I can see that from 100 messages that fail CMDSPACE 75 are legit messages. I don't know if this is something interesting but nearly all of this FPs are replies or forwardings (RE:, FW:, AW:, I:, ...) and was send from tipical client software (Outlook)
I've noted also that certain messages shows up in the log file with CMDSPACE=IGNORE Example: Legit message 01/07/2004 14:40:57 Q0c550499006ed771 REVDNS:20 CMDSPACE:8 . Total weight = 28. 01/07/2004 14:40:57 Q0c550499006ed771 R1 Message OK 01/07/2004 14:40:57 Q0c550499006ed771 Subject: RE: hidden subject 01/07/2004 14:40:57 Q0c550499006ed771 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 123.123.123.123 ID: 01/07/2004 14:40:57 Q0c550499006ed771 REVDNS=WARN CMDSPACE=IGNORE One minute later (the $junkmail file has in both cases "CMDSPACE WARN") I can see CMDSPACE=WARN Example: Legit message 01/07/2004 14:39:44 Q0c0f048b0050c5d2 REVDNS:20 CMDSPACE:8 SPAMCHK:10 ISDATE-EUR:-10 ISDATE-EN:-10 . Total weight = 18. 01/07/2004 14:39:44 Q0c0f048b0050c5d2 L1 Message OK 01/07/2004 14:39:44 Q0c0f048b0050c5d2 Subject: I: hidden subject 01/07/2004 14:39:44 Q0c0f048b0050c5d2 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 123.123.123.123 ID: 01/07/2004 14:39:44 Q0c0f048b0050c5d2 REVDNS=WARN CMDSPACE=WARN SPAMCHK=WARN ISDATE-EUR=WARN ISDATE-EN=WARN In both cases the 8 points for the CMDSPACE test was added to the total weight. At the moment I have no mail headers from a FP message. ============= Another question: After switching from the latest beta to this interim release I've noted also a different logfile format. Before there was more lines using the MID loglevel: Spam message: 01/07/2004 08:53:56 Qbaf8018a007a00fc DSBL:30 SPAMCOP:35 FIVETEN-SRC:10 SPAMCHK:55 BLKLST-URL60:80 BLKLST-COUNTRY:5 . Total weight = 215. 01/07/2004 08:53:56 Qbaf8018a007a00fc Msg failed DSBL (http://dsbl.org/listing?ip=68.65.42.163). Action=WARN. 01/07/2004 08:53:56 Qbaf8018a007a00fc Msg failed SPAMCOP (Blocked - see http://www.spamcop.net/bl.shtml?68.65.42.163). Action=WARN. 01/07/2004 08:53:56 Qbaf8018a007a00fc Msg failed FIVETEN-SRC (163.42.65.68.blackholes.five-ten-sg.com.). Action=WARN. 01/07/2004 08:53:56 Qbaf8018a007a00fc Msg failed SPAMCHK (Message failed SPAMCHK: 55.). Action=WARN. 01/07/2004 08:53:56 Qbaf8018a007a00fc Msg failed BLKLST-URL60 (Message failed BLKLST-URL60 test (line 110, weight 30)). Action=IGNORE. 01/07/2004 08:53:56 Qbaf8018a007a00fc Msg failed BLKLST-COUNTRY (Message failed BLKLST-COUNTRY test (line 226, weight 5)). Action=IGNORE. 01/07/2004 08:53:56 Qbaf8018a007a00fc Msg failed WEIGHT75 (Weight of 215 reaches or exceeds the limit of 75.). Action=SUBJECT. 01/07/2004 08:53:56 Qbaf8018a007a00fc Msg failed WEIGHT100 (Weight of 215 reaches or exceeds the limit of 100.). Action=HOLD. 01/07/2004 08:53:56 Qbaf8018a007a00fc Subject: Re: LZLYC, conversation was going 01/07/2004 08:53:56 Qbaf8018a007a00fc From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 68.65.42.163 ID: Now this looks like: 01/07/2004 15:52:19 Q1d0f0191002a2d07 DSBL:30 SPAMCOP:35 BASE64:40 REVDNS:20 CMDSPACE:100 SPAMCHK:183 . Total weight = 408. 01/07/2004 15:52:19 Q1d0f0191002a2d07 Subject: Best selling for 2003 01/07/2004 15:52:19 Q1d0f0191002a2d07 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 81.11.159.22 ID: 01/07/2004 15:52:19 Q1d0f0191002a2d07 DSBL=WARN SPAMCOP=WARN BASE64=WARN REVDNS=WARN CMDSPACE=IGNORE SPAMCHK=WARN WEIGHT75=SUBJECT WEIGHT100=HOLD Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
