Re: [Declude.JunkMail] Version 2.x, High-Weight Junkmail Not Deleted

[Matt]

Title: Message

Andy, Just curious for the sake of Declude and finding the problem for us so that I can migrate comfortably as well... It appears that whatever "content" filter and your DUL combo filter your system is using wasn't tagged or weighted in your message headers.  I assume then that you are using SKIPIFWEIGHT to end the processing on your custom filters and this is why the weight didn't change from 21. Assuming the above, I would then agree that it is probably related to the POSTMASTER filter action of ROUTETO outweighing the DELETE action based on weight.  Maybe the change in DELETE not deleting for all recipients on any hit uncovered this bug where dissimilar actions between recipients are causing ROUTETO to override DELETE...but then again who knows without seeing the actual code.  I also noted that one of the 6 sets of filter actions was marked POSTMASTER=IGNORE unlike the others which were all POSTMASTER=ROUTETO.  Since you are not using per-user configs, this could have only occurred due to per-domain configs and the address in question being an alias for an address on a different domain with a different config, or rather a bug possibly.  This did also happen when the same recipient was repeated twice, and only happened on the second occurrence of that address. I would be concerned about the bypass whitelisting issue as a separate item though also possibly related.  The logs say it is a >= scenario and there were definitely 6 recipients in the message so that should have triggered like the rest.  It could be that they are using different variables to count the number of recipients in the Q file, but doing the math only after removing duplicates of recipients as was the case here.  There were only 5 unique recipients, but there were 6 listed.   Although there is a chance that it could be cosmetic (log-only error), I think there is a chance that this is also a bug, though probably not one associated directly with the problems that you are seeing.  One way or another, that should be fixed as well.  (Declude, did you catch that?) Matt Andy Schmidt wrote: Hi Matt:   >> I would also assume that you are scoring tests such as SNIFFER, INV-URIBL and NJABLDYNA, but it doesn't appear that these scores were added according to your headers <<   I think I can explain most of that.   a) I have several "combo" tests that do the actual assigning of weights.  Sniffer and INV-URIBL both are part of the "Content" filter.  This avoids that the same spammy "URL" found by both tests will add double weight.   I think the explanation is, that the HEADER only reports "non-zero" weights.   b) The same is true for NJABLDYNA. I have a filter for Dynamic/Dialup blacklists.  Again, the idea is to find "dynamic" IP addresses in multiple lists - but if found (in one or more) to only assign ONE weight.   So, I wouldn't get hung up too much on the fact that the HEADER and the LOG list of failed tests doesn't line up.  It's just that some zero-weight tests are not reported.   c) The underlying problem appears to simply be the ROUTETO outweighing the DELETE action.  In every case that I've seen so far it was an email that included [EMAIL PROTECTED] as one of the recipients (which triggers the ROUTETO Postmaster... action).    Since there WAS a change in the logic in 2.0 regarding the handling of recipients, it's very feasibly the problem.   d) I have seen no indication whatsoever, that the bypass whitelisting is not working. In all cases where the POSTMASTER filter with ROUTETO is NOT included, the whitelisting (or rather, the bypass of it) works as intended.   In every case I have looked at where Whitelisting IS active, it was reported correctly in the log and the headers.    e) Finally, I treat the misreporting of the BYPASS WHITELIST  >= 6 Recipients as a "cosmetic" error.  Apparently, that line should read "> 6 Recipients".  (I was going to see how it is documented - if at all - but the Declude web site is down). Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone:  +1 201 934-3414 x20 (Business) Fax:    +1 201 934-9206 http://www.HM-Software.com/ -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Thursday, March 03, 2005 10:32 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Version 2.x, High-Weight Junkmail Not Deleted Andy Schmidt wrote: The message is NOT whitelisted (see log and header), so the bypass whitelisting WORKED.  The log and headers look differently, if whilelisting is effective. ...assuming that there isn't a bug.  There is definitely something strange here and several clear inconsistencies between the log, the headers and your inbox.  There's that one bypass whitelisting line that is wrong, and then I would also assume that you are scoring tests such as SNIFFER, INV-URIBL and NJABLDYNA, but it doesn't appear that these scores were added according to your headers, and of course all entries say DELETE but you still got a copy of the message.  It appears as if it was being whitelisted in spite of the logs and the headers, either that or the DELETE action was just simply being ignored.  I thought it might help to point out what I though was suggestive of the underlying problem.  Kevin's post hints at what might be similar or even related incorrect behavior. Once again, I have NO per-user configuration! I fully understood that after you stated it the first time.  I think you misread what I wrote.  There's no reason to rehash that however. Matt -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ ===================================================== -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================