Scott, in this vein, would it be possible to include ALL line numbers that fail a particular filter test, at least in the logs at MID level logging? It would be nice to know all lines of the filter file that were flagged.
Thanks, Bill ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, June 13, 2003 7:59 AM Subject: Re: [Declude.JunkMail] Counting > > >How did this get to Weight of 24. > > The easiest way to find out is to use LOGLEVEL MID, which will include a > line in the log file with the weights. > > >If it finds the item in the email more then once does it accumulate. > > For a filter, it will only look at the first occurrence. But, if multiple > lines in the filter match the E-mail, then all of them will be used. So if > you have a filter that starts off at 5 points with: > > BODY 1 CONTAINS Hello > BODY 2 CONTAINS Goodbye > > and you have an E-mail that says "Hello Goodbye Goodbye", a total of 8 > points will be added to the E-mail (5 for failing the test, 1 for having > "Hello" in there, and 2 for having "Goodbye" in there). > > >X-RBL-Warning: FILTER-BODY: Message failed FILTER-BODY test (936) > > Note that the "936" means that the line 936 is one of the lines that the > E-mail failed. There may be others. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
