Hi, The ASSP ASSP version 2.1.1 look all IP from the sender to the ISP in order to check DNSBL. nov-16-11 21:49:46 m1-76585-06880 [Worker_1] 188.165.197.85 <sender <mailto:[email protected]> > to: local <mailto:[email protected]> info: detected IP's on the mail routing way: 81.44.251.105 nov-16-11 21:49:46 m1-76585-06880 [Worker_1] 188.165.197.85 <sender <mailto:[email protected]> > to: local <mailto:[email protected]> info: detected source IP: 81.44.251.105 nov-16-11 21:49:48 m1-76585-06880 [Worker_1] 188.165.197.85 <sender <mailto:[email protected]> > to: local <mailto:[email protected]> Message-Score: added -10 for SPF pass, total score for this message is now -10 nov-16-11 21:49:58 m1-76585-06880 [Worker_1] 188.165.197.85 <sender <mailto:[email protected]> > to: local <mailto:[email protected]> Message-Score: added 50 for DNSBL: failed, 81.44.251.105 listed in bb.barracudacentral.org, total score for this message is now 40 nov-16-11 21:49:58 m1-76585-06880 [Worker_1] [DNSBL] 188.165.197.85 <sender <mailto:[email protected]> > to: local <mailto:[email protected]> [spam found] (DNSBL, 81.44.251.105 listed in bb.barracudacentral.org) [EnterBio] -> spam/EnterBio--109241.eml; nov-16-11 21:49:59 m1-76585-06880 [Worker_1] 188.165.197.85 <sender <mailto:[email protected]> > to: local <mailto:[email protected]> [SMTP Error] 554 5.7.1 DNS Blacklisted by bb.barracudacentral.org nov-16-11 21:49:59 m1-76585-06880 [Worker_1] 188.165.197.85 <sender <mailto:[email protected]> > to: local <mailto:[email protected]> finished message - received DATA size: 0 Byte - sent DATA size: 0 Byte I want to switch off to look all IP's, and I only need to check the last IP in the DNSBL How can I do it? Thanks
Fernando J. Vicioso ------------------------------------------------------------------------------ All the data continuously generated in your IT infrastructure contains a definitive record of customers, application performance, security threats, fraudulent activity, and more. Splunk takes this data and makes sense of it. IT sense. And common sense. http://p.sf.net/sfu/splunk-novd2d _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
