This line, with the "Action=WARN", indicates that the E-mail was not whitelisted (since the IGNORE action should be used for all tests (except CATCHALLMAILS) when the E-mail is whitelisted).The log file shows this when it happens..01/19/2003 00:02:54 Q5bac124 OSSOFT:5 OSSRC:5 SNIFFER:10 LOCALHEADERS:40 BODYCHECKS:40 . Total weight = 100 01/19/2003 00:02:54 Q5bac124 Msg failed OSSOFT (http://spamhaus.org/SBL/sbl.lasso?query=SBL4908). Action=IGNORE. 01/19/2003 00:02:54 Q5bac124 Msg failed OSSRC (http://spamhaus.org/SBL/sbl.lasso?query=SBL5427). Action=WARN.
My guess would be that Declude JunkMail is using a different configuration file than you think that it is. I would recommend temporarily using "LOGLEVEL HIGH" (in the \IMail\Declude\global.cfg file), which will record which configuration file Declude JunkMail is using to determine the actions to take on an E-mail.
The other option would be to use the debug mode ("LOGLEVEL DEBUG" in the global.cfg file) until this happens again. When it does, the debug log file snippet should provide enough information to determine exactly what is happening.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
