• Problems getting kSpam to work

    By Stephen P Sexton 2 decades ago

    I installed kspam 1.5 on a Domino 7/Win 2K server (though smtp.kspam.version reports 1.40 beta 0).



    I've created many allow rules to white list common organizations, and 1 deny rule to test, and because a post implied that you needed to have at least one.



    I've created mailspam.nsf and mailgood.nsf with 1000 documents each.



    I added 'spam' to the addin parameter in the notes.ini. I added bload to the serverTasks parameter for bayesian.



    When SMTP starts, kspam logs that it is loading rules, then that it has finished.



    When bload starts, it loads words for a couple of minutes, then reports that it has finished calculating probabilities and is ready. From the content of comblist.txt it is clear that it has read my mailgood and mailspam databases – all appears good



    BUT



    There is no indication in any messages that they have been processed – I don't see an KS_ items in the documents, and nothing is being blocked, even if it matches my test rule.



    The kspam bayesian task appears when I show tasks at the console (showing minutes until it reloads probs).



    The smtp.kspam stats are available in the Domino admin client, and MessagesProcessed is increasing, but the messages themselves show no signs of being processed. Also, I have bayesian ratio set to 10, but no messages get copied to mailgood, and no messages have been copied to mailspam.



    Any advice would be appreciated.

    • problems getting kspam to work

      By Dan Cihon 2 decades ago

      Here is my settings if it helps

      Mine is working just fine

      These settings can be done in the Configuration Database

      > show stat smtp.kspam.*

      SMTP.kSpam.Allow = 14

      SMTP.kSpam.Bayesian.Action = Copy & Deny

      SMTP.kSpam.Bayesian.Boundary = 90

      SMTP.kSpam.Bayesian.CopiedAndDenied = 95

      SMTP.kSpam.Bayesian.Filter = On

      SMTP.kSpam.Bayesian.Mark = On

      SMTP.kSpam.Bayesian.Prep = Off

      SMTP.kSpam.Bayesian.Prep_2 = Off

      SMTP.kSpam.Bayesian.Ratio = 10

      SMTP.kSpam.Conf.AddRecipientsItem = On

      SMTP.kSpam.Conf.Debug = Off

      SMTP.kSpam.Conf.DefaultAction = Copy & Deny

      SMTP.kSpam.Conf.DefaultProbIncrease = 0

      SMTP.kSpam.Conf.FilterFromInt = On

      SMTP.kSpam.Conf.Mark = On

      SMTP.kSpam.Conf.MaxNumbersInFrom = 7

      SMTP.kSpam.Conf.MinFromLength = 4

      SMTP.kSpam.Conf.Reload = On

      SMTP.kSpam.CopiedAndDenied = 5

      SMTP.kSpam.Denied = 113

      SMTP.kSpam.FromStartsWithNumber = 1

      SMTP.kSpam.Marked = 41

      • Did you see it?

        By Daniel Stelter 2 decades ago

        Hi -

        I have seen the same thing here. On our Server (6.0.4) kSpam 1.4b is working fine…

        When I replace nspam.dll, everything looks fine but it's doing nothing.



        Do you see what is missing? At his stats? The SMTP.kSpam.Conf.IID …!

        Same thing here. Didn't change anything on the config; with 1.4b its there, with 1.5 not.



        I'm not sure whether it helps…but worth to mention… ;)



        Cheers, Daniel.

        • Same problem here

          By Steve Roch 2 decades ago

          I have the exact same problem here except I'm running Domino 6.5.5. kSpam loads and is running, but email never passes through it (no KS_IID in the header and no email in mailspam or mailgood for two full days). I just replaced the 1.5 nspam.dll with the 1.4b dll and it's working fine again.

          • Permissions

            By Nico Vis 2 decades ago

            Hi,

            it seems that the server does not find the 1.5 dll.

            I have many istances where I replaced 1.4b with 1.5 and everything is ok.

            May this be a problem on permissions on the new dll file after being extracted?



            Now you can see immediately if the dll has been loaded because you have this new messages on the console:

            11/05/2006 23.17.03 kSpam.extmgr: Loading rules

            11/05/2006 23.17.08 kSpam.extmgr: Finished loading rules

            11/05/2006 23.17.08 SMTP Server: Starting…

            11/05/2006 23.17.09 SMTP Server: Started

            the filter only works if the smtp task is enabled.



            Hope this can help.

            Let me know.



            Nico

            • Permissions

              By Steve Roch 2 decades ago

              >May this be a problem on permissions on the new dll file after being extracted?



              I just checked and it has the same permissions as the 1.4 dll.



              >the filter only works if the smtp task is enabled.



              I do not run SMTP on my server since we get all external email from our headquarters. Is this a new requirement with 1.5? I've been running kSpam on my servers with this configuration for about 2 years without any problems. Since putting the 1.4 dll back in place a few hours ago, everything is working fine again.

              • smtp task is the problem

                By Nico Vis 2 decades ago

                Yes,

                with this version the smtp task must run because the dll starts with it.



                One of the performance and stability problem of the previous version was that the dll was loaded for every Domino task. And in this way a lot of memory was used without a real benefit.

                In fact if you stopped and started a domino task rules were reloaded. Even with admip for example.

                If you had many rules and many tasks you had a huge memory usage and a higher probability to have a crash.

                Now rules are loaded only once with the smtp task.



                I suppose that you use only the router task, I will see if it is possible to combine it with the router task without doubling the memory usage.



                Thank you for your informations.



                Nico

                • Problem with 1.5, even with SMTP running

                  By Stephen P Sexton 2 decades ago

                  Nico,



                  I am running SMTP, but kspam is still not working properly using the 1.5 version of the DLL.



                  Daniel Stelter noticed that the SMTP.kSpam.Conf.IID is not recorded with the 1.5 DLL, but 1.4b does record it. 1.5 does not mark documents , but 1.4b does. Is this helpful?



                  I think I've got 1.4b working, but I'd prefer to use 1.5 for the better memory management, and I am using SMTP. Any ideas?



                  Thanks,

                  Steve

                  • Router

                    By Nico Vis 2 decades ago

                    Hi,

                    is your mail arriving to the kspam server using the router or the smtp task?

                    With this release only smtp is filtering mail, kspam is not associated with the router task but only with smtp task.



                    In many installations kspam is on the smtp server so mail is correctly filtered

                    Haveing kspam combined with more than one task (router and smtp) had big stability problems.

                    This are resolved using only one task. And it is very difficult to obtain the same if you combine kspam with more than one task. But I will try to see if this is possible without loosing stability.

                    If there are many people with this problem, as Steve Roch before, I will compile a kspam version working with the router task.



                    Regards



                    Nico

                    • SMTP, not router

                      By Stephen P Sexton 2 decades ago

                      The vast majority of inbound mail comes in through SMTP. A small amount comes through the router via Notes routing from adjacent domains, but all of this is trusted.



                      Using the 1.5 version of the dll, the number of messages processed by SMTP increments, but the messages are not stamped with KS_ items, and are not filtered.



                      When I replace with the 1.4b version of the dll, it processes (though the baysian is thusfar very ineffective), but I am concerned about the stability problems you have referenced with releases before 1.5, when kspam binds to multiple tasks.



                      Do you have any idea what is preventing 1.5 from working? I've posted my complete configuration earlier in response to a request from Tom.



                      Also, I've seeded mailspam and mailgood with 1000+ messages, but the bayesian analysis seems largely ineffective. Any tips?



                      Thanks

            • By Stephen P Sexton 2 decades ago

              Nico,



              Thanks for the suggestion. I do see the console messages about the rules being loaded; this indicates that there is not a file permission problem, right?



              Thanks,

              Steve

            • Permission is okay

              By Daniel Stelter 2 decades ago

              G'morning!

              Doesn't seem to be a permission problem. 1.5-dll has same permission as 1.4b-dll.

              Nico: The dll is loaded - I see the kSpam.extmgr messages about loading

              rules (before the SMTP Servertask starts).

              Even when the dll is loaded, KS_IID is missing…

              You (Nico) said that the dll starts (only) with the SMTP-task. Could other AddIns disable or

              deny kSpam? I have here Sybari VirusScan as additional AddIn. But it wasn't a problem

              so far with 1.4b.



              Cheers, Daniel.

              • Update... (Stephen, Steve?)

                By Daniel Stelter 2 decades ago

                I just played a little…

                Even when having KS_IID=

                in the notes.ini, it won't show in the stats nor kSpam is working…

                Getting rid of nnproxy.dll (the VirusScanner AddIn) from the extmgr_addins line… same

                thing; kSpam is not working…



                Stephen…I see in your 2nd post that you have nnproxy.dll in your extmgr_addins line, too.

                From which product is yours?

                Steve… do you have additional stuff in your extmgr_addins line in the notes.ini?



                Cheers, Daniel.

                • More trial and error

                  By Stephen P Sexton 2 decades ago

                  Daniel,



                  I also tried removing nnproxy from the ext parameter; and also with no effect. My nnproxy is from Sybari Antigen.



                  Also, I have tried moving bload in the ServerTasks parameter; initially it was last, now it is first – no change.



                  I have kSpam functional using the 1.4b dll, but I am concerned about the stability issues that Nico raises.

                  b

                  Also, the Bayesian filter has yet to prove effective. I am regularly sorting the new entries in MailGood.nsf, and am hoping to see the effectiveness increase with the size of the spam corpus. I had used an older version of kspam on an R5 server a couple of years ago, and found that the Bayesian filter is pretty labor intensive to maintain, but I see others are quite happy with it, so I am hoping to get the 1.4b-1.5 issue resolved, then I'll see what I can do about tweaking the effectiveness.

                  • Sybari Antigen (Offtopic)

                    By Daniel Stelter 2 decades ago

                    Stephen -



                    I think it's not really the best place to discuss this… excuse me… just let me a little bit curious…

                    You wrote that you use Sybari Antigen, too.

                    I think you received that nice letter from Microsoft as well; about discontinuing Antigen for Notes.

                    Do you have already an alternative for it? I think we're spoilt by Antigen…

                    I didn't find any comparable solution for Notes yet… did you?



                    Thanks & Cheers - Daniel.

        • You're right

          By Stephen P Sexton 2 decades ago

          Confirmed: I replaced the dll with the 1.4b version, and kspam has started marking documents again. I haven't been running it long enough to have a sense if the Bayesian piece is functioning, but at least the mail is being stamped with KS_ items.



          Also, I confirmed that the kspam stats are identical, except that "SMTP.kSpam.Conf.IID = Ks_123" is missing when running 1.5, and it is there for 1.4b.



          I like that 1.5 uses memory more efficiently and I do have SMTP running on this server, so I would prefer to use 1.5. Any ideas about why 1.4b works and 1.5 does not? Any idea if it is related to the fact that IID doesn't display?



          Thanks,

          Steve

    • Re:

      By Tom Lyne 2 decades ago

      Can you post your settings exactly as thety appear in notes.ini or the config database,



      -tom

      • Settings

        By Stephen P Sexton 2 decades ago

        Thanks for your quick response:





        relevant notes.ini settings:



        ServerTasks=bload,update,replica,router,amgr,adminp, . . .

        EXTMGR_ADDINS=spam,nnproxy.dll





        General settings from Configuration Document:

        Instance ID Ks_123

        Default action 0 - Accept

        Default probability increase 0%

        Mark messages with a reason field? Yes

        Reload configuration every hour? Yes

        Show statistics? Yes

        Minimum "From:" header length? 0

        Maximum numbers in sender's username? 0

        First character in "From:" header must not be a number? No

        Other forms to scan?

        Add recipients list to copied and denied messages? Yes

        Copied mail database

        Turn on debugging? Yes





        Bayesian Settings from Configuration Document:

        Bayesian filter enabled Yes

        Token reload period 360

        Probability boundary 90%

        Mark messages with token list and probability? Yes

        Good message ratio 10

        Bayesian action 1 - Mark

        Mark with SUSPECT (B):

        Tokens to ignore

        Dump token lists to file No

        Preparation setting 1 No

        Preparation setting 2 No

        Turn on debugging? No







        kspam stats:



        > show stat smtp.kspam.*

        SMTP.kSpam.Bayesian.Action = Mark

        SMTP.kSpam.Bayesian.Boundary = 90

        SMTP.kSpam.Bayesian.Filter = On

        SMTP.kSpam.Bayesian.Mark = On

        SMTP.kSpam.Bayesian.Prep = Off

        SMTP.kSpam.Bayesian.Prep_2 = Off

        SMTP.kSpam.Bayesian.Ratio = 10

        SMTP.kSpam.Conf.AddRecipientsItem = On

        SMTP.kSpam.Conf.Debug = On

        SMTP.kSpam.Conf.DefaultAction = Accept

        SMTP.kSpam.Conf.DefaultProbIncrease = 0

        SMTP.kSpam.Conf.FilterFromInt = Off

        SMTP.kSpam.Conf.Mark = On

        SMTP.kSpam.Conf.MaxNumbersInFrom = 0

        SMTP.kSpam.Conf.MinFromLength = 0

        SMTP.kSpam.Conf.Reload = On

        SMTP.kSpam.Version = 1.40 beta 0

        17 statistics found