Hi Scott - sorry - no-go. AS>> 12/07/2001 01:11:15 Q5d582f0 OSRELAY:6 SPAMCOP:7 SPAMROUTING:4 HEUR8:3 . AS>>Total weight = 20
S>I'm not a mathematician, but when I add 6+7+4+3, I get the same answer (20) S>as Declude. Okay, no you're playing smartyboy.<G> Of course it adds up - this line only appears since 1.29 (and THANK YOU for adding it). My complaint was about the fact that the LOG does not show the matching "Msg failed lines" - so when you add ONLY SPAMROUTING you don't get 20. AS>12/07/2001 01:11:15 Q5d582f0 Msg failed SPAMROUTING (This E-mail was routed AS>in a poor manner consistent with spam [20000103].). AS>12/07/2001 01:11:15 Q5d582f0 Subject: Prescriptions Without Doctors AS>Appointment..... AS>12/07/2001 01:11:15 Q5d582f0 From: [EMAIL PROTECTED] To: AS>[EMAIL PROTECTED] In fact, I have messages where all these tests ARE listed as one would expect. S>If you have the action for OSRELAY, SPAMCOP, and HEUR8 set to IGNORE, then S>you may not see a log file entry when E-mail fails those tests. However, S>they will still be used towards the weighting. Nope - that is NOT the case. Enclosed the the global junkmail file - I don't have a seperate directory for the gameware.com domain. As you can see - I NEVER use "IGNORE". # # Actions to take when E-mails fail the various tests # LOG will put an entry into the log file for failed message, # WARN will add a warning to the headers of the message, # FOOTER will add text to the end of the E-mail (IE: "ORBS FOOTER [This message may be spam]") # HEADER will add text to the beginning of the E-mail # SUBJECT will add text to the beginning of the subject # HOLD will hold the message in the spool\spam directory. # DELETE will delete the E-mail -- don't use unless necessary! # RBL BOUNCE DUL BOUNCE RSS BOUNCE OSDUL BOUNCE OSSOFT BOUNCE ORDB BOUNCE WEIGHT10 BOUNCE WEIGHT8 SUBJECT SPAM: [See Headers] REVDNS ALERT SPAMCOP ALERT OSRELAY WARN OSSRC WARN OSSMART WARN OSLIST WARN OSFORM WARN ORBZINPUTS WARN X-RBL-WARNING: Suspected SPAM. %REMOTEIP% found in %TESTDOMAIN%. %WARNING% ORBZOUTPUTS WARN X-RBL-WARNING: Suspected SPAM. %REMOTEIP% found in %TESTDOMAIN%. %WARNING% ORBZPOST WARN X-RBL-WARNING: Suspected SPAM. %REMOTEIP% found in %TESTDOMAIN%. %WARNING% SPAMCOPHDR WARN X-RBL-WARNING: Suspected SPAM. %WARNING% #DORKS WARN #V6NET WARN #DEVNULL WARN #FIVETENSRC WARN #FIVETENDUL WARN #FIVETENOPTIN WARN #FIVETENOTHER WARN #ZTA WARN #IGNORANT LOG #DSN WARN #NOPOSTMASTER WARN #NOABUSE WARN #BADWHOIS WARN #IPWHOIS WARN MAILFROM HOLD PERCENT HOLD BADHEADERS WARN X-Declude-Note: SMTP headers violate RFCs. %WARNING% SPAMHEADERS WARN X-RBL-WARNING: Suspected SPAM. %WARNING% SPAMROUTING WARN X-RBL-WARNING: Suspected SPAM. %WARNING% HEUR WARN X-RBL-WARNING: Suspected SPAM. %WARNING% Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 http://www.hm-software.com/ -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Friday, December 07, 2001 10:03 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude v1.29 beta - Errors >1. Many messages with WEIGHT=0 or other weights are logged with single line >entries!? No from/to/subject information > >12/07/2001 01:05:22 Q5bfc2fa . Total weight = 0 At LOGLEVEL MID or higher, Declude will log the total weight for every E-mail, spam or not. >12/07/2001 01:06:11 Q5c32194 HEUR10:4 . Total weight = 4 >12/07/2001 01:06:16 Q5c503aa HEUR9:4 . Total weight = 4 >12/07/2001 01:06:27 Q5c5b2fa HEUR8:3 . Total weight = 3 >12/07/2001 01:06:29 Q5c603aa HEUR8:3 . Total weight = 3 These failed the HEUR10/HEUR9/HEUR8 tests, with the appropriate weight. >2. Declude Crashed (DECLUDE.GP* file are attached) Thank you for pointing that out. We're investigating this. >3. Here is the problem with invalid arithmetic that carried over from 1.28. >Notice how it lists all kind of failed tests in the first log entry - but >then does NOT list any of these tests (other than SPAMROUTING) in the >subsequent lines. > >12/07/2001 01:11:15 Q5d582f0 OSRELAY:6 SPAMCOP:7 SPAMROUTING:4 HEUR8:3 . >Total weight = 20 I'm not a mathematician, but when I add 6+7+4+3, I get the same answer (20) as Declude. >12/07/2001 01:11:15 Q5d582f0 Msg failed SPAMROUTING (This E-mail was routed >in a poor manner consistent with spam [20000103].). >12/07/2001 01:11:15 Q5d582f0 Subject: Prescriptions Without Doctors >Appointment..... >12/07/2001 01:11:15 Q5d582f0 From: [EMAIL PROTECTED] To: >[EMAIL PROTECTED] If you have the action for OSRELAY, SPAMCOP, and HEUR8 set to IGNORE, then you may not see a log file entry when E-mail fails those tests. However, they will still be used towards the weighting. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
