Speed (and stability) and additional test options.
The external test runs as a command line, each email is a new instance that needs an environment to be instantiated and later broken down. On top of that, it burns up some of that not-well documented heap memory for command line programs - which CAN cause stability problems in some problems if one runs several command line tools in Declude (although there are some registry settings in Windows to allocate "some" extra heap). The internal test offers additional tests (such as the reputation test) and other IP based tests that the external test does not - and it runs as "part" of Declude (not by starting another command line session for each email). From: [email protected] [mailto:[email protected]] On Behalf Of Jim Comerford Sent: Friday, April 30, 2010 12:02 PM To: [email protected] Subject: RE: [Declude.JunkMail] Sniffer Integration -> Global Exit Code "nonzero"? So what's the difference between the SNIFFER test as Internal vs External? Is one faster than the other? Assuming you did not want to check the individual tests (ie SNIFFER-TRAVEL) is there an advantage to using one over the other? Internal: SNIFFER external nonzero "C:\Smartermail\Declude\Sniffer\xxxxxxx.exe xxxabc123xxxx" 12 0 SNIFFER-TRAVEL SNF x 47 12 0 External SNIFFER external nonzero "D:\IMAIL\Declude\SNF\SNFClient.exe" 12 0 -Jim From: [email protected] [mailto:[email protected]] On Behalf Of David Barker Sent: Friday, April 30, 2010 11:14 AM To: [email protected] Subject: RE: [Declude.JunkMail] Sniffer Integration -> Global Exit Code "nonzero"? The test works as an internal test and not as an external test. The main difference being the location of the exit code. See external is the 1st variable whereas the internal it is the 2nd variable and the NONZERO does not work for that. SNIFFER external nonzero "C:\Smartermail\Declude\Sniffer\xxxxxxx.exe xxxabc123xxxx" 12 0 SNIFFER-TRAVEL SNF x 47 12 0 Also even though there are multiple entries the test only runs once and the resulted exit code is the triggered. David From: [email protected] [mailto:[email protected]] On Behalf Of Andy Schmidt Sent: Friday, April 30, 2010 10:31 AM To: [email protected] Subject: RE: [Declude.JunkMail] Sniffer Integration -> Global Exit Code "nonzero"? Hi Dave, Thanks for taking the time to explain it. I see that the sample on your web site has already been corrected to read "IPREPUTATION SNFIPREP " and I was simply working off an earlier copy. For the "SNF" test type, is there a way to have a "global" match (e.g., NONZERO), instead of having to specify each of the 18 (current) return codes one at a time? The external Sniffer simply allow me to code: SNIFFER external nonzero "D:\IMAIL\Declude\SNF\SNFClient.exe" 10 0 Best Regards, Andy From: [email protected] [mailto:[email protected]] On Behalf Of David Barker Sent: Friday, April 30, 2010 10:05 AM To: [email protected] Subject: RE: [Declude.JunkMail] Sniffer Integration SNFIPBLACK SNFIP the 2nd variable value is 5 = Block and works as an exit code. IPREPUTATION works differently. Note: IPREPUTATION SNFIP please update this to IPREPUTATION SNFIPREP x 0 10 -5 this should be the default. SNFIPREP represents a scale of -1----- 0 ----- 1 when the 2nd variable (BASEPOINT) is set to 0 this will convert the IP reputation to this scale as the examples below: If final score is 0 no score is added to the email dec0430.log 1842 04/30/2010 00:01:20.700 49319588 SNFIPRep the Value of Result = 0.000000 If final score is + the 3rd variable score is used in this case 10 dec0430.log 7351 04/30/2010 00:07:14.043 49319625 SNFIPRep the Value of Result = 0.267262 If final score is - the 4th variable score is used in this case -5 dec0430.log 11926 04/30/2010 00:08:50.340 49319647 SNFIPRep the Value of Result = -0.267262 The BASEPOINT is the point value at which an email will be considered "Good" if the result is to the left or "Bad" if to the right. (SNIFFER RETURN) x 10 - (BASEPOINT) = Result Example: 0.267262 x 10 - 0 = 2 This is positive then the test is triggered for 10 points. 0.267262 x 10 - 1 = 1 This is positive then the test is triggered for 10 points. 0.267262 x 10 - 2 = 0 Not Triggered. 0.267262 x 10 - 3 = -1 This is negative then the test is not-triggered for -5 points. 0.267262 x 10 - 4 = -2 This is negative then the test is not-triggered for -5 points. -0.267262 x 10 - 0 = -2 This is negative then the test is not-triggered for -5 points. -0.267262 x 10 - 1 = -1 This is negative then the test is not-triggered for -5 points. -0.267262 x 10 - 2 = 0 Not Triggered. -0.267262 x 10 - 3 = -1 This is negative then the test is not-triggered for -5 points. -0.267262 x 10 - 4 = -2 This is negative then the test is not-triggered for -5 points. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax <mailto:[email protected]> [email protected] , April 30, 2010 1:26 AM To: [email protected] Subject: RE: [Declude.JunkMail] Sniffer Integration Hi, 1. I'm confused about the Sniffer integration sample: SNFIPBLACK SNFIP x 5 10 0 IPREPUTATION SNFIP x 5 10 -5 It seems to me as if BOTH lines test the SAME Sniffer return code of "5" - but one line assigns adds a weight of 10 when found, the other also adds a weight of 10, but subtracts 5 when NOT found? So will this add "20" when found? Why use TWO lines to accomplish that? 2. In the past I could simply configure: SNIFFER external nonzero "D:\IMAIL\Declude\SNF\SNFClient.exe" 10 0 if I didn't want to duplicate 18 lines - and risk that at some point a return code will be added that I will miss unless I add another line to the config file. So, does the "SNF" test have some way to configure ONE line for "nonzero" to create a baseline weight, and then just add "SNF" tests for specific return code if I want those specific ones treated with a higher weight? Best Regards, Andy --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [email protected], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [email protected], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [email protected], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [email protected], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
