SpamSentinel for Domino Product Components

Created by Daniel Calkin, Modified on Mon, 3 Feb at 3:38 PM by Daniel Calkin

Overview

SpamSentinel for Domino's main components can be categorized into the following types:

Domino Databases
Domino Database Templates
Domino Extension .dll or Domino Mail Rule
Domino Server Tasks
Windows Services

Installing SpamSentinel for Domino also deploys two accessory products for use which are included in the SpamSentinel license purchase price.

Inbox Genius is a widely-used product which is installed to the Domino server at the same time as SpamSentinel.
Verisend for Domino is included in the form of an installer but must be installed separately for use within mail files.

Installation Type Differences

Checking Machine installations of SpamSentinel for Domino have a few differences in the components deployed than a Standard installation

Domino Databases

Several .nsf databases are deployed by default to the data directory of the Domino server where inbound SMTP mail will be scanned.

	SpamSentinel Admin The majority of the product configuration is contained in this database. Major Contents: License Codes Mail Scanning Configuration Settings Allow Lists / Block Lists ( White Lists / Black Lists ) Mail Disposition Settings Scanning Statistics Logs Location: SpamSentinel\SpamSentinelAdmin.nsf
	Scan Box Databases ( used when Domino is running on Windows ) Mail waiting to be scanned is stored in these databases. Several exist at the same time and are used in a daily rotation. Contents: Mail waiting to be scanned Scanned mail waiting to be delivered to Quarantine or user mail files. Location: SpamSentinel\Scan1.box (Scan2.box, etc...)
	Quarantine This is the primary Quarantine used by default for storing suspected spam. There are a number of other Quarantine databases which SpamSentinel creates that can be used depending on configuration options. Contents: Spam awaiting further review Quarantined Mail security and retention configuration options Location: SpamSentinel\SpamSentinelAdmin.nsf
	Perimeter Quarantine This Quarantine is the default location for storing confirmed spam (Spam Category D). Typically, only administrators will ever access this database. Contents: Spam awaiting deletion. Quarantined Mail security and retention configuration options Location: SpamSentinel\QuarantineAdmin.nsf
	Reporting Push-style reports generated by SpamSentinel for both Administrators and End Users are controlled by settings in the database. Major Contents: Administrator Report configurations End user Spam Report configurations Report run logs Retention options for Report Contents and Run Logs. Location: SpamSentinel\Reporting.nsf
	Logging If optional Logging features are enabled, this database will contain documents with summary information about messages scanned by SpamSentinel. Contents: Log documents Retention options for Log documents Location: SpamSentinel\MsgLog.nsf
	Policies Email policies regarding prohibited or monitored contents can be configured in this database. Contents: Lists of prohibited content. Monitoring and enforcement options Contents of non-conforming messages. Policy enforcement logs. Retention options Policy Management data. Location: SpamSentinel\policymanagement.nsf
	Perimeter 'B' #1 (also 'C' #1, 'D' #1) Numbered Quarantine databases are used only if alternate spam retention options are configured. Contents: Spam awaiting deletion. Quarantined Mail security and retention configuration options Locations: SpamSentinel\Quarantine_B1.nsf SpamSentinel\Quarantine_C1.nsf SpamSentinel\Quarantine_D1.nsf
	Inbox Genius Installer This is an installer for the Inbox Genius product. In order to be enabled and used effectively, Inbox Genius needs to be installed on every server which hosts user mail files. This installer allows administrators to further deploy the product to other servers if desired. Location: SpamSentinel\inboxgenius.nsf
	Verisend Installer This is an installer for the Verisend product. Verisend is not installed by default. To use Verisend in user mail files, it must be installed on every server which hosts those user mail files. This installer allows administrators to deploy the product where needed. Location: SpamSentinel\verisendinstall.nsf
	Manage By Example This is an installer for the legacy product Manage by Example. MBE is the fore-runner of the Inbox Genius product. It is included as an option for customers who run Domino on platforms other than Windows or Linux such as IBM i, IBM AS/400, HP-UX, etc... Location: SpamSentinel\mbe.nsf
	SS Setup This is part of the SpamSentinel downloadable Installer which is deployed to the Domino server for the purpose of distributing SpamSentinel components to the server itself. After the installation is completed, this database should not be used because automatic product updates could render it obsolete over time. If possible, do not delete this because it contains information which could be valuable to a Technical Support specialist for future troubleshooting. Location: SpamSentinel\SS Setup 12000.nsf Note: future versions will have different numbers in the filename

Database Templates

A Domino design template file ( .ntf ) for each of these databases is deployed to the folder SpamSentinel\Templates

SpamSentinel Admin
Scan Box Databases
Quarantine
Perimeter Quarantine
Reporting
Logging
Policies

Domino Extension Dll or Domino Mail Rule

Based on the operating system running Domino, SpamSentinel uses one of two methods to allow it time to scan a message before Domino continues routing it

Windows
(Standard Installation)

Domino Extension DLL: SpamSentinel Interceptor

Mail is diverted into the SpamSentinel Scan.box files by the SpamSentinel Interceptor. Its configuration is controlled by the SpamSentinel Administration database.

Major Function:

Ensure mail needing to be scanned is collected in the Scan.box databases instead of mail.box databases

Filename: SSIntercept_x64_3004.dll
NOTE: future versions will have different numbers in the filename

Non-WIndows
(Checking Machine)

Domino Mail Rule: Hold Mail

Mail is forced into a Hold status by this rule so that SpamSentinel has a chance to read the messages while they are still in mail.box

Location: Domino Directory (names.nsf)

Domino Server Tasks

Domino Server Tasks are only used when SpamSentinel is running as a Standard installation where Domino is running in a under Windows.

Although SpamSentinel includes several Domino Server tasks, only the SpamSentinel Monitor is invoked using an entry in the ServerTasks= line of the notes.ini file. The rest are started by the SpamSentinel monitor in order as required.

Domino server tasks read configuration information from the Server Configuration document in the SpamSentinel Administration database.

SpamSentinel Monitor

The SpamSentinel Monitor performs housekeeping tasks for the SpamSentinel product. Most of its configuration is controlled by the SpamSentinel Administration database.

Major Functions:

Start and stop SpamSentinel components when needed
Update component configuration files

Filename: SSMon.exe

SpamSentinel Router

The SpamSentinel Router primarily moves mail back and forth between different locations.

Major Functions:

Move mail between the scan.box databases and the native domino mail.box databases.
Rotate usage of scan.box databases on a daily basis.
In some configurations moves mail from the scan.box databases directly to Perimeter Quarantine databases.

Filename: SSRouter.exe

SpamSentinel Manager

The SpamSentinel Manager communicates with cloud servers to pull down and deploy updates to the product when they are made available for each particular server.

Major Functions:

Keep SpamSentinel updated to the latest version.
Keep cloud servers updated with critical information about the SpamSentinel installation.

Filename: SSMgr.exe

Windows Services

Standard installations of SpamSentinel will typically have five Windows Services running as part of its component set.

Checking Machine installations will have up to seven Windows Services installed.

SpamSentinel Scanner

The SpamSentinel Scanner is the primary mechanism for reading, scanning, and updating mail messages. It communicates with the SpamSentinel Duo 1 and SpamSentinel Duo 2 services to evaluate whether a message is Spam. Configuration Information is read from the SpamSentinel Server Configuration Document.

Major Functions:

Check Messages for Prohibited Files, Office file Macro content, etc...
Communicate message to the SpamSentinel Duo 1 / SpamSentinel Duo 2 Windows Services for further evaluation.
Check Messages for Email Policy violations
Decide disposition of messages based on evaluation results and other configuration options.
Maintain Statistics counts in the SpamSentinel Admin Database
Write Log documents into the Logging Database (optional)

Filename: SScanner.1.exe
Used by: All Installation Types

SpamSentinel Duo 1 / SpamSentinel Duo 2

These identical Windows Services compare message content against globally-collected anti-spam data from multiple vendors and scan messages for malware content. Two separate servcies are used for redundancy and to eliminate down-time during incremental updates. Configuration information is read from an .xml file in the same directory which mirrors information from the Spamsentinel Server Configuration document.

Major Functions:

Receive message contents from the SpamSentinel Scanner Windows Service
Evaluate Messages for Spam and Malware contents
Communicate with Cloud-based services to get anti-spam data updates in real time
Send evaluation results back to the SpamSentinel Scanner Windows Service

Filenames: SSDuoE1.exe, SSDuoE2.exe
Used by: All Installation Types
NOTE: some Domino servers or Windows Checking Machines which cannot run these two services due to older operating systems or other factors may instead use Cloud-based versions of these services.

SpamSentinel Anti-Virus Updater

Local virus definitions data is kept up-to-date by this Windows service which synchronizes local file sets with data from cloud-based servers. Configuration information is read from an .xml file in the same directory which mirrors information from the Spamsentinel Server Configuration document.

Major Functions:

Download virus definition files
Shut down then re-start SpamSentinel Duo 1 or SpamSentinel Duo 2 as needed for definition file maintenance

Filename: SSAvUpdate.1.exe
Used by: All Installation Types
NOTE: The SpamSentinel Anti-Virus Updater service will not be used on Domino servers or Windows Checking Machines where cloud-based versions of the SpamSentinel Duo services are used.

SpamSentinel Reporter

Push-style reports sent via email to both Administrators and End Users are generated by this Service. Configuration information is read from the Reporting database.

Major Functions:

Send Administrators reports of information from the SpamSentinel Admin and Quarantine databases.
Send End Users reports of Spam held for review in the Quarantine database.

Filename: SSReporter.1.exe
Used by: All Installation Types

SpamSentinel Monitor

The SpamSentinel Monitor performs housekeeping tasks for the SpamSentinel product. This mirrors the functionality of the Domino server Task with the same name

Major Functions:

Start and stop SpamSentinel components when needed
Update component configuration files

Filename: SSMonitor.1.exe
Used by: Checking Machine Installations

SpamSentinel Manager

The SpamSentinel Manager communicates with cloud servers to pull down and deploy updates to the product when they are made available for each particular server. This mirrors the functionality of the Domino server Task with the same name.

Major Functions:

Keep SpamSentinel updated to the latest version.
Keep cloud servers updated with critical information about the SpamSentinel installation.

Filename: SSManager.exe
Used by: Checking Machine Installations