Matt
Andy Schmidt wrote:
Hi Scott:
With this latest build, the log file no longer has "single line" entries for each failed test? I don't have a big problem with that - but we need to make sure that the various makers of Declude Reporting applications (such as DLANALZYER) are made aware of it so that they can re-write their log-parsing!
My log file entries now just look like this:
01/07/2004 09:23:36 Q1665125201ac31f9 BADHEADERS:5 HELOBOGUS:3 SPAMHEADERS:3
. Total weight = 11.
01/07/2004 09:23:36 Q1665125201ac31f9 Subject: Godfrey Rockefeller refill
notification from medlinerx.com
01/07/2004 09:23:36 Q1665125201ac31f9 From: [EMAIL PROTECTED] To:
[privacy/deleted] IP: 64.135.12.84 ID: 01/07/2004 09:23:36 Q1665125201ac31f9 BADHEADERS=WARN HELOBOGUS=WARN
SPAMHEADERS=WARN WEIGHT10=BOUNCEONLYIFYOUMUST
The biggest "loss" I see is for badheaders/spamheaders and other non-IP based test. The "IP" based stuff is easy to reconstruct from other sources - but the badheaders/spamheaders "reason codes" were helpful when investigating false-positive reports.
Best Regards Andy Schmidt
Phone: +1 201 934-3414 x20 (Business)
Fax: +1 201 934-9206
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, January 06, 2004 06:54 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] New CMDSPACE test in latest interim release
We've just added a new test to the latest interim release, called CMDSPACE. This one looks for spaces in SMTP commands where there shouldn't be any.
It is catching about 75% of the spam to the spamtraps here, and since we started using it, only 1 of the approximately 500 legitimate E-mails that came in was caught. It looks like this could be a good test until spammers change their spamware.
To use it, you need the latest interim release (from http://www.delude.com/interim ), and need to use the following line in your \IMail\Declude\global.cfg file to define the test:
CMDSPACE cmdspace x x 8 0
(where "8" is the weight you want to assign to the test).
-Scott
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
