The default is AUTOREVIEW OFF which just moves the in-process messages
to Review in order to protect decludeproc from crashing. After people
started seeing their Review folder fill up with messages Declude created
the AUTOREVIEW ON function to move the messages back. Unfortunately
both of these are not full solutions to the problems since each issue
creates the other one.
It is very important to have this functionality in some sense because of
the ever present danger of a killer message. IMail for instance has had
issues with killer messages, the last one was patched in 8.2, and it
would have caused Queue Manager to crash repeatedly until the
problematic message was removed. While I would imagine that Declude
tries to fix killer message issues as they come up, there is always the
possibility of an unexpected condition causing a leak or crash, so this
functionality is vital. This is true of any program that acts on a
spool in this way.
My only recommendation is that if Declude can log a GPF that identifies
the message that was being processed when it crashed, it would make
sense to only move a message to Review if it caused two successive
crashes. This would protect from copying non-problematic messages to
Review, and it would also protect decludeproc from continual crashes.
Regarding your own instability issues, having a pre-scanning gateway is
good for not only blocking spam, but also for blocking potential killer
messages. Alligate for instance kills almost all zombie spam, and it is
the unexpected message formating that causes virtually all killer
message issues, and this is not common in static spam or legitimate
E-mail. Those behind such a gateway will have many fewer crashing
issues. The same goes for IMail where if you are deleting or holding
messages with Declude, they will not be handled by Queue Manager which
then protects Queue Manager from crashing. Well protected servers are
also more stable.
Matt
Heimir Eidskrem wrote:
I appreciate your suggestion and will implement it but I find it
pretty amazing that decludes error handling is crashing the program
and moving a message. Decludeproc.exe crashes constantly on our server.
Matt wrote:
Bad idea here. This functionality was designed to keep a 'killer
message' from continually crashing decludeproc.exe. Declude will
move all actively processed messages into a Review folder upon
shutdown or crash so that if there was a killer message, it wouldn't
cause repeated issues. I have definitely run into this problem
multiple times, and while the issue I experienced is apparently fixed
in more recent versions, there are certainly others waiting.
On the flip side, moving all such messages to Review creates a
situation where one must constantly monitor it and that is far from
optimal.
Here's my work around. I created a script that I run on a schedule
of once every 30 minutes that moves everything from Review to Proc.
This way, if there is a killer message, it will only crash Declude
once every 30 minutes instead of constantly in the event of
AUTOREVIEW ON. I have found this to work, however one must still
watch their server as having Declude crash 40 times over the space of
two days can cause a general system instability, but Declude crashes
on a particular message are generally not repeatable on the same
message.
So leave AUTOREVIEW OFF and then create a CMD file with the following
command and schedule it to run once every 30 minutes, and you won't
have to worry about monitoring that folder constantly, though if you
continually find files in there, one of them is likely to be a killer
message (which will be names in your C:\DECLUDE.GP1 file). Obviously
you should customize the paths for your system.
MOVE /Y F:\proc\review\*.* F:\proc
With a little more work, one could write a script that checked for
the file name in the C:\DECLUDE.GP1 file and if the same name is
found twice in a row, that file could be removed from Review before
throwing the contents back into Proc. This is in fact how Declude
should approach this problem rather than just a blind copying of
files into Proc, or blind moving of files into Review.
Matt
Heimir Eidskrem wrote:
I have this in the declude.cfg file but I am still getting files in
the review directory.
I find this feature really annoying.
Is this the correct command:
AUTOREVIEW OFF
Is this suppose to be in the declude.cfg file or global.cfg?
It seems like a larger amount of those files are legit email.
Thanks...
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
