Yes, they correspond. I checked the name, Q8b540ec.SMD, etc. Same in both spam review and the log file. That's how I found the specific log file entry.
This is only happening for this one email address: [EMAIL PROTECTED] Thanks, Andy ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, November 28, 2003 1:46 PM Subject: Re: [Declude.JunkMail] holding not deleting > > >I'm holding on 7, deleting on 14 (I didn't change the labels on the tests, > >they still say WEIGHT10 for HOLD and WEIGHT20 for DELETE). > > Are you sure? > > >X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10. > > This line in the headers means that Declude JunkMail used the WARN action > for the WEIGHT10 test. But: > > >Log file entry > >11/28/2003 12:52:24 Q8b540ec MYFILTER:11 . Total weight = 11 > >11/28/2003 12:52:24 Q8b540ec Msg failed IPNOTINMX (). Action=WARN. > >11/28/2003 12:52:24 Q8b540ec Msg failed MYFILTER (Message failed MYFILTER > >test (17)). Action=WARN. > >11/28/2003 12:52:24 Q8b540ec Msg failed WEIGHT10 (Weight of 11 reaches or > >exceeds the limit of 7.). Action=HOLD. > >11/28/2003 12:52:24 Q8b540ec Subject: Learn a new Language in 10 days > >11/28/2003 12:52:24 Q8b540ec From: > >[EMAIL PROTECTED] To: > >[EMAIL PROTECTED] > > This shows that it used the HOLD action. Are you *positive* that these log > file entries correspond with that E-mail? > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
