Hi Thomas, I thought that spam from the last 5 days was not deleted, so users 
could retrieve them them from the block report?

fixed in assp 2.6.2 *Fortress* build 18351: 

- If the daily amount of collected .eml files in one folder exceeded the value 
of 'MaxFiles', new files were removed by the daily 
  file cleanup processing - which caused failing resend requests. New files are 
now kept for at least five days, even if the file count 
  exceeds the value of 'MaxFiles'. Set 'MaxFiles' high enough, to keep files 
for a longer period. 

User clicked on this Resend button as was told (correctly) that the file could 
not be found because it wasn’t in the spam folder.

Resend 
<mailto:asspbl...@bordo.com.au?subject=request%20ASSP%20to%20resend%20blocked%20mail%20from%20ASSP-host%20mail.bordo.com.au&body=%23%23%23spam%2FRe%5FNew%5Fcustomer%5Fmessage%5Fon%5FFebruary%5F6%5F2019%5Fat%5F06%5F5%2D%2D333141%2Eeml%23%23%23%5Bdo%20not%5D%20move%20file%20to%20errors/notspam%0D%0A>
      Feb-06-19 17:08:58 
<http://mail.bordo.com.au:55555/edit?file=spam%2FRe%5FNew%5Fcustomer%5Fmessage%5Fon%5FFebruary%5F6%5F2019%5Fat%5F06%5F5%2D%2D333141%2Eeml&note=m&showlogout=1>
 [TLS-out] [MessageLimit] 192.168.1.2 [OIP: 184.173.153.67] 
<http://mail.bordo.com.au:55555/ipaction?ip=184.173.153.67&showlogout=1> 
<bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:assp-wh...@bordo.com.au?subject=add%20to%20whitelist&body=bounce+01af04.c0f-isbrown=bordo.com...@reamaze.com%0D%0A>
 @ 
<http://mail.bordo.com.au:55555/addraction?address=bounce+01af04.c0f-isbrown=bordo.com...@reamaze.com&showlogout=1>>
 
spam reason:  (MessageScore 74, limit 46) [Re New customer message on February 
6 2019 at 06 56 PM] 

Sender  support=switchkites....@reamaze.com 
<mailto:assp-wh...@bordo.com.au?subject=add%20to%20whitelist&body=support=switchkites....@reamaze.com%0D%0A>
 @ 
<http://mail.bordo.com.au:55555/addraction?address=support=switchkites....@reamaze.com&showlogout=1>
From  supp...@switchkites.com 
<mailto:assp-wh...@bordo.com.au?subject=add%20to%20whitelist&body=supp...@switchkites.com%0D%0A>
 @ 
<http://mail.bordo.com.au:55555/addraction?address=supp...@switchkites.com&showlogout=1>
Resend 
<mailto:rsbm_spamx2fxrex5fxnewx5fxcustomerx5fxmessagex5fxonx5fxfebruaryx5fx6x5fx2019x5fxatx5fx06x5fx5x2dxx2dx333141....@bordo.com.au?&subject=request%20ASSP%20to%20resend%20blocked%20mail%20from%20ASSP-host%20mail.bordo.com.au>Resend

But I went to a backup from yesterday before nightly rebuild, and found it in 
the spam folder.

Log from when message was received:

Feb-06-19 17:08:51 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 
<bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> warning: unable to 
connect to MTA mail.bordo.com.au:10026 <http://mail.bordo.com.au:10026/> - 
Feb-06-19 17:08:51 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 
<bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> error: VRFY / RCPT 
TO failed on host mail.bordo.com.au:10026 <http://mail.bordo.com.au:10026/> - 
address <br...@bordo.com.au <mailto:br...@bordo.com.au>> accepted - SMTP failed 
- last state was connect to mail.bordo.com.au:10026 
<http://mail.bordo.com.au:10026/>
Feb-06-19 17:08:52 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 
<bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> redlisting Regex: redRe 'bounce'
Feb-06-19 17:08:52 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 
184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> Originating IP/HELO:  
184.173.153.67 / mail-p1.reamaze.com <http://mail-p1.reamaze.com/>
Feb-06-19 17:08:52 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 
184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> DKIM-Signature found
Feb-06-19 17:08:52 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 
184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> info: detected IP's on the mail 
routing way: 45.79.14.14
Feb-06-19 17:08:52 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 
184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> info: detected source IP: 
45.79.14.14
Feb-06-19 17:08:53 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 
184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> [scoring] DKIM signature 
verified-OK - header-passed - identity is: @reamaze.com - sender policy is: 
neutral - author policy is: neutral
Feb-06-19 17:08:53 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 
184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> Message-Score: added -15 
(dkimOkValencePB) for DKIM pass, total score for this message is now -15
Feb-06-19 17:08:55 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 
184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> Message-Score: added -10 
(spfpValencePB) for SPF pass, total score for this message is now -25
Feb-06-19 17:08:56 id-33331-08591 [Worker_1] [TLS-out] [FromMissing] 
192.168.1.2 [OIP: 184.173.153.67] 
<bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> [scoring] found (2) different 
sender domains in 'From:' and 'Sender:' header tags ( DoNoFrom )
Feb-06-19 17:08:56 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 
184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> Message-Score: added 50 
(nofromValencePB) for found (2) different sender domains in 'From:' and 
'Sender:' header tags ( DoNoFrom ), total score for this message is now 25
Feb-06-19 17:08:57 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 
184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> HMM Check [scoring] - Prob: 
0.99548 => spam - answer/query relation: 8% of 368
Feb-06-19 17:08:57 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 
184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> Message-Score: added 49 for HMM 
Probability: 0.99548, total score for this message is now 74
Feb-06-19 17:08:58 id-33331-08591 [Worker_1] [TLS-out] [MessageLimit] 
192.168.1.2 [OIP: 184.173.153.67] 
<bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> [spam found] (MessageScore 74, 
limit 46) [Re New customer message on February 6 2019 at 06 56 PM] -> 
/Applications/assp/spam/Re_New_customer_message_on_February_6_2019_at_06_5--333141.eml;
Feb-06-19 17:08:58 id-33331-08591 [Worker_1] 192.168.1.2 [OIP: 184.173.153.67] 
<bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> finished message - received DATA 
size: 5.57 kByte - sent DATA size: 0 Byte
Feb-06-19 17:08:58 id-33331-08591 [Worker_1] 192.168.1.2 [OIP: 184.173.153.67] 
<bounce+01af04.c0f-brown=bordo.com...@reamaze.com 
<mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: 
br...@bordo.com.au <mailto:br...@bordo.com.au> disconnected: 
session:7FE951F9B130 192.168.1.2 - processing time 7 seconds

RebuildSpamDB report:

Feb-07-19 01:04:00 /Applications/assp/spam
Feb-07-19 01:04:00 File Count:  20,464
Feb-07-19 01:04:00 Processing... spam with 20,309 files
Feb-07-19 01:36:24 0 attachment/image entries processed
Feb-07-19 01:36:24 Imported Files for HeloBlackList:    20,309
Feb-07-19 01:36:24 Imported Files for Bayes/HMM:        20,310
Feb-07-19 01:36:24 Folder contents exceeded 'MaxFiles'(20309). 
Feb-07-19 01:36:24 Finished in 1,944 seconds (10.45 files/s - 990.39 MByte)
Feb-07-19 01:36:24 info: require approximately 20,028 files (9,873,808 words) 
from folder notspam to get the wanted corpusnorm (1.000)

ASSP version 2.6.4  *SPAM-Evaporator*  build 19019

Any idea why this happened? I have another example, same user.

Thanks,

James.


_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test

Reply via email to