|
Hey Scott,
This is really a question for you about JM.
The JM log file lists "passed" messages as "L1 Message OK", so it's only the
failed messages that list the actual tests failed. However, isn't
catchallmails supposed to fail for all messages? So it must be the JM
ignores the catchallmails failure when listing a message as "OK." Is this
understanding correct?
I'm just trying to understand the behavior in the
log files. Should all "failed" messages always list catchallmails?
If so, does that mean the a count of the number of catchallmails-failed messages
in the log should equal the number of messages that failed some (other)
test? For example, if I have a log of 10,000 messages, and I know that
7,000 of them list the catchallmails option in their list of failed messages,
that should mean there were 7,000 messages (70%) that failed some other
test.
Thanks,
Ben
BC Web
----- Original Message -----
Sent: Thursday, March 03, 2005 12:15
PM
Subject: Re: [Declude.JunkMail]
catchallmails question
Thanks, Darrell. This at least sets me on
the right path. I don't believe "Whitelist AUTH" is something we use
because we're running IMail 7.15, which, I believe, doesn't support that
option. However, there must be other,similar causes for being
skipped.
So, does anyone know a list of reasons why
messages would be skipped? Obviously, a whitelist of address, domains,
and IPs, would be one possibility.
For that matter, does anyone have a utility that
would analyze messages being skipped? It would seem an obvious thing to
review, in case a whitelisted source (AUTH, address, etc.) becomes
hijacked. Perhaps this would be a good addition for
DLAnalyzer.
Ben
----- Original Message -----
Sent: Wednesday, March 02, 2005 6:56
PM
Subject: Re: [Declude.JunkMail]
catchallmails question
Ben,
There are various conditions that can account
for messages being picked up without being marked with the "CATCHALLMAILS"
test. A good bulk of these instances occur because a message under
certain conditions will not log a "Test failed" line.
One example is "Whitelist AUTH" in this
particular example the only line that is logged in the Declude log for that
particular message is this.
02/28/2004 00:01:59 Q573700001524c9ad Skipping
E-mail from authenticated user [EMAIL PROTECTED];
whitelisted.
In regards to DLAnalyzer it will count this as
a message (as it should), but there will be no tests associated with it like
"catchallmails" because the "Tests failed" line is not logged. There
are other situations where this also occurs, but that one stuck into my
head.
Hope that helps.
Darrell
------------------------------------------- Check out http://www.invariantsystems.com
for utilities for Declude And Imail. IMail/Declude Overflow Queue
Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers.
----- Original Message -----
Sent: Wednesday, March 02, 2005 7:54
PM
Subject: [Declude.JunkMail]
catchallmails question
Hi,
I have a strange question, which once against
my astounding ignorance. I just tried using DLAnalyzer Lite on our
latest Declude JM log. For the sample I tested, I got these
results:
Total Messages Processed: 11,234
Messages
That Failed Defined Test(s): 10,153
Percentage That Failed Defined
Test(s): 90.38%
Average Message Weight: 4
Average Message
Weight/Failed: 5
TEST
# FAILED
Percentage
WEIGHT10...........6,308.......56.15%
CATCHALLMAILS......5,393.......48.01%
NOLEGITCONTENT.....4,361.......38.82%
IPNOTINMX..........4,237.......37.72%
WEIGHT5............3,856.......34.32%
WEIGHT10S..........3,564.......31.73%
WEIGHT20...........3,509.......31.24%
WEIGHT7............3,465.......30.84%
SNIFFER............3,451.......30.72%
SPAMCOP............3,006.......26.76%
You can ignore the Weight tests; those are
just weight ranges and not real tests. Here's the thing:
Catchallmails also is not a real test; it's supposed to catch all
emails. So why doesn't the Catchallmails statistic above show
100%? The system is telling me that Catchallmails only caught
48%.
I should mention that Catchallmails comes in
the global.cfg file after the regular tests, and after the weight ranges,
but before a handful of whitelisted IPs.
Help, please?
Ben
BC Web
|
