Okay, I think I have a debug log that shows where the WEIGHT10 was NOT
triggered, even though the total weight was 10.
At one point it says:
11/06/2001 19:54:38 Q86454a8 SPAMHEADERS:3 SPAMROUTING:4 HEUR8:3 . Total
weight = 10
But later on it says:
11/06/2001 19:54:38 Q86454a8 Using CFG file
D:\IMAIL\Declude\$default$.junkmail.
11/06/2001 19:54:38 Q86454a8 ..................XX...X.XX
11/06/2001 19:54:38 Q86454a8 Test #18 [SPAMHEADERS weight=3] triggered;
action = 4
11/06/2001 19:54:38 Q86454a8 Msg failed SPAMHEADERS (This E-mail has
headers consistent with spam [60004103].).
11/06/2001 19:54:38 Q86454a8 Test #19 [SPAMROUTING weight=4] triggered;
action = 4
11/06/2001 19:54:38 Q86454a8 Msg failed SPAMROUTING (This E-mail was routed
in a poor manner consistent with spam [60004103].).
11/06/2001 19:54:38 Q86454a8 Test #23 [HEUR8 weight=3] triggered; action =
0
11/06/2001 19:54:38 Q86454a8 Test #25 [WEIGHT10 weight=10] triggered;
action = 0
11/06/2001 19:54:38 Q86454a8 Test #26 [WEIGHT8 weight=8] triggered; action
= 0
So it is TRIGGERING the "weight", but the action=0 is wrong and it doesn't
fail the message!
That is different from other times, when the WEIGHTnn test also inserts a
"Msg Failed" log entry, as in:
11/06/2001 19:53:28 Q86024a8 Using CFG file
D:\IMAIL\Declude\$default$.junkmail.
11/06/2001 19:53:28 Q86024a8 ..............X.....XX...XX
11/06/2001 19:53:28 Q86024a8 Test #14 [SPAMCOP weight=7] triggered; action
= 4
11/06/2001 19:53:28 Q86024a8 Msg failed SPAMCOP (Blocked - see
http://spamcop.net/bl.shtml?209.15.200.48).
11/06/2001 19:53:28 Q86024a8 Test #20 [REVDNS weight=5] triggered; action =
9
11/06/2001 19:53:28 Q86024a8 Msg failed REVDNS (This E-mail was sent from a
mail server with no reverse DNS entry.).
11/06/2001 19:53:28 Q86024a8 Test #21 [HEUR10 weight=4] triggered; action =
0
11/06/2001 19:53:28 Q86024a8 Test #25 [WEIGHT10 weight=10] triggered;
action = 11
11/06/2001 19:53:28 Q86024a8 Msg failed WEIGHT10 (Weight of 16 exceeds the
limit of 10.).
11/06/2001 19:53:29 Q86024a8 Test #26 [WEIGHT8 weight=8] triggered; action
= 7
11/06/2001 19:53:29 Q86024a8 Msg failed WEIGHT8 (Weight of 16 exceeds the
limit of 8.).
Notice how it uses the SAME config file - but the results are entirely
different!
Here is the complete log for your to go through:
11/06/2001 19:54:30 CFG: Setting LOG_OK level to NONE
11/06/2001 19:54:30 CFG: Set hop to 0 and hophigh to 0.
11/06/2001 19:54:30 Console turned OFF
11/06/2001 19:54:30 CFG: Setting XINHEADER to X-Declude-Note: Processed by
Declude %VERSION%; remote host %REVDNS%.
11/06/2001 19:54:30 CFG: Setting XOUTHEADER to X-Note: Report any abuse to
[EMAIL PROTECTED]
11/06/2001 19:54:30 CFG: Bypassing IP 63.107.174.32.
11/06/2001 19:54:30 CFG: Setting XSENDER to ON
11/06/2001 19:54:30 CFG: Setting XSPOOLNAME to ON
11/06/2001 19:54:30 CFG: Whitelisting ANYWHERE [EMAIL PROTECTED]
11/06/2001 19:54:30 CFG: Whitelisting IP 63.107.174..
11/06/2001 19:54:30 CFG: Whitelisting FROM hm-software.com.
11/06/2001 19:54:30 CFG: Whitelisting IP 128.192.1.101.
11/06/2001 19:54:30 CFG: Whitelisting IP 130.160.4.249.
11/06/2001 19:54:30 CFG: Whitelisting IP 199.232.158.102.
11/06/2001 19:54:30 CFG: Whitelisting FROM nytimes.com.
11/06/2001 19:54:30 CFG: Whitelisting IP 148.100.1.2.
11/06/2001 19:54:30 CFG: Whitelisting IP 64.65.65.2.
11/06/2001 19:54:30 CFG: Whitelisting FROM lists.cnn.com.
11/06/2001 19:54:30 CFG: Whitelisting FROM timeinc.com.
11/06/2001 19:54:30 CFG: Whitelisting FROM uni.de.
11/06/2001 19:54:30 CFG: Whitelisting IP 206.242.213.5.
11/06/2001 19:54:30 CFG: Whitelisting FROM stellenmarkt.de.
11/06/2001 19:54:30 Declude v1.28
11/06/2001 19:54:30 Setting HOLD directory to: D:\IMAIL\spool\spam.
11/06/2001 19:54:30 Q86454a8 Setting DNS server to IMail's 63.107.174.65.
11/06/2001 19:54:30 Q86454a8 Declude JunkMail Standard Version Registered
11/06/2001 19:54:30 Q86454a8 Start
11/06/2001 19:54:30 Q86454a8 Locking D:\IMAIL\spool\Q86454a8.SMD.
11/06/2001 19:54:30 Q86454a8 D:\IMAIL\spool\Q86454a8.SMD locked.
11/06/2001 19:54:30 Q86454a8 Getting message envelope
11/06/2001 19:54:30 Q86454a8 Starting locality check
11/06/2001 19:54:30 Q86454a8 CL Opening
HKEY_LOCAL_MACHINE\software\Ipswitch\IMail\Domains
11/06/2001 19:54:30 Q86454a8 [EMAIL PROTECTED] [0] is local domain1
11/06/2001 19:54:30 Q86454a8 [EMAIL PROTECTED] [0] is local main
domain
11/06/2001 19:54:30 Q86454a8 Done getting message envelope
11/06/2001 19:54:30 Q86454a8 Getting headers
11/06/2001 19:54:30 Q86454a8 Mid-headers
11/06/2001 19:54:30 Q86454a8 Done getting headers
11/06/2001 19:54:30 Q86454a8 Done getting envelope and headers
11/06/2001 19:54:32 Q86454a8 Ver=20 verflag=0
11/06/2001 19:54:32 Q86454a8 About to run spam tests
11/06/2001 19:54:32 Q86454a8 Going through datafile
11/06/2001 19:54:32 Q86454a8 Starting header check of
11/06/2001 19:54:32 Q86454a8 Starting header check of Received: from compa
11/06/2001 19:54:32 Q86454a8 203.141.175.201] by
mail.webhost.hm-software.com with ESMTP (SMTPD32-7.04) id A645DC04A8; Tue,
06 Nov 2001 19:54:29 -0500
11/06/2001 19:54:32 Q86454a8 SPAMROUTING processing IPb 203.141.175.201].
11/06/2001 19:54:32 Q86454a8 Handling Received: header
11/06/2001 19:54:32 Q86454a8 Setting remote IP address to 203.141.175.201
11/06/2001 19:54:32 Q86454a8 201.175.141.203.in-addr.arpa
11/06/2001 19:54:33 Q86454a8 Got it: 201.175.141.203.in-addr.arpa..
11/06/2001 19:54:33 Q86454a8 Hop 0: Checking IP Address 203.141.175.201.
11/06/2001 19:54:33 Q86454a8 Waiting for results
11/06/2001 19:54:37 Q86454a8 Starting header check of Received: from orgio
11/06/2001 19:54:37 Q86454a8 65.44.224.66]) by
compaq_server.tokyo.denkei.co.jp with SMTP (Microsoft Exchange Internet Mail
Service Version 5.5.2650.21) id V0ADJD9Q; Mon, 5 Nov 2001 06:29:50 +0900
11/06/2001 19:54:37 Q86454a8 SPAMROUTING processing IPa 65.44.224.66]) b.
11/06/2001 19:54:37 Q86454a8 Handling Received: header
11/06/2001 19:54:37 Q86454a8 Skipping received line (hop 1)
11/06/2001 19:54:37 Q86454a8 Starting header check of Message-ID: <0000629
11/06/2001 19:54:37 Q86454a8 Starting header check of To: <htnpehrwel@orgi
11/06/2001 19:54:37 Q86454a8 Starting header check of From: e11092@portuga
11/06/2001 19:54:37 Q86454a8 Starting header check of Subject: re: winner
11/06/2001 19:54:37 Q86454a8 Starting header check of Date: Sun, 04 Nov 20
11/06/2001 19:54:37 Q86454a8 Starting header check of MIME-Version: 1.0
11/06/2001 19:54:37 Q86454a8 Starting header check of Content-Type: text/h
11/06/2001 19:54:37 Q86454a8 Starting header check of Content-Transfer-Enc
11/06/2001 19:54:37 Q86454a8 Starting header check of X-Priority: 3
11/06/2001 19:54:37 Q86454a8 Last line of headers: X-MSMail-Priority: Normal
11/06/2001 19:54:37 Q86454a8 Starting header check of X-MSMail-Priority: N
11/06/2001 19:54:38 Q86454a8 TEST: 10 heur=0.990346 t[]domain=10
11/06/2001 19:54:38 Q86454a8 TEST: 9 heur=0.990346 t[]domain=9
11/06/2001 19:54:38 Q86454a8 TEST: 8 heur=0.990346 t[]domain=8
11/06/2001 19:54:38 Q86454a8 TEST: 9 heur=0.990346 t[]domain=
11/06/2001 19:54:38 Q86454a8 SPAMHEADERS:3 SPAMROUTING:4 HEUR8:3 . Total
weight = 10
11/06/2001 19:54:38 Q86454a8 Testing whitelist 3 [EMAIL PROTECTED]
11/06/2001 19:54:38 Q86454a8 Testing whitelist 2 63.107.174.
11/06/2001 19:54:38 Q86454a8 IP 203.141.175.201 not in whitelist
(63.107.174.)
11/06/2001 19:54:38 Q86454a8 Testing whitelist 1 hm-software.com
11/06/2001 19:54:38 Q86454a8 Testing whitelist 2 128.192.1.101
11/06/2001 19:54:38 Q86454a8 IP 203.141.175.201 not in whitelist
(128.192.1.101)
11/06/2001 19:54:38 Q86454a8 Testing whitelist 2 130.160.4.249
11/06/2001 19:54:38 Q86454a8 IP 203.141.175.201 not in whitelist
(130.160.4.249)
11/06/2001 19:54:38 Q86454a8 Testing whitelist 2 199.232.158.102
11/06/2001 19:54:38 Q86454a8 IP 203.141.175.201 not in whitelist
(199.232.158.102)
11/06/2001 19:54:38 Q86454a8 Testing whitelist 1 nytimes.com
11/06/2001 19:54:38 Q86454a8 Testing whitelist 2 148.100.1.2
11/06/2001 19:54:38 Q86454a8 IP 203.141.175.201 not in whitelist
(148.100.1.2)
11/06/2001 19:54:38 Q86454a8 Testing whitelist 2 64.65.65.2
11/06/2001 19:54:38 Q86454a8 IP 203.141.175.201 not in whitelist
(64.65.65.2)
11/06/2001 19:54:38 Q86454a8 Testing whitelist 1 lists.cnn.com
11/06/2001 19:54:38 Q86454a8 Testing whitelist 1 timeinc.com
11/06/2001 19:54:38 Q86454a8 Testing whitelist 1 uni.de
11/06/2001 19:54:38 Q86454a8 Testing whitelist 2 206.242.213.5
11/06/2001 19:54:38 Q86454a8 IP 203.141.175.201 not in whitelist
(206.242.213.5)
11/06/2001 19:54:38 Q86454a8 Testing whitelist 1 stellenmarkt.de
11/06/2001 19:54:38 Q86454a8 Looping...
11/06/2001 19:54:38 Q86454a8 S<[EMAIL PROTECTED]>
11/06/2001 19:54:38 Q86454a8 Looking up MX/A record for portugalmail.com at
63.107.174.65.
11/06/2001 19:54:38 Q86454a8 Done with MX/A record
11/06/2001 19:54:38 Q86454a8 Opening
HKEY_LOCAL_MACHINE\software\Ipswitch\IMail\Domains
11/06/2001 19:54:38 Q86454a8 Domain name = aol.com, User name = Kasette.
11/06/2001 19:54:38 Q86454a8 Using CFG file
D:\IMAIL\Declude\$default$.junkmail.
11/06/2001 19:54:38 Q86454a8 ..................XX...X.XX
11/06/2001 19:54:38 Q86454a8 Test #18 [SPAMHEADERS weight=3] triggered;
action = 4
11/06/2001 19:54:38 Q86454a8 Msg failed SPAMHEADERS (This E-mail has headers
consistent with spam [60004103].).
11/06/2001 19:54:38 Q86454a8 Test #19 [SPAMROUTING weight=4] triggered;
action = 4
11/06/2001 19:54:38 Q86454a8 Msg failed SPAMROUTING (This E-mail was routed
in a poor manner consistent with spam [60004103].).
11/06/2001 19:54:38 Q86454a8 Test #23 [HEUR8 weight=3] triggered; action = 0
11/06/2001 19:54:38 Q86454a8 Test #25 [WEIGHT10 weight=10] triggered; action
= 0
11/06/2001 19:54:38 Q86454a8 Test #26 [WEIGHT8 weight=8] triggered; action =
0
11/06/2001 19:54:38 Q86454a8 X-Declude-Note: Processed by Declude 1.28;
remote host 201.175.141.203.in-addr.arpa.
11/06/2001 19:54:38 Q86454a8 AlterMessage
11/06/2001 19:54:38 Q86454a8 Subject: re: winner confirmation
26332
11/06/2001 19:54:38 Q86454a8 From: [EMAIL PROTECTED] To:
[EMAIL PROTECTED]
11/06/2001 19:54:38 Q86454a8 Looping...
11/06/2001 19:54:38 Q86454a8 Done Looping
11/06/2001 19:54:38 Q86454a8 Final action=0.
11/06/2001 19:54:38 Q86454a8 D:\IMAIL\spool\Q86454a8.SMD
11/06/2001 19:54:38 Q86454a8 Unlocked D:\IMAIL\spool\Q86454a8.SMD.
11/06/2001 19:54:38 Q86454a8 Passing to SMTP3: D:\IMAIL\SMTP32.EXE
"D:\IMAIL\spool\Q86454a8.SMD".
11/06/2001 19:54:38 Q86454a8 Total Time: 2626ms
Best Regards
Andy
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
