> The standard changed now with the 1.3.2 last built (29). > > The standard log header gets an additional field : tag > > In case of notspam the tag is: > > [White] > [Local] > [NoProcessing] > > In case of spam the tag is the same as the tag for ccmail: > > [BombHeader] > [URIBL] > > This tag is only once per every message processed, even if several log > records are produced. > > There is also an additional tag for showing that the message is not > blocked like > > [URIBL][scoring] in case of scoring mode > [URIBL][pass] in case of testmode,spamlover, neutral results. > > It should be possible now to work on a rather fixed layout for further > loganalysis: > > The layout now for RESULT records is: > > Date Time [Result] <[scoring/pass]> <Message-ID> Sender IP From > <To> Comment > > Records without a tag are INFO records. >
Very useful !! With DoReversed=3 DoInvalidPTR=3 DoDomainCheck=3 In my logs I see that : [MissingMXA][pass] id IP ... scoring missing MX/A record Message-Score: 0+10 (MissingMXA) [MissingMXA][pass] id IP ... scoring PTR missing Message-Score: 10+10 (PTRmissing) I think there are "tag errors"[scoring ] instead of [pass] because I'm not in case of testmode,spamlover, neutral results. and [MissingPTR] : like these lines : [MissingMXA][scoring] id IP ... scoring missing MX/A record Message-Score: 0+10 (MissingMXA) [MissingPTR][scoring] id IP ... scoring PTR missing Message-Score: 10+10 (PTRmissing) No ? Jérôme ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
