Re: [Declude.JunkMail] FYI on SKIPIFWEIGHT

[Matt]

Here's how this works if I'm in fact correct.  There are two scoring columns in Declude, the first is scored if a test fails, the second is scored if a test is not failed.  It sounds like the SKIPIFWEIGHT works on the cumulative value of the first column only.  Most don't use the second column except for crediting points with IPNOTINMX and NOLEGITCONTENT when they don't fail, though one could use this in any type of test it would seem.  So if you credited 2 points when the IP is in the MX record, and 2 points when legitimate content is detected, then you should increase your SKIPIFWEIGHT value by 4 points.  So if the weight used in the calculation of SKIPIFWEIGHT had reached 25 by the last custom filter, and your SKIPIFWEIGHT was set to 25, that filter would be skipped, but if that message also was to get credit from nIPNOTINMX and nNOLEGITCONTENT, then the the final weight would be 21. You can protect from disabling filters prematurely by increasing the SKIPIFWEIGHT value by the corresponding scores of such tests, or alternatively, you can construct custom filters that credit the points in the first column by using the TESTSFAILED variable and setting the built-in test to a zero score like so: IPNOTINMX        ipnotinmx    x    x    0    0 IPINMX                filter        C:\IMail\Declude\Filters\IPInMX.txt            x    -1    0 ----- IPInMX.txt ----- TESTSFAILED    END    CONTAINS    IPNOTINMX REMOTEIP          0          CONTAINS   . I was already doing this and that's why I wasn't noticing the effect on my system.  I had made the change because when you use the last column, the WARN action doesn't work for the test so you get points credited without a sign in the headers (if you mark the headers the way that I do).  This might have been changed since I did this, but the above will also solve the SKIPIFWEIGHT issue. Matt Scott Fisher wrote: I'm confused. And it's always been a subject that confuses me. How about an example... Mail fails SBL for 100 weight. Mail fails revdns-whitelist filter which adds a -200 weight. So net weight at this time is -100. Next filter has a skipifweight 75. Would the filter get skipped or processed? ---------- Original Message ---------------------------------- From: "R. Scott Perry" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Tue, 16 Nov 2004 18:53:41 -0500 The SKIPIFWEIGHT option attempts to calculate the weight with the information it has. It will add the weights for any tests that have already been run and failed, but will not consider negative weights. Are you saying that SKIPIFWEIGHT completely ignores any test that passes a negative value? It ignores weights that are used if an E-mail does *not* pass a test (for example, the NOLEGITCONTENT/IPNOTINMX tests work in this "backwards" way). It does not ignore weights that are below zero. In other words the positive accrued value say for example on a particular email is 100. A compensatory filter for this email scores it with a -300. The net effect [%WEIGHT%] after both tests are run is +100? The actual weight is the same, regardless of whether SKIPIFWEIGHT is used. We're just talking about the weight that the SKIPIFWEIGHT option sees, which may differ from the actual weight of the E-mail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. ---- This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================