Increase in Spam the Past Month
Updated: 21 May 2010 | 11 comments
This issue has been solved. See solution.
My Symantec Mail Security is running with Exchange 2003 on server 2003.
Installed version = 6.09.286
Auto-Protect state = Started
Virus definitions = 2/5/2010, Rev 2
SPA license status = Valid
Without any system changes taking place on my side, the last 30 days or so, my previously spam-free mail system has been showing a disturbing increase in spam being delivered to the end users.
Has something changed in regard to the spammers vs. Symantec? Is the product being updated conscientiously by Symantec to reflect the latest spam techniques?
Discussion Filed Under:
Comments
You will want to check your
You will want to check your server status to see what date your spam definitions are at, this can be accessed under Monitors->Server Status.
If the date for Symantec Premium Antispam is behind more than 10 minutes, you need to follow this document:
Title: 'Premium AntiSpam for Symantec Mail Security for Microsoft Exchange fails to detect spam'
Document ID: 2007020615531854
> Web URL: http://service1.symantec.com/SUPPORT/ent-gate.nsf/...
Make sure to follow it step-bystep and don't skip any steps.
You say >>"If the date for
You say >>"If the date for Symantec Premium Antispam is behind more than 10 minutes"<<
HUH????????????????
The document you posted covers what to do if >>Question/Issue:
The Premium AntiSpam (PAS) component of Symantec Mail Security for Microsoft Exchange (SMSMSE) is not detecting spam emails.<<
THAT IS NOT MY ISSUE.
Really, did you read my inquiry?? Let's swap the sentences around, and you take another run at it:
Has something changed in regard to the spammers vs. Symantec? Is the product being updated conscientiously by Symantec to reflect the latest spam techniques?
Because
Without any system changes taking place on my side, the last 30 days or so, my previously spam-free mail system has been showing a disturbing increase in spam being delivered to the end users.
Hi fnbrowning, I'd definitely
Hi fnbrowning,
I'd definitely recommend following the document TSE-JDavis posted. The behavior you are expiriencing sounds very much like out of date antispam rulesets. Essentially, if the rulesets stop updating (for whatever reason) spam will increase over time as the rules in use are no longer addressing the current batch of spam.
To address this sentence:
"Has something changed in regard to the spammers vs. Symantec? "
There have not been any significant changes in the state of spam on the internet (outside of ordinary spammer adaptations to antispam technology, which are easily addressed by ruleset updates)
"Is the product being updated conscientiously by Symantec to reflect the latest spam techniques?"
Absolutely, this is the purpose behind our brightmail/premium antispam technology, it is constantly being updated (new rules are loaded every 5-10 minutes) to deal with new types of spam.
"Without any system changes taking place on my side, the last 30 days or so, my previously spam-free mail system has been showing a disturbing increase in spam being delivered to the end users."
Again, this behavior is typical of a ruleset downloading problem, which would be addressed by following the steps in the document TSE-JDavis provided.
Hello grobets Thank you for
Hello grobets
Thank you for the more targeted diagnostic. I'll buy the out of date antispam rulesets, and I've implemented the protocol as described in the document. It will take a little time to survey my users and document any changes.
I hope that other Symantec employees understand that the average Administrator is skeptical of a "shotgun" approach to problem resolution.
I take offense at you saying
I take offense at you saying I am taking a shotgun approach. The document I provided you was written by Gavin (groberts) for this exact situation.
The title of the document is 'Premium AntiSpam for Symantec Mail Security for Microsoft Exchange fails to detect spam', which is exactly what you described, we are failing to detect some spam messages.
The way our premium antispam works with the Exchange product it needs to have everything cleared out and started from scratch to reliably fix this issue. Just doing one of the items in the document leaves room for this to happen in a week or even a day later.
What was the date listed when you looked at the Premium Antispam status? I am just curious at this point.
Brightmail, what Premium Antispam uses, is an enterprise level product used by millions of servers around the world. We have a large team of engineers dedicated to keeping up with the latest spam trends by monitoring our probe network. There has not been any reduced level of detection on our end. We are working harder than ever.
TSE-JDavis you are
TSE-JDavis you are representing Symantec on a public forum, meaning your attitude reflects on the company. Wether you like it or not, I am a paying customer that is having problems with the product you represent.
Now to the issue at hand.
As of 20:30 CST, I have followed all the directions in the document written by Gavin (groberts). On a restart of the server, I tested the effectiveness of the Symantec Mail Security by emailing two messages from a test account. The test message with http://www.example.com/url-1.blocked/ made it through (which had never happened before) and a second spam message also.
I will wait 1/2 a day to test the results further, but from the test, I'd say the preliminary results look worse than when I started.
Hi fnbrowning, When you
Hi fnbrowning,
When you tested the http://www.example.com/url-1.blocked string, was this done from an outside account, or an account within the organization? I just wanted to verify that this message was coming via an SMTP connection, and not an internal (MAPI) connection, as MAPI connections are not scanned for spam.
If it comes through from an outside email address, and you have configured an action to take under Policies -> Premium Antispam actions which is not being taken, I'd recommend collecting the following debug log to help assess why these messages are not being scanned (we can safely say they are not being scanned if an email containing the test string comes through an SMTP session without your configured action being taken as expected, as all messages with that test string will be considered "spam" if they are seen by the scanner):
Title: 'How to obtain a DebugView log file from Symantec Mail Security for Microsoft Exchange 6.x for Microsoft Exchange 2007 transport agents'
Document ID: 2008020110381854
> Web URL: http://service1.symantec.com/SUPPORT/ent-gate.nsf/...
However, your problem seems different enough from our common cases of Premium Antispam not detecting spam that I would recommend opening a technical support case for more in depth troubleshooting. If you choose this path, please have patience with the agent that takes the case, as they are likely to want to verify the actions taken based on the documented TSE-JDavis linked earlier before continuing to more complicated troubleshooting. This is because roughly 97% of all of our spam cases are solved by following the steps in that document, and is not intended as a slight against you.
There is no reason to wait
There is no reason to wait any amount of time. It will work immediately or will not work at all for the spam test string.
You will need to check the status page I mentioned previously and make sure Symantec Premium Antispam says enabled and has a date and time within the last 10 minutes listed.
If there is a current time and date listed and Premium Antispam shows as enabled, but the spam string is not detected, then something is going on with our monitoring of port 25.
Is this the first server that mail for yoru domain hits? Does the MX record for your domain point at the Exchange server or are there any other devices in front of it?
A big, big thankyou!!!
Special thanks from me to:
I followed your instructions ... must confess that I never had looked in Monitors, System Status ... and I was shocked when I did. Although my licensing was apparently up-to-date, nevertheless SMSE was not updating and had not done so for 8 months (!!!).
I tried removing the definitions myself and was only partially successful, as I also uncovered a strange licensing issue by looking at the Logs directory. Even though the SMSE console said everything was licensed okay, the log files showed otherwise.
A quick call to Symantec Enterprise Support and I got my licensing problem fixed, and the re-starting of Premium AntiSpam and .. hey presto ... everything is now updating and working great.
I think my users are going to be a whole lot happier now, as we were starting to get hammered by spam and I just couldn't work out where in the process things were going wrong. Thanks for your advice and for making my life easier!
Great to hear Frosty! Believe
Great to hear Frosty! Believe it or not, I don't get paid to answer questions on this forum. I only get paid for taking phone calls. I do this in my spare time to help customers out. Its good to see some grattitude.
No, I did not send the spam
No, I did not send the spam from within the organization! <LOL>
As I said previously >>"Without any system changes taking place on my side"<< So that covers appliances, MX records, etc.
Thanks groberts for the help. I will pursue this through other avenues.
Would you like to reply?
Login or Register to post your comment.