Jump to content

Parser Stuck (?) When Quick Reporting


BlueRock

Recommended Posts

Posted

I've been seing it quite a lot lately on my quick reports.

Again, the clue is no "Quick reporting data" email returned.

I used the OLSpamcop reporting tool (when I use outlook) and I have it set NOT to delete the report that it sends.

When I found a "no report filed" entry in my history, I found the orignal email with the 2 reports (in this case) attached. I deleted the report that parsed ok, and then re-submitted the report. This time it parsed ok and I got a "Quick Report data" email response.

The next time I noticed one, it was in a report with 3 spam reports in.

This time, rather than resubmit the file on its own, I added in 5 new spam reports and made the 'failed' one number 2 or 3 in the list.

Again, it parsed ok and no problems second time around.

I would hazzard a guess that the parser does get stuck when parsing the mail The exact reason I can't be certain of, but those that have mentioned a timeout when querying internal or external information can't be that far wrong.

I would also bet that the whole block responsible for parsing has some sort if error, then return type function and therefore bypasses the 'send "Quick reporting data" ' function.

Wouldn't be too much trouble to add in a 'time started parsing, time ended parsing' and to make sure the "Quick reporting data" is always sent...

(*Not quite as simple as that... adding in even those two simple functions would increase the CPU load considerably when you look at the amount of processing that is performed, so it might not be a simple thing to achieve).

Either way, it is a problem... and most likely similar as others have said to the random failures when the manual submit method is used (and/or the web page - but that has problems of its own...)

Regards

Chris

Posted
If you put reply anyway in the subject line, you should (always) get a

response.

I just wanted to let everyone know that I have been adding the suggested "reply anyway" subject to my quick-reported spam. The problem has not happened for about a week - but it did happen again with spam I submitted yesterday evening.

In this case I sent a Quick Report submission, containing 11 attached spam messages, and the subject line "reply anyway". According to my Past Reports, the 11th (last) attached spam was not processed, and I received no QR confirmation email. Also, according to Past Reports, the other 10 spam attachments were handled and reported normally.

When I re-submitted that single 11th message, as an attachment to the Quick Report addres, it was handled and reported correctly.

Posted
When I re-submitted that single 11th message, as an attachment to the Quick Report addres, it was handled and reported correctly.

I'm convinced that this is just some sort of 'time-out' issue when processing the spam. Doesn't matter if it is single or multiple reports, quick or normal. It just sometimes happens.

'Eventually' the coders will get it tightened down.. If not, I can offer competitive contract rates ;)

Posted
I'm convinced that this is just some sort of 'time-out' issue when processing the spam. Doesn't matter if it is single or multiple reports, quick or normal. It just sometimes happens.

'Eventually' the coders will get it tightened down.. If not, I can offer competitive contract rates ;)

If some time-out issue (or any other issue) happens on a "normal" report, you can just click on the link to report that spam again, and it most likely will be handled correctly the second time. But with Quick Reports, you don't have that option.

Also, for me at least, this issue has happened only with multiple spam messages, submitted via Quick Reporting, and the un-handled spam is always the last attachment.

I am not so sure that 'eventually' the coders will get it tightened down. This first time I reported the problem, an admin told me that I was the only one reporting it, and that if it was a real problem, they would be inundated with complaints. If the coders are unaware of the problem, they won't be working on fixing it.

By posting my message here, I was hoping to find out whether other people who use Quick Reporting are experiencing something similar. Thus far, you are the only one who has seen this.

Also, someone in the NG named 'Eustace' posted a message about a similar (though not identical) problem, in a thread titled "Quick submitting", Sept. 14, 2006:

I got freePOPs so that I can download my webmail accounts spam to my

mail client (FireFox) and the attach them all to a letter of submission

to (quick) Spamcop. Some spam, however, are not reported, and SpamCop'

response says:

Here are the results of your submission:

Processing spam: From:

Subject:

If I copy the message source and paste it to SpamCop's website they are

reported.

I think that happens with messages in html.

What's going on?

Bottom line: As long as the problem is observed by only a handful of users, I don't think they will pay much attention to it. :(

Posted

Bottom line: As long as the problem is observed by only a handful of users, I don't think they will pay much attention to it. :(

Yup, thats the problem. It is only being observed by a handful, and reported by even less.

Most don't even know the problem exists.

But, in its defence. When you consider the % of reports that it probably effects, it is most likely quite low down the priority list.

I guess if it were a method of exploting a spam format such that reports cannot be sent, it would be dealt with more quickly.

I've not understood yet why spammers have not set up certain DNS behaviour such that querries might take a period that would cause some scripts to time out, where as Mr. Joe Public might be more patient in waiting around for a DNS to resolve.

I am sure that is one area of possible timeouts causing scripts to bomb out...

Posted

I did receive 2 "No reports filed" messages today, but on investigation, neither are like your problem.

Submitted: Tuesday, September 19, 2006 8:44:01 AM -0400:

Massive alert has been issued problem

No reports filed

This one I submitted from webmail by trying to forward to my submit address. I had forgotten I was not using the Beta any longer and that the production webmail still has a problem with adding blank lines on forwarding. http://www.spamcop.net/sc?id=z1071114038zb...3fa9668985a272z I simply returned to using VER for reporting this one without issue.

Submitted: Tuesday, September 19, 2006 6:33:28 AM -0400:

No reports filed

This one was submitted using the "Report spam" link within webmail in my Held Mail folder. It happened because it is a blank email with no body per the Message source within spamcop's webmail system. I resubmitted as below to get a tracking URL. Normally, I ignore these as they are not worth the time needed to devote to them.

http://www.spamcop.net/sc?id=z1071222352z8...4d1abbb3881f36z

Posted

Thanks, Steve

I did receive 2 "No reports filed" messages today, but on investigation, neither are like your problem.

As you said, those examples are not like the problem I am having. In both of your examples, there was a demonstrable problem with the email messages that caused them to fail. Had you submitted those exact same messages, over and over again, without modification, they would have continued to fail.

With the problem I am reporting, EVERYTIME IT HAS HAPPENED, re-submitting the failed message has always resulted in a successful parse and reports being filed. So, there is nothing about the mesasge itself that is causing it to fail.

Posted
But, in its defence. When you consider the % of reports that it probably effects, it is most likely quite low down the priority list.

I guess if it were a method of exploting a spam format such that reports cannot be sent, it would be dealt with more quickly.

Speaking as a programmer myself, and one who has been on the receiving end of tech support requests, I would like to know about behavior such as this, in code that I have written. I normally pursue any bugs found in code that I have written, no matter how minor they appear to be on the outside. Sometimes they are symptoms of a potentially more serious problem. Perhaps this one is something that could eventually be exploited by a hacker.

On the other hand, I understand that programmers with limited time must prioritize thier work, so I don't mean to be too critical.

Speaking to any SpamCop personnel who may be around:

I have some ideas on how to collect more information on this problem, but they are things I don't have the power to implement. For example, if I could re-send the complete original submission email message, with all the attached spam, to the Quick Reporting address, without the risk of sending duplicate reports, and then observe whether or not the same problem happens again, it might tell us whether something about the submission email message (i.e. the particular combination of spam message attachments) is causing the problem to happen.

Doing this, we might also find a way to consistently force the problem to happen - a very important first step for a programmer seeking to resolve a problem such as this.

Posted

OK,

A further email sent "upstairs" with the new data/assessment:

Date: Thu, 21 Sep 2006 03:03:17 +0800

To: SpamCop Deputies, SpamCop Admin

Subject: Intermittent Quick Reporting Failure

This has never been resolved and may be more widespread than was at first believed. While only a small handful of reporters have verified these occurrences there is the worrying possibility of a greater incidence sneaking through unremarked or unnoticed. Accordingly, this may be worth further investigation.

The most recent handful of forum postings are at:

http://forum.spamcop.net/forums/index.php?...ost&p=47947

and these confirm that a number of other reporters are seeing the problem.

*BACKGROUND*

The occasional failure to report the last in a batch of quick reported spam has been discussed in the news groups and forums, it has been reported and it has been looked at by Don. The topic starting, in full, is at:

http://forum.spamcop.net/forums/index.php?...ost&p=47027 has much of the history.

The only indicators or diagnostics of the occurence for reporters are

1. the non-delivery of the QR Data response message for the batch and

2. a "No reports filed" for the last message as seen in Past Reports.

The errant spam itself seems undistinguished and has always parsed correctly for reporting when resubmitted.

Regards,

(Farelf)

Posted

Today (Thursday, Sept. 28, 2006), the same problem (described in the original post) happened THREE TIMES IN A ROW, on three separate spams submitted at various times throughout the day, as single attachments.

Posted
Today (Thursday, Sept. 28, 2006), the same problem (described in the original post) happened THREE TIMES IN A ROW, on three separate spams submitted at various times throughout the day, as single attachments.
An unwelcome development. Other reporters experiencing this are invited to add their comments (or at least their names) in the further quest to define the extent of the problem.

The only indicators or diagnostics of the occurence for reporters are

1. the non-delivery of the QR Data response message for the batch and

2. a "No reports filed" for the last message as seen in Past Reports.

And,as now seen, happening on single attachment QRs.
Posted

An unwelcome development. Other reporters experiencing this are invited to add their comments (or at least their names) in the further quest to define the extent of the problem.

And,as now seen, happening on single attachment QRs.

I am not sure which submission method I use;- I send spam via attachments to a personal URL that SpamCop issued when I subscribed.

In the past I have always received 1 report per submitted mail.

Recently however I have been getting unpredictable results... There appears to be no particular pattern.

I send

6 submissions and get 3 reports

6 submissions and get 0 reports

etc

Some of the reports I DO get are to tell me that the messages can not be parsed (Or Like)

I have tried 1 attachment per email (6 emails)

6 attachments in one email

All give the same unpredictable report reliability

Please excuse my terminology, I am no expert, just a mere human. :blink:

Regards to all

Mike

Posted

This problem has happened now, on practically every submission, since last Thursday.

So, I tried another experiment. I went into preferences, and set myself to be copied on every report sent. The next time I received spam, I quick-reported it. This time, I reported two spam email messages. As usual, the last attached spam message failed. Also, as usual, my Past Reports page shows the first message as being processed and reports sent, and the second as "No Reports Filed". As usual, I received no "Quick reporting data" confirmation message.

I also did not receive any copy of any report supposedly filed, for either the first or second spam attachment. When I view the parse for the FIRST message, for which reports were supposedly sent, it DOES show my address as one to which reports would be filed ("If reported today, reports would be sent to").

I don't know if it is normal that reports are not sent to the "Personal Copies" address for spam which is Quick Reported. A quick search of the FAQ doesn't answer that question.

Does anyone here know?

Thanks.

Posted

I don't know if it is normal that reports are not sent to the "Personal Copies" address for spam which is Quick Reported. A quick search of the FAQ doesn't answer that question.

Does anyone here know?

Thanks.

I don't know that answer either but shold know in a couple of hours (I will have reported spam by then). I believe it is supposed to send the copy.

Just to clarify, you put a local address into the : "Personal copies of outgoing reports" part of the form.

Posted
Just to clarify, you put a local address into the : "Personal copies of outgoing reports" part of the form.

I am not sure what you mean by a 'local' address -- but yes, I put my email address (the one I use for spam Cop reporting) into the "Personal copies of outgoing reports" on the Reporting Preferences page.

Posted

the one I use for spam Cop reporting

Sorry, but my mind may be taking this the wrong way. Confirming it is NOT your submit.x address you put into that location.

By local, I meant an address you have access to. Sorry for the poor wording.

Posted
Confirming it is NOT your submit.x address you put into that location.

No, I am not re-submitting the reports as spam (wow, that would be bad, if you did that!). By "the one I use for spam cop reporting" I mean the one to which spam cop's confirmations are sent everytime I submit spam.

Posted

No, I am not re-submitting the reports as spam (wow, that would be bad, if you did that!). By "the one I use for spam cop reporting" I mean the one to which spam cop's confirmations are sent everytime I submit spam.

Thank you for the clarification. It is what I figured you were saying.

First test seems to indicate that Personal Reports are not sent on quick reports, at least with my current other settings, specifically: Disable quick data reports, which supposed to be the "report was sent" type message and I would expect still to receive the personal copies of reports...

I will keep the test going for a while before complaining myself.

Posted
I don't know if it is normal that reports are not sent to the "Personal Copies" address for spam which is Quick Reported. A quick search of the FAQ doesn't answer that question.

Does anyone here know?

Sorry, that doesn't work any more for regular Reports, and I'm not sure if it ever did for Quick Reports. Please see my most recent Post on the subject of "Personal copies of outgoing reports".
Posted
I don't know if it is normal that reports are not sent to the "Personal Copies" address for spam which is Quick Reported. A quick search of the FAQ doesn't answer that question.

Does anyone here know?

Sorry, that doesn't work any more for regular Reports, and I'm not sure if it ever did for Quick Reports. Please see my most recent Post on the subject of "Personal copies of outgoing reports".

I gave it a try with Regular reporting, and I do get 1 copy of a report sent to my personal address. But I don't get BCC'ed with a copy of every report sent, when multiple reports are sent, as the instructions on the web page indicate should be happening. If I am understanding the comments in the post you referenced, I think that agrees with what you are saying.

But, I get nothing with Quick Reports, even when reports are successfully filed. I was trying to use the 'Personal Copies' feature to see if I could glean any more information about the annoying problem being discussed in this thread - which continues to be a nuissance.

Sometimes a week will go by, where everything works fine. Sometimes the problem happens on every single submission I make.

Also, it has gotten a little harder to track this problem, since they removed the link that says "Older Reports" from the "Past Reports" page. Although, the "&offset=10" method that someone suggested seems to work, at least for now.

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...