Posted on

18-Apr-2010

Updates
It’s been some time that I installed updates – and I have donwloaded the latest ones some time ago but nevber found time to install them.
Today it had to be done.
It went smoothly. First, the major update (UPDATE_V0012) was installed, after I changed SYSTARTUP_VMS a bit – it should just reboot and not start everything else. After reboot, I installed all that was superseeded – about 8 patches – and the latest TCPIP ECO. I decieded to have everything started, and rebooted again.
For some reason, it did took some time for TCPIP-services to start, but in the end, all was up and running. At least, ik looked that way, but TCPIP$BIND – the BIND server – wasn’t and therefore, WASD could start properly either. It did – but on port 82….
Checking why BIND didn’t start, I found the logfile stated:

$ Set NoOn
$ VERIFY = F$VERIFY(F$TRNLNM("SYLOGIN_VERIFY"))
%DCL-W-ACTIMAGE, error activating image SYS$SYSTEM:TCPIP$BIND_SERVER.EXE
-CLI-E-IMGNAME, image file $116$DKA100:[SYS0.][SYSEXE]TCPIP$BIND_SERVER.EXE;
-RMS-F-NOPRIV, insufficient privilege or object protection violation
 TCPIP$BIND  job terminated at 18-APR-2010 19:07:25.69
 Accounting information:
 Buffered I/O count:                43     Peak working set size:       2368
 Direct I/O count:                  47     Peak virtual size:         173088
 Page faults:                       223      Mounted volumes:                0

 Charged CPU time:        0 00:00:00.07      
Elapsed time:       0 00:00:00.28

This is weird, and I checked the protection of the image, but it seemed all OK.
Except: It shouldn’t be running off [SYS0.SYSEXE] but from SYS$COMMON.SYSEXE] – and indeed, I found two instances of the image. I removed the one in [SYS0.SYSEXE] and restarted BIJD – and it worked. Next, I stopped the WASD server on port 82 (the right way) and restarted the webserver.

All seems well.
The only point is I’ll have to rewrite a frontpage article…

Posted on

01-Apr-2010

Maintenance again
The usual end-of-month maintenance consists of saving last month’s operator- and different server logs, cleanup where appropiate and (before these are saved and deleted) the SPAMfilter statistics:

PMAS statistics for March
Total messages    : 3720 = 100.0 o/o
DNS Blacklisted   : 1607 =  43.1 o/o (Files: 31)
Relay attempts    :  945 =  25.4 o/o (Files: 31)
Processed by PMAS : 1168 =  31.3 o/o (Files: 31)
       Discarded :  155 =  13.2 o/o (processed),   4.1 o/o (all)
    Quarantained :  333 =  28.5 o/o (processed),   8.9 o/o (all)
       Delivered :  680 =  58.2 o/o (processed),  18.2 o/o (all)

In other words: almost half of the messages have been dropped because the sender is blacklisted; Remarkable has been the high amount of relay attemps (failing because the filter does not accept mail to be sent to another domain than my own).
Looking where the number comes from: it’s just two days: 30-Mar-2010, between 18:00 and 18:08, about 120 from address 183.3.203.9, and 31-Mar-2010, between 21:00 and 21:18, over 700 attempts, as being send by accounts from my ISP. I couln;t trace these addresses, they may have been fake as well, but perhaps my ISP can.
No such attempt today (yet) but the regular test from my ISP failed as well (as it should).

Furthermore, last month there have been a larger number of messages that is too short to add enough points to be quarantained, so these slipped through the filter. Some use an non-existing domain and won’t pass the test that still is in the mailserver itself; and a few were acceptable.

For Januari, 50 such messsages with an invalid domain were rejected by VSM Mail; in February 48, and in March 46 – but all slightly the same. This number will be added in the statictics from now on.
The ones that make it to the mailbox however need to be counted manually, but these numbers are small compqared to the rest.