<p>I close this old case.</p><p>After ran Mercury couple of weeks without Spamhalter, no crashes at all. After manually compacted Spamhalter's database, few crashes per week with Spamhalter.</p><p> Jyrki</p>

<div>Hi!</div><div> </div><div>Problems with Spamhalter.</div><div> </div><div>Environment:</div><div> </div><div>Mercury version: 4.74</div><div>Spamhalter version: 4.5.1.411</div><div>OS: Windows server 2003 SP2 + all hotfixes in Vmware ESX.</div><div>Antivirus: Microsoft Forefront with Mercury folders excluded.</div><div>Also running ClamAV, Clamwall and Graywall in this server.</div><div> </div><div> </div><div>Prroblem:</div><div> </div><div>When server is under heavy load, Spamhalter writes constantly following messages to its log file:</div><div> </div><div>! 20130806 103123.505 MG00C31B Access violation at address 7C82A061 in module 'ntdll.dll'. Read of address 05A00578</div><div>! 20130806 103217.380 MG00C3B7 Access violation at address 7C82C912 in module 'ntdll.dll'. Read of address 00000000</div><div> </div><div> </div><div>I tried following:</div><div> </div><div>- rebuilt Spamhalter databases (words4.db3 and white4.db3) with commands:</div><div> </div><div>       sqlite> PRAGMA integrity_check;</div><div>       sqlite> VACUUM;</div><div>       sqlite> REINDEX;</div><div>       sqlite> ANALYZE;</div><div>       </div><div>       Integrity check didn’t found any problems.</div><div> </div><div>- Cleared setting “Database Forced Writes”.</div><div> </div><div><span style="font-size: 10pt;">These didn’t help, but when I cleared setting “Tokenize Image Attributes”, error messages disappeared.</span></div><div> </div><div>How much its affects Spamhalter filtering performance, when this setting is cleared? Is there any other way to fix this? Does anyone else have this problem?</div><div> </div><div><span style="font-size: 10pt;"> </span></div><div>Edit: Clearing <span style="font-size: 10pt;"> </span><span style="font-size: 10pt;">“Tokenize Image Attributes” </span><span style="font-size: 10pt;">was only temporary solution. This time there is one  error message in Spamhalter log file</span><span style="font-size: 10pt;">:</span></div><div> </div><div>! 20130808 081851.275 MG007277 Access violation at address 7C82C912 in module 'ntdll.dll'. Read of address 04AF3008</div><div><span style="font-size: 10pt;"> </span></div><div>and Mercury was completely stuck. Console window shows, that Mercury core module was permanently in active state.</div><div> </div><div> </div>

<P mce_keep="true"> </P> <P>This is difficult to diagnose as you say it only happens under heavy load.  Is it possible to run on different hardware to see if the fault is reproducible?</P>

<div> </div><div>Yeah, it is difficult. I'm not sure anymore, that Spamhalter causes this. Image tagging and database forced writes are turned off. Mercury stalls about every four days now. Today there was couple of error message pop-ups in console:</div><div> </div><div>four  GENSOCK.DLL errors: "connection::put data() unexpected error from send (): 10054"</div><div>one "Runtime error 216 at 01664A08" </div><div> </div><div>I'm suspecting ClamAV now, which is doing heavy spam filtering using Sanesecurity's filtering signatures. I removed some signature databases. If that doesn't help, I'll remove MS antivirus next.</div><div> </div><div> Moving from the virtual environment to physical is possible, but little difficult.</div><div> </div><div> <img width="19" height="19" border="0" style="font-size: 10pt;" mce_src="http://community.pmail.com/emoticons/emotion-1.gif" src="http://community.pmail.com/emoticons/emotion-1.gif"></div><div> </div><div>Edit: Those GENSOCK - errors are from Blat, not from Mercury.</div><div> </div>

<div> </div><div>It seems now, that this problem has something to do with NtWrapper. After Mercury was started directly from Loader.exe over a month ago, Mercury has been stable again. I don't know, is this coincidence or not, but problem is disappeared now. This was our only Mercury installation, where Mercury was startet using NtWrapper, and only installation, which has problems.</div><div> </div><div>I'm going to restore one by one settings, which I disabled to tracking this problem. Time will tell, if this good situation is permanent.</div><div><span style="font-size: 10pt;"> </span><img width="19" height="19" border="0" style="font-size: 10pt;" mce_src="http://community.pmail.com/emoticons/emotion-1.gif" src="http://community.pmail.com/emoticons/emotion-1.gif"></div><div> </div><div> </div>

[quote user="J_Aarni"] <DIV> </DIV> <DIV>It seems now, that this problem has something to do with NtWrapper. After Mercury was started directly from Loader.exe over a month ago, Mercury has been stable again. I don't know, is this coincidence or not, but problem is disappeared now. This was our only Mercury installation, where Mercury was startet using NtWrapper, and only installation, which has problems.</DIV> <DIV> </DIV> <DIV>I'm going to restore one by one settings, which I disabled to tracking this problem. Time will tell, if this good situation is permanent.</DIV> <DIV><SPAN style="FONT-SIZE: 10pt"> </SPAN><IMG style="FONT-SIZE: 10pt" border=0 src="http://community.pmail.com/emoticons/emotion-1.gif" width=19 height=19 mce_src="http://community.pmail.com/emoticons/emotion-1.gif"></DIV> <DIV> </DIV> <DIV> </DIV> <P>[/quote]</P> <P>You didn't mention that you were running as a service with NTwrapper in your initial post.  Were you running as Localservice or as an admin user?</P>

<p>Yeah, I didn't known that it matters. NtWrapper start account (General tab) was LocalSystem, and logon - account ("Applications to run As a Service" -> "Log On" - tab) was normal user account with ""Log on as a batch job" - privilege enabled.</p><p> </p><p> </p>

[quote user="J_Aarni"] <P>Yeah, I didn't known that it matters. NtWrapper start account (General tab) was LocalSystem, and logon - account ("Applications to run As a Service" -> "Log On" - tab) was normal user account with ""Log on as a batch job" - privilege enabled.[/quote]</P> <P>With "Run process as user" checked?  Is it the same user as you are now using with Loader or have the privileges changed?  (I don't fill in the logon tab for Mercury but run it all as Localsystem.)</P>

<p>"Run Process As User" was checked. Now Administrator is logged on console and Loader is started within that session.</p><p> </p><p> </p>

<p>FYI, Mercury crashes again week after Spamhalter "tokenize image attributes" was enabled and ClamAv settings "<span style="font-size:10.0pt;font-family:'Verdana','sans-serif'; mso-fareast-font-family:Calibri;mso-bidi-font-family:'Times New Roman'; mso-ansi-language:FI;mso-fareast-language:EN-US;mso-bidi-language:AR-SA">MaxFileSize" and  "</span><span style="font-size:10.0pt;font-family:'Verdana','sans-serif'; mso-fareast-font-family:Calibri;mso-bidi-font-family:'Times New Roman'; mso-ansi-language:FI;mso-fareast-language:EN-US;mso-bidi-language:AR-SA">StreamMaxLength" parameters was restored from 10MB to 30MB.</span></p><p>Now  "<span style="font-size: 10pt;">tokenize image attributes" is disabled to pinpoint cause of the crash.</span></p><p> <img width="19" height="19" border="0" style="font-size: 10pt;" src="http://community.pmail.com/emoticons/emotion-7.gif"></p><p> </p>