|
Thanks, Darrell. This at least sets me on the
right path. I don't believe "Whitelist AUTH" is something we use because
we're running IMail 7.15, which, I believe, doesn't support that option.
However, there must be other,similar causes for being skipped.
So, does anyone know a list of reasons why messages
would be skipped? Obviously, a whitelist of address, domains, and IPs,
would be one possibility.
For that matter, does anyone have a utility that
would analyze messages being skipped? It would seem an obvious thing to
review, in case a whitelisted source (AUTH, address, etc.) becomes
hijacked. Perhaps this would be a good addition for
DLAnalyzer.
Ben
----- Original Message -----
Sent: Wednesday, March 02, 2005 6:56
PM
Subject: Re: [Declude.JunkMail]
catchallmails question
Ben,
There are various conditions that can account for
messages being picked up without being marked with the "CATCHALLMAILS"
test. A good bulk of these instances occur because a message under
certain conditions will not log a "Test failed" line.
One example is "Whitelist AUTH" in this
particular example the only line that is logged in the Declude log for that
particular message is this.
02/28/2004 00:01:59 Q573700001524c9ad Skipping
E-mail from authenticated user [EMAIL PROTECTED];
whitelisted.
In regards to DLAnalyzer it will count this as a
message (as it should), but there will be no tests associated with it like
"catchallmails" because the "Tests failed" line is not logged. There are
other situations where this also occurs, but that one stuck into my
head.
Hope that helps.
Darrell
------------------------------------------- Check out http://www.invariantsystems.com for
utilities for Declude And Imail. IMail/Declude Overflow Queue
Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers.
----- Original Message -----
Sent: Wednesday, March 02, 2005 7:54
PM
Subject: [Declude.JunkMail]
catchallmails question
Hi,
I have a strange question, which once against
my astounding ignorance. I just tried using DLAnalyzer Lite on our
latest Declude JM log. For the sample I tested, I got these
results:
Total Messages Processed: 11,234
Messages
That Failed Defined Test(s): 10,153
Percentage That Failed Defined
Test(s): 90.38%
Average Message Weight: 4
Average Message
Weight/Failed: 5
TEST
# FAILED
Percentage
WEIGHT10...........6,308.......56.15%
CATCHALLMAILS......5,393.......48.01%
NOLEGITCONTENT.....4,361.......38.82%
IPNOTINMX..........4,237.......37.72%
WEIGHT5............3,856.......34.32%
WEIGHT10S..........3,564.......31.73%
WEIGHT20...........3,509.......31.24%
WEIGHT7............3,465.......30.84%
SNIFFER............3,451.......30.72%
SPAMCOP............3,006.......26.76%
You can ignore the Weight tests; those are just
weight ranges and not real tests. Here's the thing: Catchallmails also
is not a real test; it's supposed to catch all emails. So why doesn't
the Catchallmails statistic above show 100%? The system is telling me
that Catchallmails only caught 48%.
I should mention that Catchallmails comes in
the global.cfg file after the regular tests, and after the weight ranges,
but before a handful of whitelisted IPs.
Help, please?
Ben
BC Web
|
