Intermittent gfimesattendant Failures and Corresponding spam Leakage

Author Message
JSW2

  • Total Posts : 9
  • Joined: 6/22/2017
  • Status: offline
Intermittent gfimesattendant Failures and Corresponding spam Leakage Monday, July 10, 2017 12:20 AM (permalink)
Hi everyone
 
This has been an on again off again issue that I have tried raising with GFI repeatedly with no result, and it is causing significant pain so thought I'd throw it out to the community in case others have a workaround.
 
Every so often a spam email will come through that causes the gfimesattendant service to fail with the following:
 
Plugin MonitoringActivity reports exception.
 
ERROR.MonitoringActivity.PluginProcessingFailed.
 
Additional info: ERROR: ProcessItem: exception [System.ApplicationException: ERROR: failed to process item
at MEC.MonitoringActivityThread.ProcessMessage(Object objContext)]


 
When this happens the spam email flows through the system unfiltered - it isn't even recorded in GFIs log, the email never existed according to GFI but the Exchange server obviously records it.
 
This issue comes and goes - sometimes none at all, other times a few here and there, and other times again we get massive assaults.  This has happened again this weekend - a massive assault of spam that has flooded into our system, GFI has no record of any of it, Windows event log corroborates the above crashes, and the Exchange server obviously has full record of them all.  Last night GFI insists only 6 emails were processed - when in actual fact several hundred mailboxes each received around 15-16 spam emails.
 
My theory is these messages are being formatted in a way that is overwhelming GFI - perhaps a particular header that causes a buffer overrun of some sort with GFI.  Or perhaps it is entirely coincidental and GFI suddenly gets in a bad mood where it starts failing emails that were otherwise perfectly normal spam?
 
I'm at a loss, it's impacting our organisation, it's frustrating our staff, and after all the other GFI hassles it's rubbing even more salt into an existing wound... so hoping someone might have a shared experience dealing with this as I'm a little tired of providing logs and getting nowhere.  Will start that process all over again anyway but I know it won't go anywhere as I've tried raising this too many times.
 
#1
    ahurley@niftylift.com

    • Total Posts : 5
    • Joined: 2/16/2012
    • Status: offline
    Re:Intermittent gfimesattendant Failures and Corresponding spam Leakage Monday, August 21, 2017 4:00 PM (permalink)
    Hi,
     
    Did you get anywhere with this issue as I'm having the exact same just over a week ago?
     
    Thanks
    Anthony
     
     
    #2
      AllenD

      • Total Posts : 195
      • Joined: 7/17/2012
      • Status: offline
      Re:Intermittent gfimesattendant Failures and Corresponding spam Leakage Monday, August 21, 2017 9:28 PM (permalink)
      The plugin specified in the error (Plugin MonitoringActivity) is the one that writes to the Dashboard > Logs tab. The email may have been processed by MailEssentials in every way except write to the dashboard. Support would need to check the troubleshooter logs to determine what happened. If it's happening after a specific type of email a copy of that email would also be helpful. It should be the oldest message in the FailedMail directory from the time the error shows in the logs.
       
      You can open a cause using the automatic upload in the troubleshooter or by logging into accounts.gfi.com and creating a case there.
      https://www.gfi.com/suppo...for-GFI-MailEssentials
      Allen D.
      GFI Software
      Blog - Twitter - YouTube - Facebook

       
       
      #3
        JSW2

        • Total Posts : 9
        • Joined: 6/22/2017
        • Status: offline
        Re:Intermittent gfimesattendant Failures and Corresponding spam Leakage Monday, August 28, 2017 3:59 AM (permalink)
        Totally and utterly incorrect.
         
        The whole reason this problem was discovered was BECAUSE spam would flow through the system unfiltered.  You have contradicted the very problem being reported.
         
        It was the investigation of the tremendous volume of UNFILTERED spam that led to the discovery that there was ALSO no logging going on... that according to GFI the email never existed.  Further investigation into those TWO issues led to the discovery of the crashes.
         
        To ahurley - yes GFI eventually found the problem and provided me a patched version of a GFI DLL which finally fixed the issue.
         
        HOWEVER, after being a loyal GFI customer for around 15 years I'm sorry to say this was one of the final issues I could tolerate from GFI.  After an EXTENSIVE amount of disruption to our email, mass issues with the product, mass problems with its updates, denial from GFI of the problems existing, insistence from GFI they now believe and have fixed the issues, denial from GFI that the problems weren't actually fixed but remain ongoing, etc all over the past 9 months GFI I have had no choice but to dump GFI and move to an alternative product.
         
        To be honest I wish I had done it sooner.  Ignoring the extensive problems GFI had been causing, we had become "used" to the incredible volume of spam GFI couldn't properly detect.  During my research of alternate products I discovered independent testing that likewise confirms that GFI lets through THOUSANDS of spam while other competing products let through very little.
         
        I am pleased to say in the past month we have had a whole TWO false positives and absolutely ZERO false negatives - down from hundreds/thousands of spam coming through per day and endless complaints about the problems GFI caused.  I can't even begin to explain how peaceful it has been to not have a single issue or even spam lately, not a single thing.  I keep checking on the quarantines and logs thinking this cannot possible be right, but sure enough every legitimate message is coming through and every spam is being blocked.  Couldn't be happier.
         
        #4
          ahurley@niftylift.com

          • Total Posts : 5
          • Joined: 2/16/2012
          • Status: offline
          Re:Intermittent gfimesattendant Failures and Corresponding spam Leakage Friday, September 08, 2017 11:40 AM (permalink)
          Just an update to this thread. I was sent a patch from GFI support that updated the "auto reply" dll and this appears to have resolved the issue. 
           
          #5
            Online Bookmarks Sharing: Share/Bookmark

            Jump to:

            Current active users

            There are 0 members and 2 guests.

            Icon Legend and Permission

            • New Messages
            • No New Messages
            • Hot Topic w/ New Messages
            • Hot Topic w/o New Messages
            • Locked w/ New Messages
            • Locked w/o New Messages
            • Read Message
            • Post New Thread
            • Reply to message
            • Post New Poll
            • Submit Vote
            • Post reward post
            • Delete my own posts
            • Delete my own threads
            • Rate post

            2000-2018 ASPPlayground.NET Forum Version 3.9