Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - no forwarding
  FAQ FAQ  Forum Search   Register Register  Login Login

no forwarding

 Post Reply Post Reply
Author
Vince View Drop Down
Newbie
Newbie


Joined: 17 July 2007
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote Vince Quote  Post ReplyReply Direct Link To This Post Topic: no forwarding
    Posted: 17 July 2007 at 2:27pm

Hi, I have a problem with an email reception. As you see here, the number 12624 is accepted but never forwarding. The sender tries many times but always the same problem.  

v.3.5.4.692

07/10/07 18:14:46:765 -- (12624) Connection from: 66.235.211.153  -  Originating country : United States

07/10/07 18:14:51:578 -- (12624) - SPF analysis for mainehh.com done: - none

07/10/07 18:14:51:578 -- (12624) Mail from: john@mainehh.com

07/10/07 18:14:53:968 -- (12624) - MAPS search done...

07/10/07 18:14:53:968 -- (12624) RCPT TO: JRLADOUCEUR@BAINULTRA.COM accepted

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 17 July 2007 at 3:22pm

Vince,

You do not see anything like the below:

07/10/07 18:14:53::xxx -- (12624) Checking SURBL
07/10/07 18:14:53::xxx -- (12624) Start virus scan
07/10/07 18:14:53::xxx -- (12624) Starting queueing procedures
07/10/07 18:14:53::xxx -- (12624) EMail from john@mainehh.com to JRLADOUCEUR@BAINULTRA.COM was queued. Size: 5 KB, 5120 bytes

07/10/07 18:14:53::xxx -- (12624) Sending email from john@mainehh.com to JRLADOUCEUR@BAINULTRA.COM --

07/10/07 18:14:53::xxx -- (12624) Disconnect



Edited by Desperado
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
Vince View Drop Down
Newbie
Newbie


Joined: 17 July 2007
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote Vince Quote  Post ReplyReply Direct Link To This Post Posted: 17 July 2007 at 4:57pm

I only see what I post before. Here are more line in the logfile...

07/10/07 18:14:40:250 -- (10404) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
07/10/07 18:14:40:250 -- (10404) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
07/10/07 18:14:40:250 -- (10828) Blacklist cache - starting cleanup
07/10/07 18:14:40:265 -- (10828) Blacklist cache - removed IP 62.139.252.202 from cache during cleanup
07/10/07 18:14:44:921 -- (10692) Connection from: 83.4.90.220  -  Originating country : Poland
07/10/07 18:14:46:765 -- (12624) Connection from: 66.235.211.153  -  Originating country : United States
07/10/07 18:14:49:515 -- (10692) - IP address is from a blacklisted country...
07/10/07 18:14:49:531 -- (10692) 83.4.90.220 - Mail from: bwarestroom@compassinvest.net To: wjetjqnqtucnb@bainsultra.com will be rejected
07/10/07 18:14:50:734 -- (10556) Connection from: 201.43.67.236  -  Originating country : Brazil
07/10/07 18:14:50:968 -- (10556) No Data Received
07/10/07 18:14:50:968 -- (10556) Disconnect
07/10/07 18:14:51:578 -- (12624) - SPF analysis for mainehh.com done: - none
07/10/07 18:14:51:578 -- (12624) Mail from: john@mainehh.com
07/10/07 18:14:53:968 -- (12624) - MAPS search done...
07/10/07 18:14:53:968 -- (12624) RCPT TO: JRLADOUCEUR@BAINULTRA.COM accepted
07/10/07 18:14:56:593 -- (10692) Starting quarantine procedures
07/10/07 18:14:56:609 -- (10692) Created thread (10556) to add email to quarantine
07/10/07 18:14:57:046 -- (10556) EMail from bwarestroom@compassinvest.net to wjetjqnqtucnb@bainsultra.com was received and quarantined. Size: 9 KB, 9216 bytes
07/10/07 18:14:59:937 -- (10692) Blacklist cache - Added 83.4.90.220 to limbo
07/10/07 18:15:00:125 -- (10692) SFDB - Added 83.4.90.220 - Response: Error=0
07/10/07 18:15:00:125 -- (10692) Disconnect
07/10/07 18:15:04:812 -- (10692) Connection from: 85.242.226.137  -  Originating country : Portugal
07/10/07 18:15:06:546 -- (10692) - IP address is from a blacklisted country...
07/10/07 18:15:06:546 -- (10692) 85.242.226.137 - Mail from: xpburr@yehey.com To: duncan@bainsultra.com will be rejected
07/10/07 18:15:08:062 -- (10692) Starting quarantine procedures
07/10/07 18:15:08:078 -- (10692) Created thread (10556) to add email to quarantine
07/10/07 18:15:08:140 -- (10556) EMail from xpburr@yehey.com to duncan@bainsultra.com was received and quarantined. Size: 4 KB, 4096 bytes
07/10/07 18:15:08:250 -- (10692) Blacklist cache - Added 85.242.226.137 to limbo
07/10/07 18:15:08:437 -- (10692) SFDB - Added 85.242.226.137 - Response: Error=0
07/10/07 18:15:08:437 -- (10692) Disconnect
07/10/07 18:15:40:265 -- (10556) Running TTerminateIdleThreads - SFTC=1 - SFFC=1
07/10/07 18:15:40:281 -- (10556) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=1
07/10/07 18:15:40:281 -- (10436) Blacklist cache - starting cleanup
07/10/07 18:15:40:296 -- (10436) Blacklist cache - removed IP 168.226.12.97 from cache during cleanup
07/10/07 18:15:40:296 -- (10436) Blacklist cache - removed IP 85.103.39.2 from limbo during cleanup
07/10/07 18:15:44:062 -- (10372) Connection from: 24.115.128.87  -  Originating country : United States
07/10/07 18:15:45:609 -- (10372) - SPF analysis for feedroom.com done: - none
07/10/07 18:15:45:609 -- (10372) Mail from: Derekguidancesyntheses@feedroom.com
07/10/07 18:15:45:781 -- (10372) - MAPS search done... 521 The IP 24.115.128.87 is Blacklisted by bl.spamcop.net. Blocked - see http://www.spamcop.net/bl.shtml?24.115.128.87 --
07/10/07 18:15:45:781 -- (10372) 24.115.128.87 - Mail from: Derekguidancesyntheses@feedroom.com To: arenaud@bainsultra.com will be rejected
07/10/07 18:15:46:437 -- (10372) Starting quarantine procedures
07/10/07 18:15:46:437 -- (10372) Created thread (10692) to add email to quarantine
07/10/07 18:15:46:562 -- (10692) EMail from Derekguidancesyntheses@feedroom.com to arenaud@bainsultra.com was received and quarantined. Size: 1 KB, 1024 bytes
07/10/07 18:15:46:875 -- (10372) Blacklist cache - Added 24.115.128.87 to limbo
07/10/07 18:15:47:062 -- (10372) SFDB - Added 24.115.128.87 - Response: Error=0
07/10/07 18:15:47:062 -- (10372) Disconnect
07/10/07 18:15:50:375 -- (10372) Connection from: 81.172.124.242  -  Originating country : Spain
07/10/07 18:15:55:671 -- (12624) Disconnect

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 17 July 2007 at 5:16pm

Vince,

The last line:07/10/07 18:15:55:671 -- (12624) Disconnect
is very close to 60 seconds after the first connection line:
07/10/07 18:14:46:765 -- (12624) Connection from: 66.235.211.153  -  Originating country : United States.
Could the server you are forwarding to be timing out? Can you try the following in your INI File:
ReadTimeout=120
ReadTimeoutOutgoing=120

I may be barking up the wrong tree but ...

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 17 July 2007 at 10:01pm
Vince,

Desperado should be correct. We received your log via FTP, and we came to the same explanation.

SpamFilter has a 60-second built-in timeout, and if no data is received during that time, the connection will be dropped.

It's possible for example, that there is a firewall/virus scanning software intercepting the email before SpamFilter (this can be on the receiving or the sender's end). The firewall/antivirus is intercepting all of the packets sent after the DATA command, and only after the whole email is processed, the firewall proceeds to forward the data to SpamFilter. Normally this was not a problem, but when large attachments arrived, and/or the internet connection is slow, the firewall could "stall" SpamFilter, while the attachment is being received. Since SpamFilter is not receiving any packets, after 60 seconds SpamFilter drops the connection thinking it is a spammer.


Increasing the ReadTimeout value in the SpamFilter.ini file to a higher value, like 120 or 300 seconds should solve the issue.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.133 seconds.