>> would it be possible to turn on the debugging in Declude JunkMail
(LOGLEVEL DEBUG) long enough to let one of these issues reproduce itself? I
think that would be the optimal way to continue <<
Your wish my command. Look at the enclosed DEBUG LOG.
This mail should have BOUNCED because 12 exceeded WEIGHT10. Instead, it was
delivered.
Received: from deneb.589711.com [65.171.144.5] by hm-software.com with ESMTP
(SMTPD32-7.04) id ABE5A2E0172; Sun, 09 Dec 2001 15:39:01 -0500
Received: from localhost (root@localhost)
by deneb.589711.com (8.9.3/8.9.3) with SMTP id MAA04743;
Sun, 9 Dec 2001 12:37:08 -0800
Date: Sun, 9 Dec 2001 12:37:08 -0800
From: "Janey" <[EMAIL PROTECTED]>
Subject: Re: Your account
Comment: ksp-zbdc
To: undisclosed-recipients:;
Message-ID: <[EMAIL PROTECTED]>
X-RBL-Warning: This E-mail was sent from a mail server [No Reverse DNS] with
no reverse DNS entry.
X-Declude-Sender: [EMAIL PROTECTED] [65.171.144.5]
X-Declude-Spoolname: Dcbe5172.SMD
X-Declude-Note: Processed by Declude 1.29a; remote host [No Reverse DNS]
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 301719604
In the Debug Log - notice the following:
a) The weight summary says "SPAMCOP:7 REVDNS:5 . Total weight = 12".
But there is only ONE "Msg Failed" log entry: "Msg failed REVDNS (This
E-mail was sent from a mail server [No Reverse DNS] with no reverse DNS
entry.)."
There is NO "Msg Failed" log entry for SPAMCOP - nor is there one for
WEIGHT10!
b) The registry check returns an invalid UserID "Domain name = schmidt.as,
User name = ndy."
The recipient is an ALIAS ([EMAIL PROTECTED]), the final recipient is
"[EMAIL PROTECTED]".
12/09/2001 15:39:01 CFG: Setting LOG_OK level to NONE
12/09/2001 15:39:01 CFG: Set hop to 0 and hophigh to 0.
12/09/2001 15:39:01 Console turned OFF
12/09/2001 15:39:01 CFG: Setting XINHEADER to X-Declude-Note: Processed by
Declude %VERSION%; remote host %REVDNS%.
12/09/2001 15:39:01 CFG: Setting XOUTHEADER to X-Note: Report any abuse to
[EMAIL PROTECTED]
12/09/2001 15:39:01 CFG: Bypassing IP 63.107.174.32.
12/09/2001 15:39:01 CFG: Setting XSENDER to ON
12/09/2001 15:39:01 CFG: Setting XSPOOLNAME to ON
12/09/2001 15:39:01 CFG: Whitelisting ANYWHERE [EMAIL PROTECTED]
12/09/2001 15:39:01 CFG: Whitelisting IP 63.107.174..
12/09/2001 15:39:01 CFG: Whitelisting FROM hm-software.com.
12/09/2001 15:39:01 CFG: Whitelisting IP 128.192.1.101.
12/09/2001 15:39:01 CFG: Whitelisting IP 130.160.4.249.
12/09/2001 15:39:01 CFG: Whitelisting IP 199.232.158.102.
12/09/2001 15:39:01 CFG: Whitelisting FROM nytimes.com.
12/09/2001 15:39:01 CFG: Whitelisting IP 148.100.1.2.
12/09/2001 15:39:01 CFG: Whitelisting IP 64.65.65.2.
12/09/2001 15:39:01 CFG: Whitelisting FROM lists.cnn.com.
12/09/2001 15:39:01 CFG: Whitelisting FROM timeinc.com.
12/09/2001 15:39:01 CFG: Whitelisting FROM uni.de.
12/09/2001 15:39:01 CFG: Whitelisting IP 206.242.213.5.
12/09/2001 15:39:01 CFG: Whitelisting FROM stellenmarkt.de.
12/09/2001 15:39:01 Declude v1.29a
12/09/2001 15:39:01 Setting HOLD directory to: D:\IMAIL\spool\spam.
12/09/2001 15:39:01 Qcbe5172 Setting DNS server to IMail's 63.107.174.65.
12/09/2001 15:39:01 Qcbe5172 Declude JunkMail Standard Version Registered
12/09/2001 15:39:01 Qcbe5172 Start
12/09/2001 15:39:01 Qcbe5172 Locking D:\IMAIL\spool\Qcbe5172.SMD.
12/09/2001 15:39:02 Qcbe5172 D:\IMAIL\spool\Qcbe5172.SMD locked.
12/09/2001 15:39:02 Qcbe5172 Getting message envelope
12/09/2001 15:39:02 Qcbe5172 Starting locality check
12/09/2001 15:39:02 Qcbe5172 CL Opening
HKEY_LOCAL_MACHINE\software\Ipswitch\IMail\Domains
12/09/2001 15:39:02 Qcbe5172 [EMAIL PROTECTED] [0] is local domain2
12/09/2001 15:39:02 Qcbe5172 Done getting message envelope
12/09/2001 15:39:02 Qcbe5172 Getting headers
12/09/2001 15:39:02 Qcbe5172 Mid-headers
12/09/2001 15:39:02 Qcbe5172 Done getting headers
12/09/2001 15:39:02 Qcbe5172 Done getting envelope and headers
12/09/2001 15:39:03 Qcbe5172 Ver=20 verflag=0
12/09/2001 15:39:03 Qcbe5172 About to run spam tests
12/09/2001 15:39:03 Qcbe5172 Going through datafile
12/09/2001 15:39:03 Qcbe5172 65.171.144.5] by hm-software.com with ESMTP
(SMTPD32-7.04) id ABE5A2E0172; Sun, 09 Dec 2001 15:39:01 -0500
12/09/2001 15:39:03 Qcbe5172 Handling Received: header
12/09/2001 15:39:03 Qcbe5172 Setting remote IP address to 65.171.144.5
12/09/2001 15:39:03 Qcbe5172 5.144.171.65.in-addr.arpa
12/09/2001 15:39:03 Qcbe5172 Not found.
12/09/2001 15:39:03 Qcbe5172 Hop 0: Checking IP Address 65.171.144.5.
12/09/2001 15:39:03 Qcbe5172 5.144.171.65.bl.spamcop.net IS listed in
OSSOFT.
12/09/2001 15:39:03 Qcbe5172 5.144.171.65.relays.osirusoft.com IS listed in
SPAMCOP.
12/09/2001 15:39:03 Qcbe5172 5.144.171.65.bl.spamcop.net IS listed in
SPAMCOPHDR.
12/09/2001 15:39:13 Qcbe5172 Handling Received: header
12/09/2001 15:39:13 Qcbe5172 Last line of headers: Message-ID:
<4700.200112091236
12/09/2001 15:39:13 Qcbe5172 TEST: 10 heur=0.009897 t[]domain=10
12/09/2001 15:39:13 Qcbe5172 TEST: 9 heur=0.009897 t[]domain=9
12/09/2001 15:39:13 Qcbe5172 TEST: 8 heur=0.009897 t[]domain=8
12/09/2001 15:39:13 Qcbe5172 TEST: 9 heur=0.009897 t[]domain=
12/09/2001 15:39:13 Qcbe5172 SPAMCOP:7 REVDNS:5 . Total weight = 12
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 3 [EMAIL PROTECTED]
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 2 63.107.174.
12/09/2001 15:39:13 Qcbe5172 IP 65.171.144.5 not in whitelist (63.107.174.)
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 1 hm-software.com
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 2 128.192.1.101
12/09/2001 15:39:13 Qcbe5172 IP 65.171.144.5 not in whitelist
(128.192.1.101)
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 2 130.160.4.249
12/09/2001 15:39:13 Qcbe5172 IP 65.171.144.5 not in whitelist
(130.160.4.249)
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 2 199.232.158.102
12/09/2001 15:39:13 Qcbe5172 IP 65.171.144.5 not in whitelist
(199.232.158.102)
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 1 nytimes.com
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 2 148.100.1.2
12/09/2001 15:39:13 Qcbe5172 IP 65.171.144.5 not in whitelist (148.100.1.2)
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 2 64.65.65.2
12/09/2001 15:39:13 Qcbe5172 IP 65.171.144.5 not in whitelist (64.65.65.2)
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 1 lists.cnn.com
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 1 timeinc.com
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 1 uni.de
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 2 206.242.213.5
12/09/2001 15:39:13 Qcbe5172 IP 65.171.144.5 not in whitelist
(206.242.213.5)
12/09/2001 15:39:13 Qcbe5172 Testing whitelist 1 stellenmarkt.de
12/09/2001 15:39:13 Qcbe5172 Looping...
12/09/2001 15:39:13 Qcbe5172 S<[EMAIL PROTECTED]>
12/09/2001 15:39:13 Qcbe5172 Looking up MX/A record for slutty-coeds.com at
63.107.174.65.
12/09/2001 15:39:13 Qcbe5172 Done with MX/A record
12/09/2001 15:39:13 Qcbe5172 Opening
HKEY_LOCAL_MACHINE\software\Ipswitch\IMail\Domains
12/09/2001 15:39:13 Qcbe5172 Domain name = schmidt.as, User name = ndy.
12/09/2001 15:39:13 Qcbe5172 Using CFG file
D:\IMAIL\Declude\$default$.junkmail.
12/09/2001 15:39:13 Qcbe5172 .......X......XX.....X....XX
12/09/2001 15:39:13 Qcbe5172 Test #7 [OSSOFT weight=0] triggered; action = 0
12/09/2001 15:39:13 Qcbe5172 Test #14 [SPAMCOP weight=7] triggered; action =
0
12/09/2001 15:39:13 Qcbe5172 Test #15 [SPAMCOPHDR weight=0] triggered;
action = 0
12/09/2001 15:39:13 Qcbe5172 Test #21 [REVDNS weight=5] triggered; action =
4
12/09/2001 15:39:13 Qcbe5172 Msg failed REVDNS (This E-mail was sent from a
mail server [No Reverse DNS] with no reverse DNS entry.).
12/09/2001 15:39:13 Qcbe5172 Test #26 [WEIGHT10 weight=10] triggered; action
= 0
12/09/2001 15:39:13 Qcbe5172 Test #27 [WEIGHT8 weight=8] triggered; action =
0
12/09/2001 15:39:13 Qcbe5172 X-Declude-Note: Processed by Declude 1.29a;
remote host [No Reverse DNS]
12/09/2001 15:39:13 Qcbe5172 AlterMessage
12/09/2001 15:39:13 Qcbe5172 Subject: Re: Your account
12/09/2001 15:39:13 Qcbe5172 From: [EMAIL PROTECTED] To:
[EMAIL PROTECTED]
12/09/2001 15:39:13 Qcbe5172 Looping...
12/09/2001 15:39:13 Qcbe5172 Done Looping
12/09/2001 15:39:13 Qcbe5172 Final action=0.
12/09/2001 15:39:13 Qcbe5172 D:\IMAIL\spool\Qcbe5172.SMD
12/09/2001 15:39:13 Qcbe5172 Unlocked D:\IMAIL\spool\Qcbe5172.SMD.
12/09/2001 15:39:14 Qcbe5172 Passing to SMTP3: D:\IMAIL\SMTP32.EXE
"D:\IMAIL\spool\Qcbe5172.SMD".
12/09/2001 15:39:14 Qcbe5172 Total Time: 1454ms
Best Regards
Andy Schmidt
H&M Systems Software, Inc.
600 East Crescent Avenue
Suite 203
Upper Saddle River, NJ 07458-1846
Phone: +1 201 934-3414 x20 (Business)
Fax: +1 201 934-9206
http://www.hm-software.com/
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Saturday, December 08, 2001 01:52 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Declude v1.29 beta - Arbitrary Logging,
and Weighting IS broken!
Importance: Low
>sorry, but something IS wrong with the log and the weighting. No matter how
>you twist and turn <G>. Fortunately, with 1.29 it finally is apparent,
even
>to the naked eye:
OK -- I've gone through the issues and reports with 1.29, and it looks like
there is only one outstanding issue (albeit a complex one): Something
isn't working properly, that can cause failed tests not to get reported in
the log, and also prevent the actions from running.
If there are other issues that I've overlooked, please do let me know. I
want to make sure that all the issues get addressed, but it looks like this
is the only one left.
If that's correct, would it be possible to turn on the debugging in Declude
JunkMail (LOGLEVEL DEBUG) long enough to let one of these issues reproduce
itself? I think that would be the optimal way to continue, as it seems
that this is happening often enough that it wouldn't take too long to get
one of these to reproduce. With the debug logs, it will be a lot easier to
track down the problem, and nail it once and for all.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
