> The best way to troubleshoot weights is to use "LOGLEVEL MID" in the > \IMail\Declude\global.cfg file. This will add a line to the log file that > shows how Declude JunkMail came up with the weight (except that it does not > include weights from lines within filters; that should be changed soon).
The current log level in "\imail\declude\global.cfg" file is set to HIGH. I'm assuming HIGH has the same stuff has MID (and more).
Correct.
How do I locate the relevant lines in the log file? Is there some of identifier in the
original e-mail headers that I can use?
Yes. For the IMail and Declude log files, you can search for the spool file name minus the first character and extension. For example, your post has a line "X-Declude-Spoolname: D2f7ec80804d034b8.SMD" in it that was added by Declude JunkMail here, so I could search the IMail or Declude log files for "2f7ec80804d034b8" and find your E-mail.
> It's probably because you have a test with a "negative weight" -- one that > the E-mail did *not* fail, so a weight was subtracted from the total weight > of the E-mail. The IPNOTINMX and NOLEGITCONTENT tests are two tests that > work this way.
It just so happens that IPNOTINMX is enabled in my global.cfg...
- IPNOTINMX ipnotinmx x x 0 -3 -
That would solve the equation, then.
So, because of the nature of IPNOTINMX then if a message does NOT fail the IPNOTINMX then -3 points are added on to its weight? If so, then that explains the weight being 3 points lower.
Correct.
One thing that's of consternation to me here is that a test that's being applied to the message, i.e. IPNOTINMX, is not being represented in the headers of the message. Is there any way that DJM Pro can be configured to display not just "X-Spam-Tests-Failed:" but "X-Spam-Tests-Applied:"?
That could get *very* confusing. For example, if an E-mail fails the IPNOTINMX test, no weight will be added to the E-mail. Should that be in the X-Spam-Tests-Failed: header (since it did fail the test)? If the IPNOTINMX test was set up to add a weight of 1 to E-mail that fails the test (and still subtract 3 if the E-mail does not fail the test), should it be listed in the "X-Spam-Tests-Applied:" header? Will recipients get confused by the two headers?
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
