Thank you for this explenation. I did as you said, removed the domain mailbox (over the weekend we were flooded with more than 3000 mails). Now the message "job killed by daemon" does no longer appear (even if spamhalter is active)!! It works now as I expected to do. Of course I have now 20-30 delivery failure messages in the postmaster box, but most of spam rubbish is managed away.

Thank you all for your support.

Chris

Hello!

We are in the evaluation phase (60 days) to use Mercury for our company (since I used it on another server for private purpose for more than one year).
On both servers we have Spamhalter in use.

In this company environment I notice that lots of mails get lost. They are not delivered to any mailbox. I have settled up global filtering rules to move a message that is marked as spam to a certain mailbox (called spam), however this box is empty. To prevent lots of entries in the administrator box I defined the domain using a DM - command as mention here: 
http://kbase.pmail.gen.nz/viewfull.cfm?ObjectID=C6F298F6-6DD3-47F8-B5F8DF5F95CA447D

 The core screen shows the entries like this:

Thu 08, 18:31:52 Job MG000005: from xxx@yyy.com [non-local]
  * Job killed by Daemon.

If I look the for a mail (CNM) with this timestamp and have a look into all mailboxes but this message is nowhere. I have the same settings on spamhalter like on the private server and this behavior appears only on the company server.

What did I wrong?

Thank you in advance, Chris

The "spam" mailbox is reserved by SpamHalter for corrections; anything you move there will result in the message being deleted after the correction is submitted. Find another name for the mailbox that you move spam messages to and it should work as intended.

/Rolf 

Thank you for your quick answer. I did as you said - I created a mailbox junkmail.
In Spamhalter the settings are like this:
- Basic setting: missed spams: spam@sconsult.ch
- Basic setting: false positivies: nospam@sconsult.ch
- Message tagging - Subject prefix: SPAM?

The last filtering rule (global rule) in Mercury is: Headers S contains [SPAM?] = Action: Move to another user: junkmail

I intend spamhalter to recognize spam mails and Mercury to move them to the junkmail box (to get an overview). If mails appears with typical headers (e.g. Subject: Swiss Branded Watches) I will set a filter checking the subject with action to delete the mail. Currently I have disabled all deleting processes to see how this works. On my private mailserver this works very well.

However the behavior on the company server remains the same, most messages (about 90%) get killed by Daemon.
What have I done wrong?

Chris

P.S: Currently I disabled spamhalter not to loose any mails.

[quote user="cw23"]

Thank you for your quick answer. I did as you said - I created a mailbox junkmail.
In Spamhalter the settings are like this:
- Basic setting: missed spams: spam@sconsult.ch
- Basic setting: false positivies: nospam@sconsult.ch
- Message tagging - Subject prefix: SPAM?

The last filtering rule (global rule) in Mercury is: Headers S contains [SPAM?] = Action: Move to another user: junkmail

I use the filter If expression headers matches "X-SPAMWALL: SPAM detected!" Move "@c:\\pmail\\mail\\spamscan" where SPAMSCAN is a user directory.

I intend spamhalter to recognize spam mails and Mercury to move them to the junkmail box (to get an overview). If mails appears with typical headers (e.g. Subject: Swiss Branded Watches) I will set a filter checking the subject with action to delete the mail. Currently I have disabled all deleting processes to see how this works. On my private mailserver this works very well.

However the behavior on the company server remains the same, most messages (about 90%) get killed by Daemon.

Killed by daemon just means that the message was processed by a daemon, the message was not deleted but it was removed from the normal delivery process.   In the case of Spamhalter that means that the message was to either to SPAM or NOSPAM and so was moved to the appropriate user directory.  After processing it will be deleted. 

Spamhalter should only be tagging the headers of the messages and your filter is the one that actually should be moving the mail out of the normal delivery process.   In this case it would show "Job killed by filtering rule"

Are you running any other daemons at all?

What have I done wrong?

Chris

P.S: Currently I disabled spamhalter not to loose any mails.

Thank you for your fast answer and sorry for my delay. I can do my test during the night only, since it does not work yet. So it takes a little bit of time to test.

I just did what you sayed - without success (unfortunately). I have now the following situation:

- SpamHalter on (during the night; it is the one and only daemon that is running .. how can I be sure?? - see below)
- Mails passes spamhalter. They appear as "Job killed by filtering rule". The appear now in the spamscan box (as you described).
- However most mails are marked as "Job killed by daemon" and disappear completely. They do not appear in any box at all. It is about 95% of all mails.

I installed Mercury with spamhalter and greywall at the end of the installation routine. Since it did not work as I liked, I uninstalled spamhalter (using the uninstall routine in the program menu of spamhalter). Greywall also disappeared in the menu! I then re-installed spamhalter. I closed (CTRL + ALT-F4) and reopened Mercury several times
after this first installation. Should i reboot the server (Windows 2008)? Could it be that greywall is still working somewhere in the background
even if I has never activated it? Do you need the config files to analyse the situation?

Bye the way: As soon as i disable Spamhalter all mails are delivered to the mailboxes (or to spamscan it the mail adress does not exist with the DM=spamscan trick).

Thank you, Chris

P.S.: Since our goal is to force IMAP processes I looked for an option to create a Junkmail IMAP-folder and move all SPAM-marked mails to this Junkmail folder - at least for user with IMAP-access. I did not find a way how to do this therefore I saw the solution by moving all SPAM-marked mails to a separate mailbox (spamscan as you called). If this highly elegant solution with junkmail-folder would work I would be very glad :-)

[quote user="cw23"]

Thank you for your fast answer and sorry for my delay. I can do my test during the night only, since it does not work yet. So it takes a little bit of time to test.

I just did what you sayed - without success (unfortunately). I have now the following situation:

- SpamHalter on (during the night; it is the one and only daemon that is running .. how can I be sure?? - see below)

You can look at the daemon.ini file in the Mercury directory to see what daemons you are loading.

- Mails passes spamhalter. They appear as "Job killed by filtering rule". The appear now in the spamscan box (as you described).
- However most mails are marked as "Job killed by daemon" and disappear completely. They do not appear in any box at all. It is about 95% of all mails.

 The only thing that would cause SpamHalter to kill a message is if the message is sent to the SpamHalter SPAM or NOSPAM email address.  Everything else is just tagged with the headers.  If you are receiving mail via MercuryS you can see the mails address as it comes in.

I installed Mercury with spamhalter and greywall at the end of the installation routine. Since it did not work as I liked, I uninstalled spamhalter (using the uninstall routine in the program menu of spamhalter). Greywall also disappeared in the menu! I then re-installed spamhalter. I closed (CTRL + ALT-F4) and reopened Mercury several times
after this first installation. 

Actually you can see Graywall working at the MercuryS level.  It also would never kill a message since the messages blocked by Greywall never get to core to show this message.

Should i reboot the server (Windows 2008)?

Should not be necessary.

Could it be that greywall is still working somewhere in the background even if I has never activated it?

Look at the daemon.ini file to see if it's being loaded.

Do you need the config files to analyze the situation?

Not sure which ones to tell yuo to send me.  There would be nothing in mercury.ini.

Bye the way: As soon as i disable Spamhalter all mails are delivered to the mailboxes (or to spamscan it the mail adress does not exist with the DM=spamscan trick).

Sure looks like there is something wrong with your setup but I have no clue what.

Thank you, Chris

P.S.: Since our goal is to force IMAP processes I looked for an option to create a Junkmail IMAP-folder and move all SPAM-marked mails to this Junkmail folder - at least for user with IMAP-access. I did not find a way how to do this therefore I saw the solution by moving all SPAM-marked mails to a separate mailbox (spamscan as you called). If this highly elegant solution with junkmail-folder would work I would be very glad :-)

[quote user="cw23"]

P.S.: Since our goal is to force IMAP processes I looked for an option to create a Junkmail IMAP-folder and move all SPAM-marked mails to this Junkmail folder - at least for user with IMAP-access. I did not find a way how to do this therefore I saw the solution by moving all SPAM-marked mails to a separate mailbox (spamscan as you called). If this highly elegant solution with junkmail-folder would work I would be very glad :-)

[/quote]

Moving messages to an IMAP folder is not currently supported, but has been mentioned on the wishlist, and may appear in a future version.

If you could provide your spamhalter.ini and the relevant filtering rules, it may shed some light on your problem.

I put all check results in one answer:

> You can look at the daemon.ini file in the Mercury directory to see what daemons

you are loading.
The only daemon is spamhalter (I checked the daemon.ini).

> The only thing that would cause SpamHalter to kill a message is if the

message is sent to the SpamHalter SPAM or NOSPAM email address. 

Everything else is just tagged with the headers.  If you are receiving

mail via MercuryS you can see the mails address as it comes in.

The target adresses are neither spam nor nospam but different existing or non-existing adresses.

> Sure looks like there is something wrong with your setup but I have no clue

what.
Hmm. If we cannot solve the problem i just could uninstall and reinstall the server. But if i would take the migration guide I would copy the problems as well if they are in some control files, isn't it?

Other aspects I could imagine (without knowing the code):
- Could it go in troubles with aliases?
- Problems with IMAP?

Chris

Here are the content of files requested by dilberts_left_nut:

----------------------------------
[SpamHalter]
Queue=
Debug=0
BayDebug=1
CleanTime=20
StatRate=1
SpamAddr=spam@sconsult.ch
NoSpamAddr=nospam@sconsult.ch
HoneyPot=
LocalIP=127.0.0.1/8,192.168.0.0/16
DynamicHost=
Password=password
BlockTag=X-Blocked
VirusTag=attach removed
LogVirWall=0
subject=SPAM?
tagname=X-SPAMWALL
WhitelistText=Whitelisted
BlockText=Blocked SPAM!
DebugText=Debug -
ProbText=probability -
SpamText=SPAM detected!
bayDataDir=D:\Mercury\spamhalter_DB\
logfile=D:\Mercury\Statistics\spamhalter\sh~Y~W.LOG
Enabled=0
SpamTrack=0
TrainAlways=1
IgnoreWhite=0
ImageParser=1

[bayDynamic]
bayForcedWrites=1
bayNoSpamBoost=3
bayClasifyMaxTokens=20
bayUnknownProb=40
baySpamProb=80
bayMaxCorrCnt=50
bayOldDays=30
bayExpire=180
bayWhiteOldDays=60
CustomHeaders=

[bayStatic]
bayMaxLength=8192
bayMinTokenLength=3
bayMaxTokenLength=25
----------------------------------

RULES.MER contains:
----------------------------------
Mercury Global Rules
If expression headers matches "X-UC-Weight:*" Move "trash"
If expression headers matches "X-Mailer: The Bat!*" Move "trash"
If header "S" contains "Acheter V" Move "trash"
If header "S" contains "] Amtsgericht" Move "trash"
If header "S" contains "Euro-Club" Move "trash"

.. here comes some similar rules with other key words. IT ends with ...

If header "S" contains "Swiss Branded Watches" Move "trash"
If header "S" contains "B?U3dpc3MgQnJhbmRlZCBXYXRjaGVz" Move "trash"
If expression headers matches "X-SPAMWALL: SPAM detected!" Move "@d:\\mercury\\MAIL\\spamscan"
-------------------------------------------

The Mercuri.ini contains:
--------------------------------------------
[Domains]
mail: mail
DM=spamscan: sconsult.ch
mail: mail.sconsult.ch
--------------------------------------------

The Mercuri.ini contains:
--------------------------------------------
[Domains]
mail: mail
DM=spamscan: sconsult.ch
mail: mail.sconsult.ch
--------------------------------------------

[quote user="cw23"]

----------------------------------
[SpamHalter]

SpamAddr=spam@sconsult.ch
NoSpamAddr=nospam@sconsult.ch
[/quote]

This could be having an issue with your weird Merc.ini [Domains] section, try using just "spam" & "nospam"

Also, have you actually set up "spam" & "nospam" (& "spamscan") as local users?

> Why have you done this? You are moving all mail for the entire domain to the spam folder. If you do not have an alias for all the good users to the domain mail.sconsult.ch then everything goes here.

That solution was recommended in this forum to have all unknown users. Without doing so my postmaster box is overcrowded with Deliviery failure messages and I have to open every message because I do not see the subject, the from and the receiver adress.

As recommended I have set aliases for all good users, e.g. :
- Alias -> Real adress
- chweiser@sconsult.ch -> chweiser
- ch.weiser@sconsult.ch -> chweiser
- etc.

This could be having an issue with your weird Merc.ini [Domains] section, try

using just "spam" & "nospam"

I changed it. I will try out tonight (CET) if it works. I will observe it and tell you afterwards.

Also, have you actually set up "spam" & "nospam" (& "spamscan") as

local users?

Yes, i did.

But do you really need to accept mail for invalid users? If not change that setting in MercuryS configuration and remove the domain mailbox.

If you for some reason really want to receive mail with non-existing user address you could as an alternative try this daemon:

http://community.pmail.com/files/folders/community_add-ons_for_mercury/entry10133.aspx 

It will attempt to reject spam messages and only let good mail through, and should be used together with a reliable blacklist, for instance Spamhaus.

/Rolf 

> But do you really need to accept mail for invalid users? If not change

that setting in MercuryS configuration and remove the domain mailbox.

The setting "Accept mail for invalid local adresses" is already OFF in MercuryS.
I put this domain settings because of easier handling - in the spamscan box i see via IMAP the receipient and the subject. In general after a quick overview I will delete all messages. Otherwise I have the same hunderts of mails per day in the postmaster box with subject "Delivery failure". There I have to open every mail to see if perhaps it has a misspelled receipient or just spam. As it is described in the mercury help: "This refusal can result in the sender getting unhelpful mail messages from their mail program. If you check this control, Mercury will accept the message and the Mercury core module will later reject it and send it back to the sender, but in a more clearly-explained form. Mercury will also refer a copy to the postmaster, who can then correct any addressing error and pass it on to the proper recipient." If the system runs stable (with all mails passing) I will define filter rule to directly delete mails containg subject or from adress containing "casino" etc. This will reduce the amount dramatically. However i switched all deletions off until my problem is solved. I will then also have a look at the daemon (thank you for the link!).

I assume that the system is not compleately misconfigured - because I copied the settings from the server I use privately and everything is fine there.
The only difference is that the company server runs on Win 2008 (instead of Win 2000) - but should this really be the point?

Chris

[quote]

 The setting "Accept mail for invalid local adresses" is already OFF in MercuryS.

[/quote]

With a domain mailbox setup there are no invalid local addresses, so all mail is accepted anyway.

[quote] I put this domain settings because of easier handling [/quote]

hmm... hows that working out [:P]

You should (IMHO) remove the domain box setting. Invalid addressed mail will then be rejected at SMTP time, you won't have to wade through lots of dictionary spam and any misspelled good mail will get a very helpful SMTP bounce message saying "user not known", and you won't fill the postmaster box with delivery failures from trying to send failure notification mails to forged FROM: addresses.

Then you should only have spam being MOVED to the spamscan folder by your filter rule (triggering on the X-Blocked header is recommended), with any missed spams manually copied into "spam" & false positives into "nospam". IMAP accounts for the "spam" & "nospam" users are ideal for this, as you can drag & drop corrections without altering the mail headers as forwarding would do.