RE: [Declude.JunkMail] SpamManager test

[Mike Gable]

Scott and John:   OK, now! I've done some playing around and it's now working as expected. Here's a summary of what had transpired:   1.  I was running Declude 1.65.   2.  I applied John's test definitions as shown below, and all emails were suddenly being deleted plus "fromfile" tests were not being loaded, I thought, because of the use of quotation marks around the path names of the tests and so removed them.   3.  I restored the default SpamManager (Alligate) test.   4.  Per Scott, the accumulative weights feature (< and >) would only work with 1.66 and above so I upgraded to 1.70B, but then, neither the default test nor John's tests would work.   5.  I re-read the Alligate manual and realized I should try it again with the quotation marks around the path names. Voila!   Now, what I need to know, please, is how the accumulative weights work, but especially the lesser-than minus scores ( <- ) used on the adult tests. Does this test mean it will get a weight of 20 if the exit code is 17 or higher? Again why the lesser-than minus thing?:   SPMMGRADULT1       external         <-17   "D:\Imail\SpamManager\noxmail.exe"         20      0   What does the  <-  combination mean?   Also, if the message has an exit code of 17+ why would it get a weight of 20, and if it had an exit code of 39+ why would it get a weight of 20 AND 10 (total=30)? Why not 17+ gets 10 and 39+ gets 20?   I am concerned about weights skyrocketing so that legitimate email could get deleted (weight 35 in my case).   Thanks for your help and your response.                                   -Mike -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of John Tolmachoff (Lists) Sent: Monday, June 23, 2003 4:34 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SpamManager test Since I have not got around to publishing the white paper on implementing SpamManager (Now Alligate) as an integrated test within Declude, here is a simple run down:   Here is what I do and what is recommended:   I defined 6 tests as below. Using the greater than and less than signs allows accumulative weights. For example, if a message is deemed as spam by SpamManager with an exit score of 40, it will fail spam1 & spam2 and have a weight of 30. If it fails adult with an exit score of say 50, it will have a weight of 40.   If you have the config file set up right as a Declude only test, it will return a positive value for spam and a negative value for adult spam.   So, in your example, the message using my definitions would have given the message a weight of 30.   SPMMGRSPAM1         external         >17     "D:\Imail\SpamManager\noxmail.exe"         20      0 SPMMGRSPAM2         external         >39     "D:\Imail\SpamManager\noxmail.exe"         10      0 SPMMGRSPAM3         external         >99     "D:\Imail\SpamManager\noxmail.exe"         10      0 SPMMGRADULT1       external         <-17   "D:\Imail\SpamManager\noxmail.exe"         20      0 SPMMGRADULT2       external         <-39   "D:\Imail\SpamManager\noxmail.exe"         20      0 SPMMGRADULT3       external         <-74   "D:\Imail\SpamManager\noxmail.exe"         20      0   I am currently holding at 25 and deleting at 35.   Please let me know if you need more help with this, as I am one of the original beta testers and helped to design the flexible weighting for Declude.   John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike Gable Sent: Monday, June 23, 2003 10:22 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SpamManager test   Hi,   I've got SpamManager running as a test only in Declude, and while it catches nearly everything SPAM it also has a lot of false positives, so I was wondering if I could create specific HEADER tests with different actions taken based on the SpamManager points system results. A SpamManager header looks like this:   X-CYBERsitter-SpamManager-In: FAILED - Score Adult: 0 (Req: 18) Spam: 68 (Req: 18) Tot: 68 (Req: 25)   For example: HEADERS 30 CONTAINS Score Adult: 25 HEADERS 20 CONTAINS Spam: 40   I am currently running this Test/Action which minimizes false positives, but still lets a lot of Spam through: CYBERSITTER  external   nonzero   "D:\IMail\SpamManager\NoXMail.exe"   10   0   The only thing I don't know is if Declude has already finished with the HEADER tests before it has inserted the Cybersitter header.   Thanks!   Mike