Page 1 of 2 12 LastLast
Results 1 to 10 of 13
  1. #1
    Master Untangler
    Join Date
    Dec 2008
    Location
    Dallas, TX
    Posts
    337

    Default All messages blocked with spam score of 0

    Original problem was discussed in this thread:
    http://forums.untangle.com/installat...ng-e-mail.html

    All incoming messages - valid or not - were marked with a spam score of 0 and dropped. Sender received a 451 message - try again later.

    Untangle support logged in twice and worked on this problem but it returned over time. Support said the problem was due to database corruption. So I flattened the box and installed UT 8 from scratch. Everything worked fine for several weeks - until today.

    Again we had the same situation. All messages begin dropped with a spam score of 0. A restart of the UT box allows messages to flow again and they are being marked properly by Spam Assassin. Obviously this is a work around and not a "fix" to the problem.

    This is an Intel board with a DC 2.6GHz CPU, 4GB RAM and dual-port Intel NIC. There are about 15 users. This is box pounded by spammers on one specific user account - to the tune of about 1,000 messages an hour. Tarpitting is turned on and appears to be working well. All other aspects of the installation work fine. I had trial versions of Commtouch, Esoft and Kaspersky running but they have now expired. I was planning on subscribing to them but want to get this fixed first.

    Any ideas what causes this to happen and how can it be prevented?
    Last edited by itcinc; 12-12-2010 at 10:57 PM.

  2. #2
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    26,173

    Default

    Do you have attack blocker installed?
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  3. #3
    Master Untangler
    Join Date
    Dec 2008
    Location
    Dallas, TX
    Posts
    337

    Default

    Yes, Attack Blocker is installed and active.

  4. #4
    Untangle Ninja dwasserman's Avatar
    Join Date
    Jun 2008
    Location
    Argentina
    Posts
    4,366

    Default

    By chance can be a bad unistallation of trial ended?
    My better choice is build from scratch again, but only package (lite?) you own.
    The world is divided into 10 kinds of people, who know binary and those not

  5. #5
    Untangle Ninja mrunkel's Avatar
    Join Date
    Jul 2008
    Posts
    3,040

    Default

    This has nothing to do with the database. 451 - Try again later means that the box's load is too high to allow for further processing of messages.

    As soon as the load comes down, the box will allow messages through until the load is too high again.

    Are you sure tarpitting is working? What DNS servers do you have set in the Untnagle? If you're using any public DNS server tarpitting will not work.
    m.


    Big Frickin Disclaimer:
    While I'm pretty sure, I can't guarantee that I know what I'm doing. There might be a better way to do this, and this way might actually suck. Make sure you understand the implications of what you're doing before trying to follow these directions.

    It often helps troubleshooting if you have a good network map. Look here if you want my advice on how to draw one.
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

  6. #6
    Master Untangler
    Join Date
    Dec 2008
    Location
    Dallas, TX
    Posts
    337

    Default

    Yes, tarpitting is enabled and working. No, I am not using public DNS servers.

    I don't know if the senders received the 451 error this time but they did previously.

    However, if this is caused by excessive load it never reverts to processing spam properly. Once this condition occurs *no* mail is allowed through. *All* messages have a spam score of 0 and are dropped. It never reverts back to working *without* a reboot of the box.

    How can I see the load on the box during a specific time period - e.g. Sunday?

    Is there a way you can look up the notes from support on the previous incident? I will be glad to give you or any other UT employee access to the box.

    I need to be able to give the client some assurance that this is fixed before we spend the money on subscriptions. The last thing I want to do is purchase subscriptions for support, Esoft and Kaspersky only to have the product not work for them.
    Last edited by itcinc; 12-13-2010 at 10:30 PM. Reason: added request for load history

  7. #7
    Untangle Junkie dmorris's Avatar
    Join Date
    Nov 2006
    Location
    San Carlos, CA
    Posts
    17,747

    Default

    you can look at past loads in the reports or using atop (do a search)

    reports are probably easiest.
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

  8. #8
    Master Untangler
    Join Date
    Dec 2008
    Location
    Dallas, TX
    Posts
    337

    Default

    I have gone back and downloaded the CSVs for the Saturday and Sunday time period. I have attached 4 CSV files for the two days as a zip file to meet the file size posting limits.

    The spam summary stops at 11:32 on Saturday 12/12 and the next spam entry is on Sunday 12/13 at 15:38 right after I rebooted the server. During the 28 hour period all messages were marked as 0 and dropped - apparently with no entry in the spam event log. Spam summary reports are *not* included but are available if required.

    I do not see any evidence that the machine is overloaded - even around the time of failure. Please let me know what you think.
    Last edited by itcinc; 12-13-2010 at 11:32 PM. Reason: clarification of attachments

  9. #9
    Master Untangler
    Join Date
    Dec 2008
    Location
    Dallas, TX
    Posts
    337

    Default

    Dirk,

    Did you have a chance to look at the attached CSV files? I am still looking for a solution.....

  10. #10
    Untanglit
    Join Date
    Jan 2009
    Posts
    27

    Default

    I'm having this problem also! Nothing is getting through.

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2