is unlikely to be SNF related.


SNF doesn't do anything weird with memory -- everything is allocated through very ordinary channels in very ordinary ways, so unless the OS decides to do something different with it you shouldn't see any special requirements.


Hope this helps,


_M


-- 

Pete McNeil

Chief Scientist,

Arm Research Labs, LLC.

#############################################################
This message is sent to you because you are subscribed to
  the mailing list <sniffer@sortmonster.com>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to  <[EMAIL PROTECTED]>



Reply via email to