MESpamC - MailEnable SpamAssassin Client [v 0.3.1 / 0.2.5]

[burningice]

You need to copy MEAIAM.DLL to the MESpamC folder; note that it's not a typo, MEAIAM and MEAOAM are two different files, and even though the MESpamC error refers to the latter, the solution implies the former (they seem to be interlinked, so that when MESpamC calls one, the other is also invoked by ME).

I have that file too in my install dir...

the files i've copied so far are

MEAIAM.dll
MEAOAM.dll
MEAOSM.dll

[someone_else]

Well, you can try copying all ME dlls to the MESpamC folder (i.e. the folder where mespamc.exe is located) - I'm not sure if that will change anything, but it's worth a try. As I have previously said, in my test environment, copying the MEAIAM.DLL file solved the problem.

[burningice]

Well, you can try copying all ME dlls to the MESpamC folder (i.e. the folder where mespamc.exe is located) - I'm not sure if that will change anything, but it's worth a try. As I have previously said, in my test environment, copying the MEAIAM.DLL file solved the problem.

But the weird thing is, that this error first appears after several hours. I've just restarted the server, and now spamc and SA is processing emails and filtering spam. But then the error starts to appear, and no emails are processed by SA.

The Application Error about rerenced memory could be read keeps appearing for every oncoming message though.

[jgrant07]

You should check the MailEnable MTA logs; from your description, it appears that MESpamC is not being called on those messages.

OK, I checked my logs and here's what I have found out:

All messages that are processed by mespamc and get sent to my spamassassin server have the following log entry:

11/28/06 19:14:22 Processing file 2C181CFBEE834B61876913BE806222D2.MAI from queue SMTP
11/28/06 19:14:22 Pre Pickup Event executing: "C:\Program Files\MESpamC\MESpamC.CMD" 2C181CFBEE834B61876913BE806222D2.MAI SMTP
11/28/06 19:14:29 Pre Pickup Event removed message 2C181CFBEE834B61876913BE806222D2.MAI.

But any message that is not passed to my spamassassin server look like this in the MTA log:
11/28/06 19:10:29 Processing file 65F0981AFC194B1787AF634DC618FBAD.MAI from queue SMTP
11/28/06 19:10:29 Pre Pickup Event executing: "C:\Program Files\MESpamC\MESpamC.CMD" 65F0981AFC194B1787AF634DC618FBAD.MAI SMTP
11/28/06 19:10:30 ME-MTA-ROUTE [65F0981AFC194B1787AF634DC618FBAD.MAI] from [SMTP] Connector queued to [SF] Connector as [76F1070C8F75494FB54F94DC41367488.MAI]


In my spamio log I can see that the first email that was sent through to spamassasssin was returned back correctly:

2006/11/28 19:14:25 [2C181CFBEE834B61876913BE806222D2.MAI] >> 10.0.0.2
2006/11/28 19:14:29 [2C181CFBEE834B61876913BE806222D2.MAI] || 10.0.0.2

However, the second message that was not sent is not listed at all in the spamio log.

I have disabled all rules in my Mailenable except the one that deletes viruses (I know these messages did not contain any).

Any ideas why?

Thanks

[someone_else]

@burningice: I really don't know what else to tell you. I found that the ME APIs in ME Enterprise (with MySQL at least) have strange and sometimes unexpected behavior. Given that they are linked to the SQL server, errors between those two will lead to errors with MESpamC, but the exact cause can be difficult to ascertain. MESpamC uses the same API calls for all ME versions; with Standard and Pro there are no problems, but with Enterprise there certainly seem to be some. Why? The only thing I can think of is that the ME API + (My)SQL integration has some underlying problems/issues.


@jgrant07: It's really difficult to say, as I don't know your setup. The fact that a message is not sent to SA could mean, for example, that MESpamC has been invoked, but considered that the message should be ignored; again, though, this will depend on your setup. If you haven't already, you should turn on (AddHeaderWithMESpamCStatus' and see if that gives you any hint of what might be happening. Furthermore, I see that MESpamC is being invoked through a batch script. It could also be whatever else is being invoked alongside it might be interfering.

[jgrant07]

@burningice: I really don't know what else to tell you. I found that the ME APIs in ME Enterprise (with MySQL at least) have strange and sometimes unexpected behavior. Given that they are linked to the SQL server, errors between those two will lead to errors with MESpamC, but the exact cause can be difficult to ascertain. MESpamC uses the same API calls for all ME versions; with Standard and Pro there are no problems, but with Enterprise there certainly seem to be some. Why? The only thing I can think of is that the ME API + (My)SQL integration has some underlying problems/issues.


@jgrant07: It's really difficult to say, as I don't know your setup. The fact that a message is not sent to SA could mean, for example, that MESpamC has been invoked, but considered that the message should be ignored; again, though, this will depend on your setup. If you haven't already, you should turn on (AddHeaderWithMESpamCStatus' and see if that gives you any hint of what might be happening. Furthermore, I see that MESpamC is being invoked through a batch script. It could also be whatever else is being invoked alongside it might be interfering.

Thanks for the info. I have verified the AddHeaderWithMESpamCSatus is checked. I have also the following line under the MTA Pickup Event Option within Mailenable:

"C:\Program Files\MESpamC\MESpamC.CMD"

That cmd script is below:

@echo off
REM This is a pickup event command file generated by MESpamC for use with MailEnable
REM original cmd: C:\Program Files\SWsoft\Plesk\admin\bin\memailfilter.exe

"C:\Program Files\SWsoft\Plesk\admin\bin\memailfilter.exe" %1 %2
"C:\Program Files\MESpamC\MESpamC.exe" %1 %2

I will rem out the first memailfilter.exe from running and see if that works--I am assuming this is where my problem is because this is a plesk system.

Thanks again for the help

[Setebos]

Any idea what is causing messages:

Code: Select all

communication with spamd host [SA SERVER IP] did not complete successfully

in mespamc log?
It seems that every incoming email ends up with same error message but
messages return to MailEnable with SpamAssassin headers. I also have custom postoffice delivery event, which for some reason seems to be ignored randomly by MailEnable. According PostOffices debug log, executable is not even called, but this happens to maybe 1 of 10 messages.

Could PostOffice troubles be caused by MTA PickUp /MeSpamC?

[someone_else]

If you are using Failover, then it is possible for the message you mentioned to be logged, and yet for the message to be processed ok. Anyway, spamIO logging will generally give you an idea of what is happening. As for the PO delivery event, no idea.

[Setebos]

If you are using Failover, then it is possible for the message you mentioned to be logged, and yet for the message to be processed ok. Anyway, spamIO logging will generally give you an idea of what is happening. As for the PO delivery event, no idea.

Thanks for quick response, MESpamC support works so much better than MailEnables support

It looks like those errors show up when 2 or more messages arrive withing few seconds.
In spamdIO.log

Code: Select all

2006/12/04 23:52:03 [F5F9550917B444D6BB85FD6E47E24BE4.MAI] >> 10.0.224.170 
2006/12/04 23:52:03 [F5F9550917B444D6BB85FD6E47E24BE4.MAI] || 10.0.224.170 
2006/12/04 23:52:11 [8B8A08BD819D4C948B503437BE23BEF9.MAI] >> 10.0.224.170 
2006/12/04 23:52:17 [8B8A08BD819D4C948B503437BE23BEF9.MAI] || 10.0.224.170 
2006/12/04 23:59:08 [9CB13C5A70DB449A8C98714DB128EAF1.MAI] >> 10.0.224.170 
2006/12/04 23:59:08 [9CB13C5A70DB449A8C98714DB128EAF1.MAI] || 10.0.224.170 
2006/12/04 23:59:11 [F4959188712A4A31A46F6EE4F69B3B81.MAI] >> 10.0.224.170 
2006/12/04 23:59:17 [F4959188712A4A31A46F6EE4F69B3B81.MAI] || 10.0.224.170 

and in same time from mespamc.log

Code: Select all

2006/12/04 23:52:17 communication with spamd host 10.0.224.170 did not complete successfully
2006/12/04 23:59:17 communication with spamd host 10.0.224.170 did not complete successfully

[someone_else]

You should check the detailed spamdIO logs, and also the spamd logs; the problem lies probably with SpamAssassin.

[Setebos]

You should check the detailed spamdIO logs, and also the spamd logs; the problem lies probably with SpamAssassin.

After looking through logs we had to stop using MeSpamC.
Each of those communication error rows means that we actually lost email message. When logs show that 2 messages arrived approximately in same time, only one of those finds it way to PostOffice.

[someone_else]

After looking through logs we had to stop using MeSpamC.
Each of those communication error rows means that we actually lost email message. When logs show that 2 messages arrived approximately in same time, only one of those finds it way to PostOffice.

I very much doubt that MESpamC is responsible for lost messages; it was designed from the very start to process messages in such a way that, should there be a problem with it, some unexpected error, the message processing will fail, but the original message itself will not be touched. MESpamC will always work with intermediate temporary files; all its processing is done on those, and not on the actual message file, which is only replaced at the very last moment, if there were no errors, and all temporary files are ok. So if there is an error with MESpamC (like the communication error you mentioned) then MESpamC will not touch the original message file.

[Setebos]

After looking through logs we had to stop using MeSpamC.
Each of those communication error rows means that we actually lost email message. When logs show that 2 messages arrived approximately in same time, only one of those finds it way to PostOffice.

I very much doubt that MESpamC is responsible for lost messages; it was designed from the very start to process messages in such a way that, should there be a problem with it, some unexpected error, the message processing will fail, but the original message itself will not be touched. MESpamC will always work with intermediate temporary files; all its processing is done on those, and not on the actual message file, which is only replaced at the very last moment, if there were no errors, and all temporary files are ok. So if there is an error with MESpamC (like the communication error you mentioned) then MESpamC will not touch the original message file.

You'r right, I'm having a very nice problem with email randomly disappearing emails even without MESpamC. E.g 10 emails are forwarded to MailEnable but only 9 of them shows up in SMTP activity and debug logs.
So there's something very strange going on with our mailserver

[burningice]

@burningice: I really don't know what else to tell you. I found that the ME APIs in ME Enterprise (with MySQL at least) have strange and sometimes unexpected behavior. Given that they are linked to the SQL server, errors between those two will lead to errors with MESpamC, but the exact cause can be difficult to ascertain. MESpamC uses the same API calls for all ME versions; with Standard and Pro there are no problems, but with Enterprise there certainly seem to be some. Why? The only thing I can think of is that the ME API + (My)SQL integration has some underlying problems/issues.

I do believe you. I switched to TDF for datastore and now everything works a charm... well, besides my management interface that relies on viewing and editing the config from database

I've sent an email to Mail Enable explaining the problem, so now its just to wait and see how they'll react.

But i dont understand... isn't it possible to make some kind of try-catch around the unpredictable method-calls so errors would be catched and handled correctly, instead of this Windows Error Message popping up all the time?

[someone_else]

But i dont understand... isn't it possible to make some kind of try-catch around the unpredictable method-calls so errors would be catched and handled correctly, instead of this Windows Error Message popping up all the time?

There are, and MESpamC should normally take care of errors; but in some cases the 'error' is not so much an error, but an issue which the OS cannot accept (like trying to read a 'wrong' memory block) and therefore will forcefully intervene and terminate MESpamC before the latter can respond to the issue. Again, I'm still not entirely certain what is happening there with the ME API, but whatever it is, it seems to be something... unexpected.