Done. Now the entries are a lot more interesting.
Thanks, Jason -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Riddle Sent: Tuesday, July 06, 2004 3:00 PM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Anti-spam question You should set your logs to "verbose" (under Services, SMTP) so that you can get meaningful information from them. Be sure to stop/restart SMTP and the Queue Manager server when making changes. At 11:28 AM 7/6/2004, you wrote: >My log entries don't look anything like that. They look like this: > >20040706 001813 127.0.0.1 SMTPD (0374038A) [212.235.49.216] MAIL FROM: ><[EMAIL PROTECTED]> >20040706 001815 127.0.0.1 SMTPD (0374038A) [212.235.49.216] RCPT TO: ><[EMAIL PROTECTED]> >20040706 001838 127.0.0.1 SMTPD (0374038A) [212.235.49.216] >e:\IMail\spool\D28050374038a2df5.SMD 7257 >20040706 001838 127.0.0.1 SMTP (0974185B) processing >e:\IMail\spool\Q28050374038a2df5.SMD >20040706 001838 127.0.0.1 SMTP (0974185B) probability email is spam >0.982904: email is spam >20040706 001838 127.0.0.1 SMTP (0974185B) ldeliver mawdi.com >gdurivage-main (1) [EMAIL PROTECTED] 7290 > > >Then it processes the next message. > >Jason > > > > >-----Original Message----- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED] On Behalf Of Dave Riddle >Sent: Tuesday, July 06, 2004 1:42 PM >To: [EMAIL PROTECTED] >Subject: RE: [IMail Forum] Anti-spam question > > >Of course it will continue the delivery because the email was found to >be good and not spam. You should have included the full log entry so >that we can see if that particular filter is even running. From what >you provided it does not look like it checked any words to determine a >"Statistical Probability" > >Here is what a log entry will look like for an email identified as >spam. >---------- >07:06 01:31 SMTP(600e088d01106dcb) The following words were used to compute >the probability email is spam >07:06 01:31 SMTP(600e088d01106dcb) word = deaden, probability = 0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = endomorphism, probability = >0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = machination, probability = >0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = headpiece, probability = >0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = hadnt, probability = 0.010000 >07:06 01:31 SMTP(600e088d01106dcb) word = danube, probability = 0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = accentual, probability = >0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = construe, probability = 0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = adsorptive, probability = >0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = cyst, probability = 0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = vacuolate, probability = >0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = libelous, probability = 0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = manikin, probability = 0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = dilapidate, probability = >0.990000 >07:06 01:31 SMTP(600e088d01106dcb) word = abrade, probability = 0.990000 >07:06 01:31 SMTP(600e088d01106dcb) probability email is spam 1.000000: >email is spam >---------- >This particular test is bad for false positives as it using the generic URL >Blacklist supplied by Ipswitch. I would really recommend against deleting >mail just for failing those two tests. > >Of the false positives that I show (going back to 6-25 - earlier than >that have been deleted) I see the following: > >Connection Test: 0 >Statisical Test: 3 >Content Test: 1 >Ipswitch URL Test: 20 > >At 10:10 AM 7/6/2004, you wrote: > >I have it set to delete. > > > >Here is a log entry: > >20040706 130126 127.0.0.1 SMTP (0474003F) probability email is spam > >0.000000: email is good > >It continues the delivery anyway. > > > >If there is another log entry, or a setting, or an Ipswitch update, > >that I am missing I'd love to know! I'm going crazy going over and > >over these config's and I'm finding nothing wrong. > > > >Thanks, > >Jason > > > >-----Original Message----- > >From: [EMAIL PROTECTED] > >[mailto:[EMAIL PROTECTED] On Behalf Of Laura > >Bhandari > >Sent: Tuesday, July 06, 2004 1:00 PM > >To: [EMAIL PROTECTED] > >Subject: RE: [IMail Forum] Anti-spam question > > > > > > > >RE: "...the log entries show me that it is examining the messages, > >but it won't delete a message if it determines that it is spam." > > > >At the bottom of the content filtering tab, where it is labeled > >"action to be taken on email..." - what do you have in the options? > > > > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > >List Archive: > >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > >List Archive: > >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >List Archive: >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >List Archive: >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
