Hi,
I'm running my first
few tests.
ISSUE 1 -
Mail Headers
My mail headers now include
X-Declude-RefID:
I never requested
that header in my config file!
ISSUE 2 -
Log Files
LOGLEVEL MID and
HIGH is no longer recording messages in the DEC*.log. (The message was a
whitelisted message.)
The virus log still
works:
10/17/2006
16:35:25.155 q3e8a0136000000f7.smd Log Level set to MID
10/17/2006 16:35:25.170 q3e8a0136000000f7.smd Vulnerability flags = 0
10/17/2006 16:35:26.264 q3e8a0136000000f7.smd Virus scanner 1 reports exit code of 0
10/17/2006 16:39:20.270 q3f770136000000fd.smd Vulnerability flags = 0
10/17/2006 16:39:21.255 q3f770136000000fd.smd Virus scanner 1 reports exit code of 0
10/17/2006 17:00:35.428 q446e013600000114.smd Vulnerability flags = 0
10/17/2006 17:00:36.444 q446e013600000114.smd Virus scanner 1 reports exit code of 0
10/17/2006 17:03:15.557 q4510013600000119.smd Vulnerability flags = 0
10/17/2006 17:03:16.557 q4510013600000119.smd Virus scanner 1 reports exit code of 0
10/17/2006 17:05:00.685 q457801360000011c.smd Vulnerability flags = 0
10/17/2006 17:05:01.685 q457801360000011c.smd Virus scanner 1 reports exit code of 0
10/17/2006 16:35:25.170 q3e8a0136000000f7.smd Vulnerability flags = 0
10/17/2006 16:35:26.264 q3e8a0136000000f7.smd Virus scanner 1 reports exit code of 0
10/17/2006 16:39:20.270 q3f770136000000fd.smd Vulnerability flags = 0
10/17/2006 16:39:21.255 q3f770136000000fd.smd Virus scanner 1 reports exit code of 0
10/17/2006 17:00:35.428 q446e013600000114.smd Vulnerability flags = 0
10/17/2006 17:00:36.444 q446e013600000114.smd Virus scanner 1 reports exit code of 0
10/17/2006 17:03:15.557 q4510013600000119.smd Vulnerability flags = 0
10/17/2006 17:03:16.557 q4510013600000119.smd Virus scanner 1 reports exit code of 0
10/17/2006 17:05:00.685 q457801360000011c.smd Vulnerability flags = 0
10/17/2006 17:05:01.685 q457801360000011c.smd Virus scanner 1 reports exit code of 0
But, for those
messages, the Declude Junkmail no longer have any entries - unless I
set LOGLEVEL DEBUG. The only message that has log entires for Declude
Junkmail is messageID q446e013600000114, because I had set log level to DEBUG
for that:
10/17/2006
16:35:25.155 q3e8a0136000000f7.smd Declude v4.3.14 for IMail
10/17/2006 17:00:35.428 q446e013600000114.smd CFG: Bypassing IP 63.107.174.32.
10/17/2006 17:00:35.428 q446e013600000114.smd CFG: Bypassing IP 65.119.204.32.
10/17/2006 17:00:35.428 q446e013600000114.smd CFG: Bypassing IP 67.132.45.18.
10/17/2006 17:00:35.428 q446e013600000114.smd CFG: Bypassing IP 127.0.0.1.
10/17/2006 17:00:35.428 q446e013600000114.smd CFG: Set hop to 0.
10/17/2006 17:00:35.428 q446e013600000114.smd STOPPROCESSINGONFIRSTDELETE: Set to ON
10/17/2006 17:00:35.428 q446e013600000114.smd Setting AUTOWHITELIST to ON
10/17/2006 17:00:35.428 q446e013600000114.smd CFG: Whitelisting AUTH .
10/17/2006 17:00:35.428 q446e013600000114.smd CFG: Bypassing IP 63.107.174.32.
10/17/2006 17:00:35.428 q446e013600000114.smd CFG: Bypassing IP 65.119.204.32.
10/17/2006 17:00:35.428 q446e013600000114.smd CFG: Bypassing IP 67.132.45.18.
10/17/2006 17:00:35.428 q446e013600000114.smd CFG: Bypassing IP 127.0.0.1.
10/17/2006 17:00:35.428 q446e013600000114.smd CFG: Set hop to 0.
10/17/2006 17:00:35.428 q446e013600000114.smd STOPPROCESSINGONFIRSTDELETE: Set to ON
10/17/2006 17:00:35.428 q446e013600000114.smd Setting AUTOWHITELIST to ON
10/17/2006 17:00:35.428 q446e013600000114.smd CFG: Whitelisting AUTH .
more debug
lines...
10/17/2006
17:00:40.897 q446e013600000114.smd Test #26 [SORBS] is same as Test #33
[SORBS-ZOMBIE=127.0.0.9]. Answer=dns.isux.com.?
10/17/2006 17:00:40.897 q446e013600000114.smd Last line of headers checking for Recived: X-Auth: Yes
10/17/2006 17:00:40.897 q446e013600000114.smd Skipping4 E-mail from IP 63.107.174.136; whitelisted (63.107.174.0/24). nm=ffffff00
10/17/2006 17:00:40.897 q446e013600000114.smd AlterMessage
10/17/2006 17:00:40.897 q446e013600000114.smd Subject = []
10/17/2006 17:00:40.897 q446e013600000114.smd Warning = [X-Declude-RefID:
10/17/2006 17:00:40.897 q446e013600000114.smd Last line of headers checking for Recived: X-Auth: Yes
10/17/2006 17:00:40.897 q446e013600000114.smd Skipping4 E-mail from IP 63.107.174.136; whitelisted (63.107.174.0/24). nm=ffffff00
10/17/2006 17:00:40.897 q446e013600000114.smd AlterMessage
10/17/2006 17:00:40.897 q446e013600000114.smd Subject = []
10/17/2006 17:00:40.897 q446e013600000114.smd Warning = [X-Declude-RefID:
X-Declude: Version
4.3.14; D446e013600000114.smd from corner-office.usa.hm-software.com
[63.107.174.136]
X-Declude: Code
0
X-Declude: Triggered
[0] Whitelisted
X-Countries:
Return-Path: <[EMAIL PROTECTED]>
]
10/17/2006 17:00:40.897 q446e013600000114.smd Header = []
10/17/2006 17:00:40.897 q446e013600000114.smd Footer = []
10/17/2006 17:00:40.897 q446e013600000114.smd MoveFile in AlterMessage - datafile = [D:\IMail\spool\proc\work\D446e013600000114.smd] TempFile = [D:\IMail\spool\proc\work\D446e013600000114.sm$]
10/17/2006 17:00:40.897 q446e013600000114.smd Adding warning [X-Declude-RefID:
10/17/2006 17:00:40.897 q446e013600000114.smd Header = []
10/17/2006 17:00:40.897 q446e013600000114.smd Footer = []
10/17/2006 17:00:40.897 q446e013600000114.smd MoveFile in AlterMessage - datafile = [D:\IMail\spool\proc\work\D446e013600000114.smd] TempFile = [D:\IMail\spool\proc\work\D446e013600000114.sm$]
10/17/2006 17:00:40.897 q446e013600000114.smd Adding warning [X-Declude-RefID:
X-Declude: Version
4.3.14; D446e013600000114.smd from corner-office.usa.hm-software.com
[63.107.174.136]
X-Declude: Code
0
X-Declude: Triggered
[0] Whitelisted
X-Countries:
Return-Path: <[EMAIL PROTECTED]>
]
10/17/2006 17:00:40.897 q446e013600000114.smd TempFile = [D:\IMail\spool\proc\work\D446e013600000114.sm$]
10/17/2006 17:00:40.897 q446e013600000114.smd TempFile = [D:\IMail\spool\proc\work\D446e013600000114.sm$] was deleted
10/17/2006 17:00:40.897 q446e013600000114.smd passiton set - args [D:\IMail\spool\proc\work\q446e013600000114.smd]
10/17/2006 17:00:40.897 q446e013600000114.smd Attempting to move files to spool
10/17/2006 17:00:40.897 q446e013600000114.smd Files successfully moved back to spool
10/17/2006 17:00:40.897 q446e013600000114.smd Passing to SMTP32: D:\IMAIL\smtp32.exe D:\IMail\spool\q446e013600000114.smd.
10/17/2006 17:00:40.897 q446e013600000114.smd TempFile = [D:\IMail\spool\proc\work\D446e013600000114.sm$]
10/17/2006 17:00:40.897 q446e013600000114.smd TempFile = [D:\IMail\spool\proc\work\D446e013600000114.sm$] was deleted
10/17/2006 17:00:40.897 q446e013600000114.smd passiton set - args [D:\IMail\spool\proc\work\q446e013600000114.smd]
10/17/2006 17:00:40.897 q446e013600000114.smd Attempting to move files to spool
10/17/2006 17:00:40.897 q446e013600000114.smd Files successfully moved back to spool
10/17/2006 17:00:40.897 q446e013600000114.smd Passing to SMTP32: D:\IMAIL\smtp32.exe D:\IMail\spool\q446e013600000114.smd.
Here is my
Global.CFG
LOGFILE Spool\dec####.log
LOGLEVEL HIGH
#LOGFILE Spool\decX####.log
#LOGLEVEL DEBUG
LOGLEVEL HIGH
#LOGFILE Spool\decX####.log
#LOGLEVEL DEBUG
#PID / PID DEBUG
#EVENTLOG ON
#LOG_OK NONE
#LOG_OK NONE
Issue 3 Incorrect Phone Number
Your auto-response system sends out a three
paragraph notice - the last paragraph has an incorrect phone
number:
>> Call customer care 866-332-5822 #3
to purchase or renew a service agreement. <<
Issue 4 Declude appends its headers BELOW the content of an
email
While Imail is able to insert the
header at the correct location, Declude appends it headers at the
bottom. That explains why some email seem to "bypass" Declude. Depending on
the message format you might not even see any email headers (e.g.,
for HTML messages)
Best Regards
Andy Schmidt
Phone: +1 201 934-3414 x20 (Business)
Fax: +1 201 934-9206
Best Regards
Andy Schmidt
Phone: +1 201 934-3414 x20 (Business)
Fax: +1 201 934-9206
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
