Jump to content
Sign in to follow this  
dra007

[Resolved] New Glitch

Recommended Posts

Has anyone noticed that since the recent upgrade there is a high number of failed reports, that assume reports have already been sent? I don't know if it is a real failure to recognize new spam or the reported spam is not being cleared in time from the queue..I'll pay attention next time..

Edited by dra007

Share this post


Link to post
Share on other sites
Has anyone noticed that since the recent upgrade there is a high number of failed report now that assume reports have already been sent? I don't know if it is a real failure to recognize new spam or the reported spam not being cleared in time from the queue..I'll pay attention next time..

Not sure if you're saying the same thing here as I did in http://forum.spamcop.net/forums/index.php?...ost&p=72611 and the follow-on newsgroup posts.

Share this post


Link to post
Share on other sites
Not sure if you're saying the same thing here as I did in http://forum.spamcop.net/forums/index.php?...ost&p=72611 and the follow-on newsgroup posts.

sounds like exactly the same issue, only I submitted by dragging the mail into the held mail folder (in IMAP; IE) and then reported as above... I just submitted two e-mails the same way and had only one returned for reporting..so something does seem out of sink,..

Share this post


Link to post
Share on other sites

I guess this topic will be more noticeable that the parallel but older one at http://forum.spamcop.net/forums/index.php?showtopic=10556 (because it deals with a specific symptom) but Wazoo's suggestion (in a newsgroup) has obvious merit if this is a continuing problem - that the specific server identity probably needs to be noted in case that has bearing on the problem. Some discussion kicked off in that other topic (post http://forum.spamcop.net/forums/index.php?...ost&p=72631).

Share this post


Link to post
Share on other sites
Has anyone noticed that since the recent upgrade there is a high number of failed reports, that assume reports have already been sent? I don't know if it is a real failure to recognize new spam or the reported spam is not being cleared in time from the queue..I'll pay attention next time..

Yes, I have seen this happen to about half of the submissions each day since the system came back online after the 08/19/09 upgrade. I use the forwarding method to report spam. Each time the duplicate report error message has displayed, upon page refresh from the previous report, the new page's 'Report Now' link will be the color indicating a previously visited link (red), rather the color of an unvisited link (blue) as it would be normally.

I am certain none of those spam emails was forwarded more than once because I move each one to a special SpamCop holding folder as they are forwarded. Now that I read the other thread that mentioned reporting the server ID, I will make note of that info if the problem continues.

Share this post


Link to post
Share on other sites

I was 3 for 3 just now with the following data:

<!-- Original Parse

<!-- Page showing: Report Now in pink (page in history)

<!-- Parse showing: Reports regarding this spam have already been sent

&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;

I'm thinking it would be the second line that would indicate the error because that server is finding the next available parse incorrectly, but I see 3 different servers showing here so that could be code or slow database update.

Share this post


Link to post
Share on other sites

I also came to this forum to find out whether anyone else is having this problem. I have noticed quite many "reports have already been sent" messages for spam that I have definitely forwarded only once. I even got it for at least one spam mail that SpamCop commented with "Yum this spam is fresh!"

I find this rather annoying because reporting all the spam I receive takes a lot of time. I don't know whether reporting all that spam has any effect anyway, but at least I want SpamCop to handle the spam I forward instead of rejecting it as having already been reported!

Share this post


Link to post
Share on other sites

How old the spam is has no affect... from what I am seeing, it is likely the last spam you just parsed, trying to be parsed again. If you note the TrackingURL for each spam you report and the link for the "Report Now", they are likely the same.

I was 3 for 3 from my paid email home account earlier... just now 12 for 12 on my free work account

&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www2 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www1 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;
&lt;!-- SpamCop::Web::Look $Revision: #13 $ produced by prod-sc-www3 --&gt;

Share this post


Link to post
Share on other sites
How old the spam is has no affect... from what I am seeing, it is likely the last spam you just parsed, trying to be parsed again. If you note the TrackingURL for each spam you report and the link for the "Report Now", they are likely the same.

So what does that mean? Is there anything I am doing wrong, or is this a bug?

Share this post


Link to post
Share on other sites
So what does that mean? Is there anything I am doing wrong, or is this a bug?

You are not doing anything wrong... it is a bug in the code somewhere. It has happened after other upgrades as well.

Share this post


Link to post
Share on other sites

Ha! New feature of the bug, if you click the:

"Remove all unreported spam"

And the machine reports:

"Removed 0 unreported messages"

And then you can go back and find no unreported spam, and, for me anyway, it stayed that way for several submissions.

Note: using the web interface to copy and paste stuff to the engine.

Share this post


Link to post
Share on other sites

I haven't quite sorted out some of the differences i the presentation of this glitch, though haveing to assume that they are due to the same cause.

I conjecture;

spam is submitted, assigned to a specific parsing server. Various other systems, resources tapped for the parsing and analysis functions, data gathered up to generate the Report. When the Send Report Now button s pushed/function is called, the outgoing Report is submitted to the e-mail server for processing. It would be assumed that at this point, the database would be touched, flags set for status, maunged spam saved, etc. It is also at this point that it would seem that there is a communication problem between those various servers (parser, e-mail, database)

I've ruled out that it's a parsing server issue, having so many go though the same identified system, some sailing through just fine, others having this non-reported/already sent issue .. still running about 50%

What I do find interesting is that between notes here and my own logs, I'm only seeing three parsing servers involved thus far. Kind of hard to believe that only three systems would be keeping up with the load and yet (perhaps) having the issue that they are still too fast at making some 'status' decisions based on other server input/output/status signals.

Share this post


Link to post
Share on other sites

Just had a little glitch of my own, not identical to others' but related I think.

I reported a spam (that had been forwarded to SC and detained by the filters) but it was not cleared from my queue; when I clicked the "Report now" link I saw the message, together with a note that it was already reported. I tried the "remove all unreported spam" route but it did not immediately work. A couple minutes later, however, and all seems well. So, perhaps there is simply a timing problem somewhere.

-- rick

Share this post


Link to post
Share on other sites

yes, it seems to be a timing problem...for my last messages I had to refresh the report now page a couple of times before I saw the report now being queued...

PS. On the same token the reports come back incredibly fast, so I assume something has been done to boost up the processing speed..

Edited by dra007

Share this post


Link to post
Share on other sites

With my last couple of reporting sessions, I have not seen any problems where I was seeing nearly 100% yesterday... either it is load related or something has been fixed.

09:00 I had about 50% problems

10:45 I had 0% problems

15:45 I had 0% problems

Share this post


Link to post
Share on other sites

Don't kow if what I'm seeing is the same issue or not.

I submit only by copy-paste, not by forward-as-attachment, because my SMTP server is likely to drop mail containing spam, even as attachment.

What I'm seeing is that, since the latest "software update" a few days ago, on the "Reports have been sent" page I often see the line: "You have unreported spam - Report now" with "Report now" in the colour for "visited links". If I click that "Report now" link, I see a repeat of the latest parse, with "Reports have already been sent". OTOH, if I ignore the "Report now" link and click the "spamcop.net" banner instead, I'm brought to a "Welcome registered user" page without the "unreported spam - Report now" line.

I suspect that there's a speed problem in the software - the reports-sent page is sent too fast, so to speak, before the latest spam has been cleared away. Maybe adding a small "sleep" (on the order of one second) before sending the reports-sent page would clear this issue?

Share this post


Link to post
Share on other sites

This is the same issue... it does not matter how the messages are getting to the parser.

While I last reported and experienced 0% errors over the weekend, yesterday I saw ~15% error rate... better than it was, but still happening. With that data, it may also be load related as I believe the reporting load is heavier during the week than the weekends.

Share this post


Link to post
Share on other sites
This is the same issue... it does not matter how the messages are getting to the parser.

While I last reported and experienced 0% errors over the weekend, yesterday I saw ~15% error rate... better than it was, but still happening. With that data, it may also be load related as I believe the reporting load is heavier during the week than the weekends.

FWIW, I am having the same issue. I came here to see if it had already been reported. I noticed it a couple days ago, again right after the upgrade on the reporting side. I just now reported one spam via email and received the dreaded "unreported spam" followed by the "reports have already been sent." I then went into my "held" email and quick-reported all but one (same a-hole spammer as the one I reported via email) and submitted that one for reporting so I could add some comments and report the website. Again, I got the dreaded "unreported spam" followed by the equally dreaded "reports have already been sent."

So, I can only hope that someone is making the Deputies and Ironport aware of the problem.

Share this post


Link to post
Share on other sites
...So, I can only hope that someone is making the Deputies and Ironport aware of the problem.
Should think they are seeing it too but without feedback it's best not to assume anything, I have sent an email to Don.

Share this post


Link to post
Share on other sites
Should think they are seeing it too but without feedback it's best not to assume anything, I have sent an email to Don.

IIUC from one of the above posts, Wazoo seems to be "in the know but under a gag rule". By open-source standards, this would mean that if the details were known it might entail a security liability (such as, let's say, unveiling a possible hole to a DOS attack). But then OTOH maybe IronPort is, just like Microsoft-Megabucks, under the misguided impression that it's better to always keep everything hush-hush at all times.

Share this post


Link to post
Share on other sites
...this would mean that if the details were known it might entail a security liability (such as, let's say, unveiling a possible hole to a DOS attack). But then OTOH maybe IronPort is, just like Microsoft-Megabucks, under the misguided impression that it's better to always keep everything hush-hush at all times.
Hey, Tony, I'm the appointed paranoiac, are you aiming for the job? :D But yes, I'm sure there are all sorts of situations where things said in public (here and elsewhere) could give aid and comfort to the ungodly not to mention that spammers can even get themselves SC reporting accounts and conduct their own little 'laboratory' sessions to try out their tricks. But I think, for the most part these days, their hight-volume, distributed and flexible botnet-based 'business model' probably doesn't require such sophistication or effort in the spam delivery operation - if it did they could surely get easier (and real) jobs and make much more money.

Anyway, I have a response, there is a high-priority request lodged for a fix.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×