Hi Thomas, I thought that spam from the last 5 days was not deleted, so users could retrieve them them from the block report?
fixed in assp 2.6.2 *Fortress* build 18351: - If the daily amount of collected .eml files in one folder exceeded the value of 'MaxFiles', new files were removed by the daily file cleanup processing - which caused failing resend requests. New files are now kept for at least five days, even if the file count exceeds the value of 'MaxFiles'. Set 'MaxFiles' high enough, to keep files for a longer period. User clicked on this Resend button as was told (correctly) that the file could not be found because it wasn’t in the spam folder. Resend <mailto:asspbl...@bordo.com.au?subject=request%20ASSP%20to%20resend%20blocked%20mail%20from%20ASSP-host%20mail.bordo.com.au&body=%23%23%23spam%2FRe%5FNew%5Fcustomer%5Fmessage%5Fon%5FFebruary%5F6%5F2019%5Fat%5F06%5F5%2D%2D333141%2Eeml%23%23%23%5Bdo%20not%5D%20move%20file%20to%20errors/notspam%0D%0A> Feb-06-19 17:08:58 <http://mail.bordo.com.au:55555/edit?file=spam%2FRe%5FNew%5Fcustomer%5Fmessage%5Fon%5FFebruary%5F6%5F2019%5Fat%5F06%5F5%2D%2D333141%2Eeml¬e=m&showlogout=1> [TLS-out] [MessageLimit] 192.168.1.2 [OIP: 184.173.153.67] <http://mail.bordo.com.au:55555/ipaction?ip=184.173.153.67&showlogout=1> <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:assp-wh...@bordo.com.au?subject=add%20to%20whitelist&body=bounce+01af04.c0f-isbrown=bordo.com...@reamaze.com%0D%0A> @ <http://mail.bordo.com.au:55555/addraction?address=bounce+01af04.c0f-isbrown=bordo.com...@reamaze.com&showlogout=1>> spam reason: (MessageScore 74, limit 46) [Re New customer message on February 6 2019 at 06 56 PM] Sender support=switchkites....@reamaze.com <mailto:assp-wh...@bordo.com.au?subject=add%20to%20whitelist&body=support=switchkites....@reamaze.com%0D%0A> @ <http://mail.bordo.com.au:55555/addraction?address=support=switchkites....@reamaze.com&showlogout=1> From supp...@switchkites.com <mailto:assp-wh...@bordo.com.au?subject=add%20to%20whitelist&body=supp...@switchkites.com%0D%0A> @ <http://mail.bordo.com.au:55555/addraction?address=supp...@switchkites.com&showlogout=1> Resend <mailto:rsbm_spamx2fxrex5fxnewx5fxcustomerx5fxmessagex5fxonx5fxfebruaryx5fx6x5fx2019x5fxatx5fx06x5fx5x2dxx2dx333141....@bordo.com.au?&subject=request%20ASSP%20to%20resend%20blocked%20mail%20from%20ASSP-host%20mail.bordo.com.au>Resend But I went to a backup from yesterday before nightly rebuild, and found it in the spam folder. Log from when message was received: Feb-06-19 17:08:51 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> warning: unable to connect to MTA mail.bordo.com.au:10026 <http://mail.bordo.com.au:10026/> - Feb-06-19 17:08:51 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> error: VRFY / RCPT TO failed on host mail.bordo.com.au:10026 <http://mail.bordo.com.au:10026/> - address <br...@bordo.com.au <mailto:br...@bordo.com.au>> accepted - SMTP failed - last state was connect to mail.bordo.com.au:10026 <http://mail.bordo.com.au:10026/> Feb-06-19 17:08:52 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> redlisting Regex: redRe 'bounce' Feb-06-19 17:08:52 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> Originating IP/HELO: 184.173.153.67 / mail-p1.reamaze.com <http://mail-p1.reamaze.com/> Feb-06-19 17:08:52 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> DKIM-Signature found Feb-06-19 17:08:52 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> info: detected IP's on the mail routing way: 45.79.14.14 Feb-06-19 17:08:52 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> info: detected source IP: 45.79.14.14 Feb-06-19 17:08:53 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> [scoring] DKIM signature verified-OK - header-passed - identity is: @reamaze.com - sender policy is: neutral - author policy is: neutral Feb-06-19 17:08:53 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> Message-Score: added -15 (dkimOkValencePB) for DKIM pass, total score for this message is now -15 Feb-06-19 17:08:55 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> Message-Score: added -10 (spfpValencePB) for SPF pass, total score for this message is now -25 Feb-06-19 17:08:56 id-33331-08591 [Worker_1] [TLS-out] [FromMissing] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> [scoring] found (2) different sender domains in 'From:' and 'Sender:' header tags ( DoNoFrom ) Feb-06-19 17:08:56 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> Message-Score: added 50 (nofromValencePB) for found (2) different sender domains in 'From:' and 'Sender:' header tags ( DoNoFrom ), total score for this message is now 25 Feb-06-19 17:08:57 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> HMM Check [scoring] - Prob: 0.99548 => spam - answer/query relation: 8% of 368 Feb-06-19 17:08:57 id-33331-08591 [Worker_1] [TLS-out] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> Message-Score: added 49 for HMM Probability: 0.99548, total score for this message is now 74 Feb-06-19 17:08:58 id-33331-08591 [Worker_1] [TLS-out] [MessageLimit] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> [spam found] (MessageScore 74, limit 46) [Re New customer message on February 6 2019 at 06 56 PM] -> /Applications/assp/spam/Re_New_customer_message_on_February_6_2019_at_06_5--333141.eml; Feb-06-19 17:08:58 id-33331-08591 [Worker_1] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> finished message - received DATA size: 5.57 kByte - sent DATA size: 0 Byte Feb-06-19 17:08:58 id-33331-08591 [Worker_1] 192.168.1.2 [OIP: 184.173.153.67] <bounce+01af04.c0f-brown=bordo.com...@reamaze.com <mailto:bounce+01af04.c0f-brown=bordo.com...@reamaze.com>> to: br...@bordo.com.au <mailto:br...@bordo.com.au> disconnected: session:7FE951F9B130 192.168.1.2 - processing time 7 seconds RebuildSpamDB report: Feb-07-19 01:04:00 /Applications/assp/spam Feb-07-19 01:04:00 File Count: 20,464 Feb-07-19 01:04:00 Processing... spam with 20,309 files Feb-07-19 01:36:24 0 attachment/image entries processed Feb-07-19 01:36:24 Imported Files for HeloBlackList: 20,309 Feb-07-19 01:36:24 Imported Files for Bayes/HMM: 20,310 Feb-07-19 01:36:24 Folder contents exceeded 'MaxFiles'(20309). Feb-07-19 01:36:24 Finished in 1,944 seconds (10.45 files/s - 990.39 MByte) Feb-07-19 01:36:24 info: require approximately 20,028 files (9,873,808 words) from folder notspam to get the wanted corpusnorm (1.000) ASSP version 2.6.4 *SPAM-Evaporator* build 19019 Any idea why this happened? I have another example, same user. Thanks, James. _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test