[Declude.JunkMail] Logging change request

2004-05-16 Thread Darin Cox
I'd like to have the Last Action line in the log moved from LOGLEVEL HIGH to LOGLEVEL MID to reduce the size of logs but still have an easy indicator as to what was done with the message. Would help greatly with log parsing at MID level, I think. Anyone agree or disagree with this? Darin.

Re: [Declude.JunkMail] Logging change request

2004-05-16 Thread Matt
That was moved in a recent interim release. Matt Darin Cox wrote: I'd like to have the Last Action line in the log moved from LOGLEVEL HIGH to LOGLEVEL MID to reduce the size of logs but still have an easy indicator as to what was done with the message. Would help greatly with

Re: [Declude.JunkMail] Logging change request, possible new tests, and honeypot processing

2004-05-16 Thread Darin Cox
Gotcha. Thanks, Matt. I have another one: Adding a line to record sender IP/hostname to the log. Could be useful both for log reports andfor building our own sender lists. Also, I've been thinking of some additional tests and considering writing some external tests where needed. 1. If

RE: [Declude.JunkMail] ALLRECIPs filter trouble

2004-05-16 Thread Goran Jovanovic
Scott, I am interested in what you are doing with this filter? Obviously you are checking if an incoming e-mail is for someone and assigning 20 points to it, but why? Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-

Re: [Declude.JunkMail] DUL skipping was ISBLANK is blank

2004-05-16 Thread Don Brown
Saturday, May 15, 2004, 4:58:34 PM, Andy Schmidt [EMAIL PROTECTED] wrote: [SNIP] AS It should be an option. Those who need to bypass the DYNA tests on the AS first hop should be able to - those who don't need to should not lose those AS tests! But that was the point - You CAN do it NOW! No change

[Declude.JunkMail] Duplicate Logfile entries

2004-05-16 Thread Darin Cox
Anyone else seeing duplicate sets of logfile entries? The FROMline changes, but everything else is the same. Each subsequent FROM line has an additional TO address before the IP. Darin.

Re: [Declude.JunkMail] Duplicate Logfile entries

2004-05-16 Thread Darrell
This is normal when the message has multiple recipients. This is because Declude can in certain instances take different actions based on recipients. Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail

Re: [Declude.JunkMail] Duplicate Logfile entries

2004-05-16 Thread Darin Cox
Ok...hadn't ever noticed that behavior before in the logs. Guess I'd always been looking at single recipient emails. However, all recipients were in a single domain and we're using per-domain configuration...no per-user configs... so all actions would be the same. Darin. - Original

RE: [Declude.JunkMail] ALLRECIPs filter trouble

2004-05-16 Thread Scott Fisher
I'm currently using Imail/Declude as a gateway forwarding the e-mail onto my mail server. Out of my top 20 recipients, about 8 are employees that are long gone from my company or e-mail addresses that have never been. I assign these 20 points over my delete weight since I don't want the

Re: [Declude.JunkMail] f-prot

2004-05-16 Thread Scott Fisher
I find the Mcafee is the best at detecting viruses within encrupted zips. Otherwise they are pretty even. I'd recommend using F-Prot and Mcafee. Mcafee for the DOS command line scanner is dirt cheap. I'll see if I can find my price tomorrow. [EMAIL PROTECTED] 5/15 12:29p Can anyone tell me

Re: [Declude.JunkMail] Logging change request, possible new tests, and honeypot processing

2004-05-16 Thread Matt
Darin Cox wrote: Gotcha. Thanks, Matt. I have another one: Adding a line to record sender IP/hostname to the log. Could be useful both for log reports andfor building our own sender lists. The remote IP is already there, but the reverse DNS isn't. I would think that is more