Goran and Scott... John probably hit the nail on the head. I was going to make the same comment, actually.
Since you have the message, turn on HIGH or DEBUG level logging and send the message to yourself. I bet that there are other tests in that same filter file that are triggered, and that the line you're concerned with is the *last* filter that is triggered, and thus there are 1 or more other filters that are triggered which total 10 points. With HIGH or DEBUG level logging, you will see a line in the Declude decMMDD.log file for every filter line that is triggered. Andrew 8) -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Friday, February 25, 2005 11:12 AM To: [email protected] Subject: RE: [Declude.JunkMail] Body filter adding extra 10 points Scott, Since I do the editing on the filter files and I do not remember doing this ..... I have been doing a bunch of work on COMBO filters but not on tweaking that filter. Now it is possible that I did tweak it and I do not remember doing it but ... I will ask around the office as well I sent a test mail to myself with STRICTLY CONFIDENTIAL in the body and got a FILTER-NIGERIAN-SCAM [2] so it is working correctly now. I am going to watch what it is doing and maybe replace the filter with your multiline one. Goran Jovanovic The LAN Shoppe > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Scott Fisher > Sent: Friday, February 25, 2005 1:16 PM > To: [email protected] > Subject: Re: [Declude.JunkMail] Body filter adding extra 10 points > > Could it have been set to "body contains 12.." on 2/16 and subsequently > changed to "body contains 2.." sometime after the email was processes? > > It's the only explanation that I can see... > > ----- Original Message ----- > From: "Goran Jovanovic" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Friday, February 25, 2005 11:17 AM > Subject: RE: [Declude.JunkMail] Body filter adding extra 10 points > > > Here it is > > > > > Goran Jovanovic > The LAN Shoppe > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Scott Fisher > > Sent: Friday, February 25, 2005 12:00 PM > > To: [email protected] > > Subject: Re: [Declude.JunkMail] Body filter adding extra 10 points > > > > Can you post the entire filter? > > > > My copy of Kami's filter shows: > > BODY 12 CONTAINS STRICTLY CONFIDENTIAL > > ----- Original Message ----- > > From: "Goran Jovanovic" <[EMAIL PROTECTED]> > > To: <[email protected]> > > Sent: Friday, February 25, 2005 9:44 AM > > Subject: [Declude.JunkMail] Body filter adding extra 10 points > > > > > > Hi, > > > > I am seeing very strange behaviour with one of my body filters. > > > > These are the only three entries with STRICTLY CONFIDENTIAL: > > > > BODY 2 CONTAINS STRICTLY CONFIDENTIAL > > BODY 20 CONTAINS STRICTLY CONFIDENTIAL & URGENT > > BODY 20 CONTAINS STRICTLY CONFIDENTIAL BUSINESS > > PROPOSAL > > > > >From the Declude Log: > > > > 02/16/2005 16:36:04 Qbca31d68008ed51d Triggered BODY CONTAINS filter > > FILTER-NIGERIAN-SCAM on STRICTLY CONFIDENTIAL [weight->12; strictly > > confidential to you a]. > > > > And the actual message text which is a plain text message: > > > > I would appreciate your keeping the fact of this meeting strictly > > confidential to you alone. > > > > So the question is how did an extra 10 points get added to this? > > > > Declude 1.82 on IMail. > > > > Thanx > > > > > > Goran Jovanovic > > The LAN Shoppe > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > "unsubscribe Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > "unsubscribe Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
