I'm just curious... Wouldn't the following work for the intended purpose (in this case)...
NOTSNIFFED external 0 "....." ... Specifically - an external test that fails on a zero result should work right Scott? _M On Monday, May 31, 2004, 7:01:50 PM, Matt wrote: M> I believe that MINWEIGHT 15 always exits the filter since it startswith a score of zero. M> If Andrew's suggestion doesn't work for your purposes, there's M> likely akludge that can be written with multiple filter files that M> can do this. M> Matt M> Andy Schmidt wrote: M> Hi Matt: M> � M> Uh - I see.� We would need a"SKIPIFWEIGHTLESS" option.� Scott? M> � M> But - I still don't understand why I don'tsee lots of entries M> for "NOTSNIFFed".� If anything, now I should seelots of legitimate M> mail "match" that test? M> Best Regards M> Andy Schmidt M> H M Systems Software, Inc. M> 600 East Crescent Avenue, Suite 203 M> Upper Saddle River, NJ 07458-1846 M> Phone:� +1 201 934-3414x20 (Business) M> Fax:��� +1 201 934-9206 M> http://www.HM-Software.com/ M> -----Original Message----- M> M> From:[EMAIL PROTECTED]:[EMAIL PROTECTED] M> On Behalf Of Matt M> Sent: Monday, May 31, 2004 06:18 PM M> To:[EMAIL PROTECTED] M> Subject: Re: [Declude.JunkMail] Detect "Test NOT Failed" M> Andy, M> That's not how MINWEIGHT works.� MINWEIGHT is used for a filter M> so thatit doesn't subtract any more than the value that you give M> it, generallya negative number unless you get fancy and apply M> scoring tests first. M> The only way to do this currently would be to create an M> external testto run after Sniffer which passes in the %WEIGHT% M> variable. M> Matt M> Andy Schmidt wrote: M> Hi, M> � M> I'mtrying to detect mails weight >= 15 that did NOT fail "Sniffer". M> � M> Ihave: M> � M> Global.cfg: M> � M> SNIFFER �external M> �nonzero"D:\IMAIL\Sniffer\Win32\????????.exe ?????"�4�0 M> SNIFFER-SNAKE�external M> �052�"D:\IMAIL\Sniffer\Win32\????????.exe?????"�1�0 M> SNIFFER-SCAMS �external M> �053�"D:\IMAIL\Sniffer\Win32\????????.exe?????"�2�0 M> SNIFFER-PORN�external M> �054�"D:\IMAIL\Sniffer\Win32\????????.exe?????"�2�0 M> SNIFFER-MALWARE�external M> �055�"D:\IMAIL\Sniffer\Win32\????????.exe?????"�2�0 M> SNIFFER-OBFUSC �external M> �061�"D:\IMAIL\Sniffer\Win32\????????.exe?????"�2�0 M> � M> NOTSNIFFed�filter��D:\IMail\Declude\NOTSNIFFEDfilter.txt�x�0�0 M> � M> In"NOTSNIFFEDfilter.txt" M> � M> MINWEIGHT�15 M> TESTSFAILED�END�CONTAINS SNIFFER M> REMOTEIP�0�CONTAINS . M> � M> Yet,the log doesn't show "NOTSNIFFed": M> � M> 05/31/2004 17:48:59 Qa83f230c00e4d595SPAMCOP:7 XBL-DYNA:7 M> HELOBOGUS:3 REVDNS:5 SPAMROUTING:4 .� Total weight= 26. M> 05/31/2004 17:48:59 Qa83f230c00e4d595 Bypassing whitelisting of M> E-mailwith weight >=19 (26) and at least 1 recipients (7). M> 05/31/2004 17:48:59 Qa83f230c00e4d595 Bypassing whitelisting of M> E-mailwith weight >=14 (26) and at least 4 recipients (7). M> 05/31/2004 17:48:59 Qa83f230c00e4d595 Bypassing whitelisting of M> E-mailwith weight >=12 (26) and at least 6 recipients (7). M> 05/31/2004 17:48:59 Qa83f230c00e4d595 Deleting spam from M> [EMAIL PROTECTED] to [EMAIL PROTECTED] M> 05/31/2004 17:48:59 Qa83f230c00e4d595 From: [EMAIL PROTECTED] M> To: [EMAIL PROTECTED] IP: 61.73.93.27 ID: M> 05/31/2004 17:48:59 Qa83f230c00e4d595 Tests failed M> [weight=26]:BYPASS19=IGNORE BYPASS14=IGNORE BYPASS12=IGNORE M> SPAMCOP=WARNNJABLDYNA=LOG SORBS=WARN SORBS-DUHL=LOG XBL-DYNA=IGNORE M> HELOBOGUS=WARNIPNOTINMX=IGNORE REVDNS=ALERT SPAMROUTING=WARN M> NOLEGITCONTENT=IGNOREWEIGHTKILL=DELETE M> 05/31/2004 17:48:59 Qa83f230c00e4d595 Deleting spam from M> [EMAIL PROTECTED] to M> [EMAIL PROTECTED]@alloysinternational.com M> Best Regards M> Andy Schmidt M> H M Systems Software, Inc. M> 600 East Crescent Avenue, Suite 203 M> Upper Saddle River, NJ 07458-1846 M> Phone:� +1 201934-3414 x20 (Business) M> Fax:��� +1 201 934-9206 M> http://www.HM-Software.com/ M> � M> -- M> ===================================================== M> MailPure custom filters for Declude JunkMail M> Pro.http://www.mailpure.com/software/===================================================== --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
