dra007 Posted August 20, 2009 Share Posted August 20, 2009 Has anyone noticed that since the recent upgrade there is a high number of failed reports, that assume reports have already been sent? I don't know if it is a real failure to recognize new spam or the reported spam is not being cleared in time from the queue..I'll pay attention next time.. Link to comment Share on other sites More sharing options...
Wazoo Posted August 20, 2009 Share Posted August 20, 2009 Has anyone noticed that since the recent upgrade there is a high number of failed report now that assume reports have already been sent? I don't know if it is a real failure to recognize new spam or the reported spam not being cleared in time from the queue..I'll pay attention next time.. Not sure if you're saying the same thing here as I did in http://forum.spamcop.net/forums/index.php?...ost&p=72611 and the follow-on newsgroup posts. Link to comment Share on other sites More sharing options...
g4mby Posted August 20, 2009 Share Posted August 20, 2009 Not sure if you're saying the same thing here as I did in http://forum.spamcop.net/forums/index.php?...ost&p=72611 and the follow-on newsgroup posts. If dra007 isn't saying the same thing then I certainly am. I saw this twice when sending about ten reports. Didn't this happen last time SpamCop was upgraded? Link to comment Share on other sites More sharing options...
dra007 Posted August 20, 2009 Author Share Posted August 20, 2009 Not sure if you're saying the same thing here as I did in http://forum.spamcop.net/forums/index.php?...ost&p=72611 and the follow-on newsgroup posts. sounds like exactly the same issue, only I submitted by dragging the mail into the held mail folder (in IMAP; IE) and then reported as above... I just submitted two e-mails the same way and had only one returned for reporting..so something does seem out of sink,.. Link to comment Share on other sites More sharing options...
nealbscott Posted August 20, 2009 Share Posted August 20, 2009 I came to this forum to see if any one else had noticed this very thing (higher than usual 'already submitteds')... Link to comment Share on other sites More sharing options...
Farelf Posted August 21, 2009 Share Posted August 21, 2009 I guess this topic will be more noticeable that the parallel but older one at http://forum.spamcop.net/forums/index.php?showtopic=10556 (because it deals with a specific symptom) but Wazoo's suggestion (in a newsgroup) has obvious merit if this is a continuing problem - that the specific server identity probably needs to be noted in case that has bearing on the problem. Some discussion kicked off in that other topic (post http://forum.spamcop.net/forums/index.php?...ost&p=72631). Link to comment Share on other sites More sharing options...
Fonman805 Posted August 21, 2009 Share Posted August 21, 2009 Has anyone noticed that since the recent upgrade there is a high number of failed reports, that assume reports have already been sent? I don't know if it is a real failure to recognize new spam or the reported spam is not being cleared in time from the queue..I'll pay attention next time.. Yes, I have seen this happen to about half of the submissions each day since the system came back online after the 08/19/09 upgrade. I use the forwarding method to report spam. Each time the duplicate report error message has displayed, upon page refresh from the previous report, the new page's 'Report Now' link will be the color indicating a previously visited link (red), rather the color of an unvisited link (blue) as it would be normally. I am certain none of those spam emails was forwarded more than once because I move each one to a special SpamCop holding folder as they are forwarded. Now that I read the other thread that mentioned reporting the server ID, I will make note of that info if the problem continues. Link to comment Share on other sites More sharing options...
StevenUnderwood Posted August 21, 2009 Share Posted August 21, 2009 I was 3 for 3 just now with the following data: <!-- Original Parse <!-- Page showing: Report Now in pink (page in history) <!-- Parse showing: Reports regarding this spam have already been sent <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> I'm thinking it would be the second line that would indicate the error because that server is finding the next available parse incorrectly, but I see 3 different servers showing here so that could be code or slow database update. Link to comment Share on other sites More sharing options...
Eisenbart Posted August 21, 2009 Share Posted August 21, 2009 I also came to this forum to find out whether anyone else is having this problem. I have noticed quite many "reports have already been sent" messages for spam that I have definitely forwarded only once. I even got it for at least one spam mail that SpamCop commented with "Yum this spam is fresh!" I find this rather annoying because reporting all the spam I receive takes a lot of time. I don't know whether reporting all that spam has any effect anyway, but at least I want SpamCop to handle the spam I forward instead of rejecting it as having already been reported! Link to comment Share on other sites More sharing options...
Eisenbart Posted August 21, 2009 Share Posted August 21, 2009 Here we go again: Link to comment Share on other sites More sharing options...
StevenUnderwood Posted August 21, 2009 Share Posted August 21, 2009 How old the spam is has no affect... from what I am seeing, it is likely the last spam you just parsed, trying to be parsed again. If you note the TrackingURL for each spam you report and the link for the "Report Now", they are likely the same. I was 3 for 3 from my paid email home account earlier... just now 12 for 12 on my free work account <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> > <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> <!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --> Link to comment Share on other sites More sharing options...
Eisenbart Posted August 21, 2009 Share Posted August 21, 2009 How old the spam is has no affect... from what I am seeing, it is likely the last spam you just parsed, trying to be parsed again. If you note the TrackingURL for each spam you report and the link for the "Report Now", they are likely the same. So what does that mean? Is there anything I am doing wrong, or is this a bug? Link to comment Share on other sites More sharing options...
StevenUnderwood Posted August 21, 2009 Share Posted August 21, 2009 So what does that mean? Is there anything I am doing wrong, or is this a bug? You are not doing anything wrong... it is a bug in the code somewhere. It has happened after other upgrades as well. Link to comment Share on other sites More sharing options...
cwg Posted August 21, 2009 Share Posted August 21, 2009 Ha! New feature of the bug, if you click the: "Remove all unreported spam" And the machine reports: "Removed 0 unreported messages" And then you can go back and find no unreported spam, and, for me anyway, it stayed that way for several submissions. Note: using the web interface to copy and paste stuff to the engine. Link to comment Share on other sites More sharing options...
dra007 Posted August 21, 2009 Author Share Posted August 21, 2009 It is still happening today so it is not just a temporary glitch. Link to comment Share on other sites More sharing options...
Wazoo Posted August 21, 2009 Share Posted August 21, 2009 I haven't quite sorted out some of the differences i the presentation of this glitch, though haveing to assume that they are due to the same cause. I conjecture; spam is submitted, assigned to a specific parsing server. Various other systems, resources tapped for the parsing and analysis functions, data gathered up to generate the Report. When the Send Report Now button s pushed/function is called, the outgoing Report is submitted to the e-mail server for processing. It would be assumed that at this point, the database would be touched, flags set for status, maunged spam saved, etc. It is also at this point that it would seem that there is a communication problem between those various servers (parser, e-mail, database) I've ruled out that it's a parsing server issue, having so many go though the same identified system, some sailing through just fine, others having this non-reported/already sent issue .. still running about 50% What I do find interesting is that between notes here and my own logs, I'm only seeing three parsing servers involved thus far. Kind of hard to believe that only three systems would be keeping up with the load and yet (perhaps) having the issue that they are still too fast at making some 'status' decisions based on other server input/output/status signals. Link to comment Share on other sites More sharing options...
rconner Posted August 22, 2009 Share Posted August 22, 2009 Just had a little glitch of my own, not identical to others' but related I think. I reported a spam (that had been forwarded to SC and detained by the filters) but it was not cleared from my queue; when I clicked the "Report now" link I saw the message, together with a note that it was already reported. I tried the "remove all unreported spam" route but it did not immediately work. A couple minutes later, however, and all seems well. So, perhaps there is simply a timing problem somewhere. -- rick Link to comment Share on other sites More sharing options...
dra007 Posted August 22, 2009 Author Share Posted August 22, 2009 yes, it seems to be a timing problem...for my last messages I had to refresh the report now page a couple of times before I saw the report now being queued... PS. On the same token the reports come back incredibly fast, so I assume something has been done to boost up the processing speed.. Link to comment Share on other sites More sharing options...
StevenUnderwood Posted August 22, 2009 Share Posted August 22, 2009 With my last couple of reporting sessions, I have not seen any problems where I was seeing nearly 100% yesterday... either it is load related or something has been fixed. 09:00 I had about 50% problems 10:45 I had 0% problems 15:45 I had 0% problems Link to comment Share on other sites More sharing options...
A.J.Mechelynck Posted August 25, 2009 Share Posted August 25, 2009 Don't kow if what I'm seeing is the same issue or not. I submit only by copy-paste, not by forward-as-attachment, because my SMTP server is likely to drop mail containing spam, even as attachment. What I'm seeing is that, since the latest "software update" a few days ago, on the "Reports have been sent" page I often see the line: "You have unreported spam - Report now" with "Report now" in the colour for "visited links". If I click that "Report now" link, I see a repeat of the latest parse, with "Reports have already been sent". OTOH, if I ignore the "Report now" link and click the "spamcop.net" banner instead, I'm brought to a "Welcome registered user" page without the "unreported spam - Report now" line. I suspect that there's a speed problem in the software - the reports-sent page is sent too fast, so to speak, before the latest spam has been cleared away. Maybe adding a small "sleep" (on the order of one second) before sending the reports-sent page would clear this issue? Link to comment Share on other sites More sharing options...
StevenUnderwood Posted August 25, 2009 Share Posted August 25, 2009 This is the same issue... it does not matter how the messages are getting to the parser. While I last reported and experienced 0% errors over the weekend, yesterday I saw ~15% error rate... better than it was, but still happening. With that data, it may also be load related as I believe the reporting load is heavier during the week than the weekends. Link to comment Share on other sites More sharing options...
mrmaxx Posted August 25, 2009 Share Posted August 25, 2009 This is the same issue... it does not matter how the messages are getting to the parser. While I last reported and experienced 0% errors over the weekend, yesterday I saw ~15% error rate... better than it was, but still happening. With that data, it may also be load related as I believe the reporting load is heavier during the week than the weekends. FWIW, I am having the same issue. I came here to see if it had already been reported. I noticed it a couple days ago, again right after the upgrade on the reporting side. I just now reported one spam via email and received the dreaded "unreported spam" followed by the "reports have already been sent." I then went into my "held" email and quick-reported all but one (same a-hole spammer as the one I reported via email) and submitted that one for reporting so I could add some comments and report the website. Again, I got the dreaded "unreported spam" followed by the equally dreaded "reports have already been sent." So, I can only hope that someone is making the Deputies and Ironport aware of the problem. Link to comment Share on other sites More sharing options...
Farelf Posted August 25, 2009 Share Posted August 25, 2009 ...So, I can only hope that someone is making the Deputies and Ironport aware of the problem.Should think they are seeing it too but without feedback it's best not to assume anything, I have sent an email to Don. Link to comment Share on other sites More sharing options...
A.J.Mechelynck Posted August 25, 2009 Share Posted August 25, 2009 Should think they are seeing it too but without feedback it's best not to assume anything, I have sent an email to Don. IIUC from one of the above posts, Wazoo seems to be "in the know but under a gag rule". By open-source standards, this would mean that if the details were known it might entail a security liability (such as, let's say, unveiling a possible hole to a DOS attack). But then OTOH maybe IronPort is, just like Microsoft-Megabucks, under the misguided impression that it's better to always keep everything hush-hush at all times. Link to comment Share on other sites More sharing options...
Farelf Posted August 25, 2009 Share Posted August 25, 2009 ...this would mean that if the details were known it might entail a security liability (such as, let's say, unveiling a possible hole to a DOS attack). But then OTOH maybe IronPort is, just like Microsoft-Megabucks, under the misguided impression that it's better to always keep everything hush-hush at all times.Hey, Tony, I'm the appointed paranoiac, are you aiming for the job? But yes, I'm sure there are all sorts of situations where things said in public (here and elsewhere) could give aid and comfort to the ungodly not to mention that spammers can even get themselves SC reporting accounts and conduct their own little 'laboratory' sessions to try out their tricks. But I think, for the most part these days, their hight-volume, distributed and flexible botnet-based 'business model' probably doesn't require such sophistication or effort in the spam delivery operation - if it did they could surely get easier (and real) jobs and make much more money. Anyway, I have a response, there is a high-priority request lodged for a fix. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.