Hi Scott: With this latest build, the log file no longer has "single line" entries for each failed test? I don't have a big problem with that - but we need to make sure that the various makers of Declude Reporting applications (such as DLANALZYER) are made aware of it so that they can re-write their log-parsing!
My log file entries now just look like this: 01/07/2004 09:23:36 Q1665125201ac31f9 BADHEADERS:5 HELOBOGUS:3 SPAMHEADERS:3 . Total weight = 11. 01/07/2004 09:23:36 Q1665125201ac31f9 Subject: Godfrey Rockefeller refill notification from medlinerx.com 01/07/2004 09:23:36 Q1665125201ac31f9 From: [EMAIL PROTECTED] To: [privacy/deleted] IP: 64.135.12.84 ID: 01/07/2004 09:23:36 Q1665125201ac31f9 BADHEADERS=WARN HELOBOGUS=WARN SPAMHEADERS=WARN WEIGHT10=BOUNCEONLYIFYOUMUST The biggest "loss" I see is for badheaders/spamheaders and other non-IP based test. The "IP" based stuff is easy to reconstruct from other sources - but the badheaders/spamheaders "reason codes" were helpful when investigating false-positive reports. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, January 06, 2004 06:54 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] New CMDSPACE test in latest interim release We've just added a new test to the latest interim release, called CMDSPACE. This one looks for spaces in SMTP commands where there shouldn't be any. It is catching about 75% of the spam to the spamtraps here, and since we started using it, only 1 of the approximately 500 legitimate E-mails that came in was caught. It looks like this could be a good test until spammers change their spamware. To use it, you need the latest interim release (from http://www.delude.com/interim ), and need to use the following line in your \IMail\Declude\global.cfg file to define the test: CMDSPACE cmdspace x x 8 0 (where "8" is the weight you want to assign to the test). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
