Sign in to follow this  
Followers 0
BlueRock

Parser Stuck (?) When Quick Reporting

46 posts in this topic

This issue may require the attention of a SPAMCOP admin. I originally posted in the NG, but received no reply there.

Yesterday morning I submitted 4 spam messages, as attachments in one single email

message, using the Quick Reporting method. I have done this several times

in the past, with no problems.

However, after yesterday morning's submission, I never received the usual "Quick

Reporting Data" response message from SPAMCOP (on any of the four spams submitted).

So, I logged in on the web site to see if I could figure out what was going

on. When I view my Past Reports, it shows that three of the four spam

messages were reported (and it shows the various reporting addresses and

message ID's for them). It also shows the fourth message, identifiable by

its submission time and subject line, but indicates the status as "No

reports filed":

-------------------

Submitted: Wed Aug 30 13:07:17 2006 GMT Wednesday, August 30, 2006 9:07:17

AM -0400:

Get out of the obese crowd

No reports filed

-------------------

I thought maybe the parser "got stuck" for some reason when trying to

process that fourth message, so I submitted it again, by pasting the message

source into the reporting box on the web page. After viewing the parse,

which did work correctly, I canceled the report, to avoid reporting the same

spam twice. The tracker link from that second submission is here, but is

not very informative, other than it shows that the parser doesn't fail on

this message, and that reports *should* have been filed:

http://www.spamcop.net/sc?id=z1048167057z5...e7523412d0defaz

Remember that this tracker is for the second, manual submission of the spam,

not the "Quick Reported" one which appears to be stuck. I have no way of

getting a tracker for the first submission, because I never received the

Quick Reporting Data email message, where that information is usually

displayed.

Later that day, I received more spam, which I Quick Reported, and for which

everything worked as usual. But that message from yesterday morning remains

un-reported in my Past Reports list, and I still have not received the Quick

Reporting Data message for the four spams submitted that morning.

In the past, it has been the case that no reports were filed on a particular

spam, for example, when the abuse desk for a spamsource has indicated that

they refuse munged reports. However, that has not caused the Quick

Reporting Data response to fail in this way. But, in this case, as the tracker shows,

reports should have been filed.

So, it appears to me that there may be some problem which causes:

a) Quick Reported spam submissions to not be properly parsed and reported.

and

B) The Quick Reporting Data reply to not be sent.

Any suggestions?

Thanks!

Share this post


Link to post
Share on other sites

This appears to be an exact copy of the newsgroup post that I have also noticd that has gone unanswered, despite even the latest discussion points on how much the Forum sucks, newsgroups are the only 'real' answer ....

The said ... once again, I'm only speaking from knowlege gained from previous discussions here.

Whay I didn't see mentioned in the otiginal newsgroup pot or now here .. is any mention of a "Report Now" button .. assumedly this is tied to your described "no reports sent" description ... This is where I have no personal background .... If it was me, I'd have submitted your pasted-in version to address that spam, again regerenceing your described "no reports sent" on touyr e-mailed submittal.

And with that out of the way, now I'm trying to figure out the "stuck" issue .. most times, when this word is used, the reporter can't submit more spam to get parsed, until a "delete them all" action is performed .... yet you say further e-mail submissions are processed just fine. So I'm not sure what you are meaning by your "stuck" desription, other than it didn't get parsed and no reports went out.

If it's not interfering with the continued submittals, your posted sample looks fresh enough to resubmit again, if you want to get that action accomplished. This is one of the best constructed spams I've had to look at in a long while .. read that as I didn't see anything obvious that should have given the parser problems ... the only thing not actually explained is your description of

Yesterday morning I submitted 4 spam messages, as attachments in one single email

message, using the Quick Reporting method. I have done this several times

in the past, with no problems.

Your newsgroup post shows Outlook Express in use, but that doesn't say a thing about the e-mail application in use .... so not sure whether to suggest that it was the way thos e-mail got attched in the original submission that may have fed into some kind of problem ...???

There were also some dropouts in the statistics graphic/link at the top right of this page ...it's is possuble that something happened at just the right time ....????

In hopes, someone will be along later with some hands-on experience if none of the above is useful.

Share this post


Link to post
Share on other sites

Wazoo: When submitting for quick reporting, one does not generally see the "Report Now" link. The OP is describing hitting the "Past Reports" tab and then "View recent reports".

You do not mention how often you report spam. Recently (May), there was an option added to eliminate the return email for quick reporting. Here is a link which describes it's release. There is another post somewhere when it was re-released, but this link gives the basic idea.

While I don't think that is your answer, it was worth a shot. Beyond that, I think you will need to contact the deputies[at]spamcop.net address so they can poke around and see what happened.

Share this post


Link to post
Share on other sites
This appears to be an exact copy of the newsgroup post that I have also noticd that has gone unanswered, despite even the latest discussion points on how much the Forum sicks, newsgroups are the only 'real' answer.

Yes, it is a copy, I did modify the text a little, since the event was now a day old, and the original newsgroup post mentioned "today". As I said, I posted here, because the newsgroup post went unanswered.

Whay I didn't see mentioned in the otiginal newsgroup pot or now here .. is any mention of a "Report Now" button

When you use Quick Reporting, you don't get a "Report Now" button. The reporter forwards one or more spams as attachment(s) to a SPAMCOP quick report address, and the spam is parsed and reported, without having to access the confirmation web page. Normally, you receive a confirmation email, that shows the address(es) to which reports were sent, and contains the tracker links for the submitted spam. That did not happen in THIS case, which is part of the problem I am describing here.

...now I'm trying to figure out the "stuck" issue .. most times, when this word is used, the reporter can't submit more spam to get parsed, until a "delete them all" action is performed .... yet you say further e-mail submissions are processed just fine. So I'm not sure what you are meaning by your "stuck" desription, other than it didn't get parsed and no reports went out

I mean that the one message is "stuck" - it shows up on my Past Reports list as "Not Reported" (complete text from my Past Reports list shown in original post), and I have never received the confirmation email on ANY of the four messages from that submission.

If it's not interfering with the continued submittals, your posted sample looks fresh enough to resubmit again...

I thought of that, but I did not want to risk reporting the same spam message twice, in case the parser suddenly decided to process that message.

Your newsgroup post shows Outlook Express in use, but that doesn't say a thing about the e-mail application in use .... so not sure whether to suggest that it was the way thos e-mail got attched in the original submission that may have fed into some kind of problem ...???

In this case the spam was submitted from a Webmail client program called "Squirrel Mail" (it is what my host uses to provide access to web mail). When email is forwarded as an attachment in Squirrel Mail, it is of the type "message/rfc822". I have submitted spam in this manner hundreds of time in the past, without any problems.

There were also some dropouts in the statistics graphic/link at the top right of this page ...it's is possuble that something happened at just the right time ....????

In hopes, someone will be along later with some hands-on experience if none of the above is useful.

Yes, it may have been a one time glitch - but I though the folks that run spamcop might want to know about this, in case there is a bug or other problem in thier system. Maybe this only affects Quick Reporting. But I thought it should be looked at.

Edited by BlueRock

Share this post


Link to post
Share on other sites

Yes, it may have been a one time glitch - but I though the folks that run spamcop might want to know about this, in case there is a bug or other problem in thier system. Maybe this only affects Quick Reporting. But I thought it should be looked at.

This could also add to the questions to ask when people complain of not getting replies, as happened here. Perhaps, if the parser has a momentary problem and does not complete parsing of all the submitted messages (when submitting multiple messages) the message is not always sent back to the reporter. We can ask if they go to the Past Reports, if they see any messages with "No report filed" status.

Share this post


Link to post
Share on other sites

I am sorry the reply ended up in the wrong place in the tree - apparently I am not using this web interface correctly - I am not sure which "reply" button to click on to generate a reply to a reply....

Share this post


Link to post
Share on other sites

OK, I believe I've got enough data so that I can write up something sensible in an e-mail .. consider "those folks upstream" advised of the situation ... whether I can ask the right question to get a reply with a solution is the only left to worry about <g>

Share this post


Link to post
Share on other sites

I am sorry the reply ended up in the wrong place in the tree - apparently I am not using this web interface correctly - I am not sure which "reply" button to click on to generate a reply to a reply....

Click the reply just below the message you are trying to reply to will keep the messages properly threaded for those that use that view. I view mine linearly, which works better for me.

Share this post


Link to post
Share on other sites

Oops! I just filed a report using the web form, based on Steve's suggestion that I "contact the deputies". Sorry for the duplicate effort :(

Share this post


Link to post
Share on other sites
From: "Wazoo"

To: "Deputies"

Cc: "SpamCop, Argyle"

Subject: Batch Quck-Report problem

Date: Thu, 31 Aug 2006 12:05:26 -0500

Originally posted into the newsgroups at;

Newsgroups: spamcop

Subject: Parser Stuck?

Date: Wed, 30 Aug 2006 13:53:17 -0400

Organization: SpamCop

Lines: 62

Message-ID: <ed4jae$ou1$1[at]news.spamcop.net>

No reply ever offered, so a Forum posting made at;

http://forum.spamcop.net/forums/index.php?showtopic=6973

So once again, a Forum issue, I'm getting involved ....

Tracking URL offered (so as to help you locate the user in question) ....

http://www.spamcop.net/sc?id=z1048167057z5...e7523412d0defaz

At issue is a spam submittal from a SquirrelMail web interface,

four spams attached .... the 'confirmation' e-mail was never

received for this submittal. Looking at "past reports" .. three

of the four were processed, the fourth identified as "no reports

sent" ....assumedly, there's a connection between one of the four

not being processed and the lack of a confirmation notice.

I had pointed out that the "Reporting System Status" graphic /

link I've got on the Forum pages showed some dropouts

yesterday. Conjecturing that there may have been a link

there also.

But the question remains (as this isn't the first time that

this scenario has come up) .... what is the user supposed

to do to "fix" the indicated "no reports sent" along with the

notification of "successful parses" not being sent.?

I'd already suggested re-submitting the spam in question, if

that was the only thing bothering the user, but ... it's the

handling of these multiple submittals "when something goes

wrong" that seems to be the larger issue ....

Share this post


Link to post
Share on other sites

So, it appears to me that there may be some problem which causes:

a) Quick Reported spam submissions to not be properly parsed and reported.

and

B) The Quick Reporting Data reply to not be sent.

I don't know what to tell you. The spam parsed OK for me. Maybe some sort of temporary glitch.

All very strange, but I don't have an explanation, and no way to go back to see what happened then. SpamCop does everything live and in real time, so all we have is what's happening now.

- Don -

Share this post


Link to post
Share on other sites

All very strange, but I don't have an explanation, and no way to go back to see what happened then. SpamCop does everything live and in real time, so all we have is what's happening now.

Don:

I have seen the "no reports filed", specifically when the parser has been down and is catching up on the queued messages, right after submitting messages but if I go back later, those reports have been filed.

I suppose, if it were only a few reports missing, with reports filed after it, that that it would be safe to assume the report is not going to run and it is safe to resubmit.

Share this post


Link to post
Share on other sites

I am re-submitting this issue for discussion, since it is continuing to happen, more and more frequently. It has happened three more times, since I first mentioned it in the thread "Parser Stuck (?) When Quick Reporting" - and it has happened twice within the past 24 hours.

I would really like to know whether or not anyone else who uses Quick Reporting is experiencing problems similar to this.

I submit spam using the Quick Reporting method. Multiple spam messages are submitted as attachments of type "message/rfc822" in a single message from a web mail client called "SquirrelMail 1.4.6".

Sometimes, when I submit spam this way, the spam message that is the last attachment of the submisison is not parsed or reported. Everytime this happens, I recieve no confirmation for ANY of the spam in the submission (and sometimes no confirmation for other spam submitted in a separate message, a short time earlier).

The failed spam is always listed in my Past Reports, along with the other spam from that submission (the other spam is handled and reported correctly). But, the failed message just appears as "No reports filed". Since there are no reports filed, and I never receive the confirmation email, there is NO WAY FOR ME TO GET A TRACKER for the spam that fails in this manner.

If I re-submit that failed spam message, it is always handled and reported correctly - meaning that it is not some characteristic of the message that is causing it to fail.

The FIRST TIME this happened to me, a SpamCop admin was able to find the tracker for the failed message, and provide it to me. This tracker showed that the message was intact, and would have been properly handled had the parser processed it - meaning that the problem is not due to my email client failing somehow to properly attach the spam message.

When this problem happened to me yesterday morning, I had submitted a total of 8 spam messages, in two submissions, each containing 4 attachments, just a few minutes apart. The failure occurred, on the last attachment of the second submission. The 7 other spams were properly handled, according to the Past Reports page. But I never received a Quick Report confirmation on ANY of these eight spams, even though they were submitted in separate email messages.

Here is the Past Reports page listing for that failed message:

--------------------------------------------------------------------------------

Submitted: Thursday, September 07, 2006 8:38:18 AM -0400:

Summer is almost here, be ready

No reports filed

--------------------------------------------------------------------------------

I then re-submitted that single spam, which was properly handled, and created this tracker:

http://www.spamcop.net/sc?id=z1058942453z0...de74a8bab2f3caz

I have other examples, in case anyone is interested. I also have copies of the original spam, and of the emails used to submit the spam, from each time this failure has occurred.

I am convinced that this is not a "one time" glitch, and that there is some systemic problem here. If there is something that I could be doing wrong, I would really appreciate some help in figuring out what that might be.

Thanks.

Share this post


Link to post
Share on other sites

Noting this is a continuation of http://forum.spamcop.net/forums/index.php?...ost&p=47027 which was not resolved.

I hope another SquirrelMail user is able to contribute/add observations to this - I'm certainly familiar with "problem" spam but that experience was confined to my email application (certain spam, for no reason that was clear or predictable at the time, caused a Netscape 4.79 error when attempting to forward as attachment). Your case, if it depends on SquirrelMail, appears to add some weird interaction with the SC processing which is difficult to understand.

... I then re-submitted that single spam, which was properly handled ...
Just clarifying - this is a manual "paste-in" submission?

Share this post


Link to post
Share on other sites

I am re-submitting this issue for discussion, since it is continuing to happen, more and more frequently. It has happened three more times, since I first mentioned it in the thread "Parser Stuck (?) When Quick Reporting" - and it has happened twice within the past 24 hours.

I just wnet back through my history since Sept 1 (160 messages out of 1256 reported since June 9, 2006) and found none that showed "No reports filed" except for the most recent which had been submitted less that 2 minutes before. I then went back and saw that one had also processed.

I submit using the Report spam link within SpamCop's webmail application. We have been told that is using the same process as emailing them as attachments and the responses are the same. I usually only send a couple at a time, however, with a max being 10 from overnight collection.

Share this post


Link to post
Share on other sites

Noting this is a continuation of http://forum.spamcop.net/forums/index.php?...ost&p=47027 which was not resolved.

Yes, that is correct. I am sorry if I should not have started a new thread, but I thought that enough time had passed since that old thread, that it wasn't worth adding to it - plus there was email interraction between me and a SpamCop admin that was not posted in that original thread.

I hope another SquirrelMail user is able to contribute/add observations to this - I'm certainly familiar with "problem" spam but that experience was confined to my email application (certain spam, for no reason that was clear or predictable at the time, caused a Netscape 4.79 error when attempting to forward as attachment). Your case, if it depends on SquirrelMail, appears to add some weird interaction with the SC processing which is difficult to understand.

I don't personally think this is a SquirrelMail problem, but I am not ruling it out either. As I stated in my post, the first time I reported this, the admin was able to find the spam which got "hung up", and he gave me a tracker for it. Looking at that tracker, the spam appeared to be fully intact, and the parser had no problems analyzing the message, and determining reporting addresses. This means to me that SpamCop servers must have correctly received, recognized, and separated that attached spam message from my submission email. After that is done, I can't imagine what impact Squirrel Mail could have had on the process.

Just clarifying - this is a manual "paste-in" submission?

When this problem has occurred, I have tried three different reporting methods to re-submit the offending spam message: I have pasted it in the reporting web page; I have submitted it via email as an attachment to the normal reporting address (from SquirrelMail); and I have submitted it via email to the Quick Reporting address (again, from SquirrelMail). In every case, everything worked absolutely correctly, on the second attempt.

Edited by BlueRock

Share this post


Link to post
Share on other sites

Thanks for checking!

I submit using the Report spam link within SpamCop's webmail application.

Since I started using SpamCop, I have used all three reporting methods (pasting into the web page, submitting reports via email, and Quick Reporting). I had no problems with the first two. I do not use SpamCop email.

I think the problem we are discussing occurs only when Quick Reporting.

Share this post


Link to post
Share on other sites

I think the problem we are discussing occurs only when Quick Reporting.

Yes, and my account is setup for Quick Reporting. When I hit the Report spam button, I get the same email reply from spamcop (when I had it enabled) as when I forward to my quick.x address.

Of the 160 messages viewed, probably less than 5 were full reports. I only full report those that slip by spamcop into my inbox.

Share this post


Link to post
Share on other sites
When this problem happened to me yesterday morning, I had submitted a total of 8 spam messages, in two submissions, each containing 4 attachments, just a few minutes apart. The failure occurred, on the last attachment of the second submission. The 7 other spams were properly handled, according to the Past Reports page. But I never received a Quick Report confirmation on ANY of these eight spams, even though they were submitted in separate email messages.

Aside from the fact that you didn't get a Quick Report confirmation, my guess is that occasionally the parser hits a snag when one of the lookups times out and that's why no reports were filed. If the spam is reprocessed, the lookups work and then the parser works. (read the thread again and saw that you had talked to deputies about another spam - if my guess wasn't mentioned, then perhaps it is not applicable).

Why there was no QR confirmation may have nothing to do with it or may be part of the problem or may have happened because there was a 'no report'.

It may happen more frequently with Quick Reporting because it is /quicker/ but I think it does happen sometimes with regular submissions.

Looks like you are a thorough person so you have lots of possibilities to test!

Miss Betsy

Share this post


Link to post
Share on other sites

Thanks for your comments!

Aside from the fact that you didn't get a Quick Report confirmation, my guess is that occasionally the parser hits a snag when one of the lookups times out and that's why no reports were filed. If the spam is reprocessed, the lookups work and then the parser works. (read the thread again and saw that you had talked to deputies about another spam - if my guess wasn't mentioned, then perhaps it is not applicable).

That possibility was not discussed. But, it sounds plausible to me. Before I was using Quick Reports, it would happen that I would click on the link to manually confirm a spam, and the page would not come up (or some strange error would be displayed). That may be due to one of the timeouts you mention.

When something like this happened, I would just go back to the front reporting page, where I could click on the link to parse the spam again. But, there is no mechanism to do something like this for Quick Reporting.

If timeouts like the one you describe are common, I would think that the Quick Reporting program would have a built-in mechanism to retry failed messages after some amount of time.

The only point that argues against this, is that every time it I have seen this problem, it has happenened on a spam message that was the LAST attachment in a submission message. If timeouts occur randomly, why would that be the case?

BTW- I made a suggestion to the Admin that they should put a tracker link to everything listed on the "Past Reports" page, so that you could view the spam, even if no reports were filed. (Right now, you can only click on items on the Past Reports page that have a Report ID, which takes you to the Report, where you can click on a tracker link). I don't know how well suggestions like this are accepted.

Why there was no QR confirmation may have nothing to do with it or may be part of the problem or may have happened because there was a 'no report'.

Everytime I have not received a QR confirmation, I have found a corresponding un-reported message in my past reports list. AND, everytime I have found an un-reported message in my past reports list (an hour or so after submitting spam), I have gone back and checked, and found that I did not receive a QR confirmation. Beyond that, I have never failed to receive a QR confirmation.

I am pretty certain there is a correlation between the two. So, if your theory that timeouts are the root cause is true, then a secondary cause is that the QR confirmation is not sent. Maybe the program waits for all messages to be processed, before sending the QR confirmation.

There have been times when no reports were filed for some external reason - i.e. the abuse desk for the spam has refused munged reports. But, in those cases, I have still received a QR confirmation.

It may happen more frequently with Quick Reporting because it is /quicker/ but I think it does happen sometimes with regular submissions.

My observation is that Quick Reporting is not actually "quicker". Usually, it takes 5-10 minutes, and I have seen it take up to 20-30 minutes, to process spam that I submitted via Quick Reporting. It rarely took so long with normal reporting.

Also, if I make multiple submissions during that time period, the Quick Reporting program seems to handle all the submissions together - and I will receive only one QR confirmation that lists all submitted spam, even if I had submitted spam in separate submission emails.

It is "quicker" for the user, though, because you don't have the manual confirmation step. I don't really care how long the parser takes.

Looks like you are a thorough person so you have lots of possibilities to test!

Thanks! But, I am reaching the end of my resources. I have tested about everything I can think of. If someone at spam Cop is interested in helping, I would appreciate some assistance!

Share this post


Link to post
Share on other sites

This snagged my attention in a recent NG posting (my emphasis)

Path: news.spamcop.net!not-for-mail

From: "anon" <vxpy7do02[at]sneakemail.com>

Newsgroups: spamcop

Subject: Re: Forwarding Submissions Automatically

Date: Sat, 9 Sep 2006 14:50:04 -0700

Xref: news.spamcop.net spamcop:160161

"Blue Rock" <nobody[at]devnull.spamcop.net> wrote in message

news:edur3o$rek$1[at]news.spamcop.net...

> "Steven Maesslein" <nobody[at]nowhere.invalid> wrote:

>> Once you're sure that you're not going to report your own ISP you can

>> start sending your spam to:

>>

>> quick.############[at]spam.spamcop.net

>

> I have been through this already. Here is what you can expect:

>

<clip>

> One problem I have observed: If Quick Reported spam is not processed for

> some reason, you do NOT get a Quick Report confirmation, and there is no

> way to get a tracker, to see what might have gone wrong. This does happen

> occasionally (to me, at least) - I am not sure why.

>

If you put reply anyway in the subject line, you should (always) get a

response.

(Not guaranteed - with or without reply anyway I sometimes do not get the

confirmation.)

--

A SpamCop user and forum reader,

Not Admin

<clip>

I've not heard of this before but, if you've tried everything else, here is one more thing to try.

Share this post


Link to post
Share on other sites

Noting further discussion has moved to the above NG, involving Blue Rock, Wazoo and anon and carting some stuff over for continuity to benefit/for the interest of other users.

Though technically, the last "words from Don" that I recall

were that this magic phrase "wasn't needed anymore / didn't

work anymore / had been coded out / etc., etc. etc."

I've got way too much other stuff going on right now, so I'll

leave the searching for someone else .. but this data is absolutely

ancient stuff .....almost dating back to when the "submit-by-email"

process was created .... Julian running the whole thing from "the

house" and the local ISP ... way back when ....point is that folks

were 'prescribing this fix' long after it had 'disappeared' (per Don)

And what was an independent and virtually sumultaneous post:

I think someone else posted this several years ago. I do not think there is a FAQ on it.

Maybe a deputy will chime in and clarify - as to whether reply anyway is still needed (I think another poster said it was no longer needed but my experience of no subject = no response vs. reply = response -- I still add it.)

Share this post


Link to post
Share on other sites
I've not heard of this before ...
It helps to use the correct search terms! Emailed spam Submissions Disappearing?, No Confirmation e-mails? (In TECHNICAL DETAILS).
I'll leave the searching for someone else ...
Don's NG post seems to be quoted as confirmation it no longer applies (not spefically talking about quick reporting it seems). Yet some swear it still works. As always, the myth is more memorable than the fact, and less mutable. Sorry I didn't research this more accurately from first mention.

Share this post


Link to post
Share on other sites
This snagged my attention in a recent NG posting (my emphasis)I've not heard of this before but, if you've tried everything else, here is one more thing to try.

Thanks - in fact, that was me in the newsgroup. I was explaining to someone who is considering using Quick Reporting what my experiences with that method have been - the various pros and cons. And, another NG poster suggesting the "reply anyway" subject line method.

Share this post


Link to post
Share on other sites
Thanks - in fact, that was me in the newsgroup. ...
Sheesh - I see that now that you mention it. Some days/weeks it just ain't worth the effort of gnawing through the straps. :D Anyway, some more history recorded "here" which is apparently a little less evanescent than over "there".

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0