RE: [Declude.JunkMail] SpamManager test

[John Tolmachoff \(Lists\)]

Since I have not got around to publishing the white paper on implementing SpamManager (Now Alligate) as an integrated test within Declude, here is a simple run down:   Here is what I do and what is recommended:   I defined 6 tests as below. Using the greater than and less than signs allows accumulative weights. For example, if a message is deemed as spam by SpamManager with an exit score of 40, it will fail spam1 & spam2 and have a weight of 30. If it fails adult with an exit score of say 50, it will have a weight of 40.   If you have the config file set up right as a Declude only test, it will return a positive value for spam and a negative value for adult spam.   So, in your example, the message using my definitions would have given the message a weight of 30.   SPMMGRSPAM1         external         >17     "D:\Imail\SpamManager\noxmail.exe"         20      0 SPMMGRSPAM2         external         >39     "D:\Imail\SpamManager\noxmail.exe"         10      0 SPMMGRSPAM3         external         >99     "D:\Imail\SpamManager\noxmail.exe"         10      0 SPMMGRADULT1       external         <-17   "D:\Imail\SpamManager\noxmail.exe"         20      0 SPMMGRADULT2       external         <-39   "D:\Imail\SpamManager\noxmail.exe"         20      0 SPMMGRADULT3       external         <-74   "D:\Imail\SpamManager\noxmail.exe"         20      0   I am currently holding at 25 and deleting at 35.   Please let me know if you need more help with this, as I am one of the original beta testers and helped to design the flexible weighting for Declude.   John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike Gable Sent: Monday, June 23, 2003 10:22 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SpamManager test   Hi,   I've got SpamManager running as a test only in Declude, and while it catches nearly everything SPAM it also has a lot of false positives, so I was wondering if I could create specific HEADER tests with different actions taken based on the SpamManager points system results. A SpamManager header looks like this:   X-CYBERsitter-SpamManager-In: FAILED - Score Adult: 0 (Req: 18) Spam: 68 (Req: 18) Tot: 68 (Req: 25)   For example: HEADERS 30 CONTAINS Score Adult: 25 HEADERS 20 CONTAINS Spam: 40   I am currently running this Test/Action which minimizes false positives, but still lets a lot of Spam through: CYBERSITTER  external   nonzero   "D:\IMail\SpamManager\NoXMail.exe"   10   0   The only thing I don't know is if Declude has already finished with the HEADER tests before it has inserted the Cybersitter header.   Thanks!   Mike