Re: [Declude.JunkMail] False positive -- Declude + Sniffer

2009-02-06 Thread Pete McNeil 


Katie LaSalle-Lowery wrote:


I have a situation I haven't seen before. 

Declude logs show that the message failed Sniffer, which caused the 
message to exceed our weight threshold and be deleted.


Sniffer logs show that the message did not fail Sniffer.

Actually that is not correct. The message did fail SNF with a Caution 
result.



s u='20090206143433' 
m='c:\IMAIL\spool\proc\work\D4a6d019b50e3.smd' s='40' r='0'/


p s='0' t='31' l='61394' d='37'/

g o='0' i='63.118.171.179' t='u' c='0.142858' p='0.5' 
r='Caution'/


/s

The caution result (symbol 40) will resolve itself almost immediately in 
most cases because the caution range in GBUdb is very thin. When a 
caution result is produced it indicates that there was no pattern match 
but the IP is suspicious. Since the message did not match a pattern 
result code the statistics for the IP are usually moved out of the 
caution range on the first event.


 


How do I prevent recurrence of this false positive deletion?

Note that the statistics show this IP has produced spam about 75% of the 
time (probability figure = 0.5). You may want to look into what other 
messages this IP has sent to you that were filtered out - and why.


If you would like to be more lenient on your system (especially during 
spam storms) then you could turn off the caution range or you could 
adjust it's envelope settings.


Hope this helps,

_M



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] mail server software

2009-02-06 Thread Marc Catuogno 
If you are looking at smartermail I would make sure you don't have too many
Blackberry users. I moved off of IMAIL for Smartermail and on the whole it
was an improvement BUT with IMAIL people got their BB email.  Smartermail
has an intermittent issue with BB; some messages just randomly don't appear
on the BB.  Never had an issue until I moved to SM.  I put in a ticket, they
suggested an upgrade, the upgrade made even more people miss messages.  They
did a packet capture that proved that SM sent data to the BB on ONE single
missed message, they felt that was enough proof. 

I am going to have to tell all my users to forward the email to their BB
email accounts because that is the only reliable way of getting messages to
the BB from Smartermail - unless maybe you disable IMAP.   I suspect that it
has something to do with IMAP IDLE so I just turned that off, but last time
I did there was a 30 minute delay of email delivery.  I'm waiting for user
complaints.  I'm probably going to tell my users to forward, tired of being
SM's guinea pig and getting an answer like, well our system sent the data.
I wish they had more of an interest in finding/fixing the issue instead of
just being right.

Their system has been pretty good but with the unreliability of delivery to
BB from their software  I am going to be looking at another solution in the
next few months...

 

Marc

 

From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Michael
Graveen
Sent: Tuesday, February 03, 2009 8:10 PM
To: declude.junkmail@declude.com
Subject: re: [Declude.JunkMail] mail server software

 

I use SmarterMail (www.smartertools.com) and like it a lot.  SmarterTools
has conversion tools to help you migrate your IMail domains to SmarterMail.

Hope this helps.

Mike

  _  


I am going to move from Imail soon.
Does any one have any recommendations on reasonable Mail Server software.
we need maybe 200 users, and we just pop our mail now.
I have been using Workgroup Share to add calendar sharing etc to our current
config.
Has any one used their Mail Server software and what do you think of it?
and will my junkmail still work with it?

Thanks for any help.

Bruce Loughlin



---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.