Actually this one was from John.
 
On 01/28/03 6:50pm you wrote...
>Thanks Brian.
>
>Mark
>
>
>At 02:27 PM 1/28/2003, you wrote:
>
>>Mark, I will put together an information sheet together, as I have even 
>>changed it a bit since I wrote the one up before that Brian is using.
>>
>>
>>
>>Give me a day or so.
>>
>>
>>
>>John Tolmachoff  MCSE, CSSA
>>
>>IT Manager, Network Engineer
>>
>>211 E. Imperial Hwy, Suite 106
>>
>>Fullerton, CA  92835
>>
>>562-694-4800, ext. 104
>>
>><mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED]
>>
>>www.reliancesoft.com
>>
>>
>>
>>
>>
>>-----Original Message-----
>>From: [EMAIL PROTECTED] 
>>[mailto:[EMAIL PROTECTED]] On Behalf Of Mark Seagroves
>>Sent: Tuesday, January 28, 2003 1:35 PM
>>To: [EMAIL PROTECTED]
>>Subject: RE: [NoXMail] filtering working intermittently?
>>
>>
>>
>>John,
>>
>>Are you referring to the Declude global.cfg settings?  If so, I've never 
>>been clear on how these work.  Any light you could shed on this would be 
>>appreciated (specifically the interaction between declude and noxmail).
>>
>>Thanks.
>>
>>Mark
>>
>>
>>At 12:26 PM 1/28/2003, you wrote:
>>
>>
>>Mark, I would recommend changing from using 2 weight tests to using a 
>>combination of weightrange and weight.
>>
>>
>>
>>WEIGHTRANGE10-19  WEIGHTRANGE X X 10 19
>>
>>WEIGHTRANGE20-29  WEIGHTRANGE X X 20 29
>>
>>WEIGHT30               WEIGHT         X X 30 0
>>
>>
>>
>>Having Weight10 and Weight20 and so forth could cause action problems.
>>
>>
>>
>>Not sure if this would cause this, just something I noticed.
>>
>>
>>
>>John Tolmachoff MCSE, CSSA
>>
>>IT Manager, Network Engineer
>>
>>RelianceSoft, Inc.
>>
>>Fullerton, CA  92835
>>
>>www.reliancesoft.com
>>
>>
>>
>>-----Original Message-----
>>From: [EMAIL PROTECTED] 
>>[mailto:[EMAIL PROTECTED]] On Behalf Of Mark Seagroves
>>Sent: Tuesday, January 28, 2003 12:09 PM
>>To: [EMAIL PROTECTED]
>>Subject: [NoXMail] filtering working intermittently?
>>
>>
>>
>>Brian,
>>
>>Since last Thurs or so, noxmail seems to be allowing some adult & spam 
>>e-mails to go through.  I received a couple of calls from users on Friday 
>>that they had received some porn e-mails.  I double-checked all settings 
>>on Sat and finally stopped/restarted the IMail SMTP service.  This seemed 
>>to fix the problem for the moment.  However, yesterday I saw some more 
>>adult/spam messages slip through and I rebooted our e-mail server, again 
>>after checking everything first.  That seemed to cause the filtering to 
>>work properly again.  This morning, I thought I saw some more e-mails slip 
>>through but I sent myself a couple (one "adult" and one "spam") from an 
>>off-campus address and they were filtered correctly.  I currently have all 
>>adult & spam e-mail sent to a spam account.  This account is getting 
>>messages but some are apparently still slipping through.  I just received 
>>a spam e-mail from e-bay.  Below are the spam e-mail header and log 
>>snippet from noxmail.  I can send you the .nox config file or other files 
>>if needed.  I currently have ROUTEADULTSCORE and ROUTESPAMCORE set to 30 
>>to the e-bay message should have been routed.  The spam mailbox did catch 
>>this same e-mail to 7 other recipients (however, the total weight was 40 
>>instead of 45).
>>
>>Any suggestions?
>>
>>Thanks.
>>
>>Mark
>>
>>
>>NOXMAIL log snippet:
>>
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD (OUT) [FAILED SPAM] Scores - 
>>Adult: 0 (Req: 18) Spam: 45 (Req: 18) ExitCode: 45 (Req: 20)
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG TO: <[EMAIL PROTECTED]>
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - ENV TO: <[EMAIL PROTECTED]>
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG FROM: 
>><[EMAIL PROTECTED]>
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG SUBJECT: Don't spend a 
>>fortune, mseagroves!
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Excessive Routing: 3 
>>penalty points added.
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Return address consistent 
>>with SPAM: 1 penalty points added.
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Subject contains variables: 
>>5 penalty points added.
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Found 53 embedded image 
>>links: 14 penalty points added.
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg obfuscation: 12 penalty 
>>points added.
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - 
>>Matched:  (#Spam)MARKETING(2*2) (Spam){UNSUBSCRIBE&SUBJECT}(1*6)
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg processed in: 429ms - 
>>Msg Size: 19300 bytes
>>
>>
>>
>>
>>Mail Header:
>>
>>To: [EMAIL PROTECTED]
>>Subject: [S] Don't spend a fortune, mseagroves!
>>From: "eBay" <[EMAIL PROTECTED]>
>>Date: Tue, 28 Jan 2003 11:29:04 -0800
>>Reply-To: "eBay" <[EMAIL PROTECTED]>
>>X-CYBERsitter-NoXMail: FAILED - Score Adult: 0 (Req: 18) Spam: 45 (Req: 
>>18) Tot: 45 (Req: 20)
>>X-CYBERsitter-SpoolFile: Dda50019700ce4425.SMD
>>X-CYBERsitter-Sender: [EMAIL PROTECTED] [10.1.1.10]
>>X-RBL-Warning: HELOBOGUS: Domain CNCFWblue.cn.edu has no MX or A records.
>>X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam 
>>[4000020e].
>>X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the limit of 10.
>>X-RBL-Warning: WEIGHT20: Weight of 21 reaches or exceeds the limit of 20.
>>X-Declude-Sender: [EMAIL PROTECTED] [10.1.1.10]
>>X-Declude-Spoolname: Dda50019700ce4425.SMD
>>X-Note: This E-mail was scanned for spam.
>>X-Spam-Tests-Failed: HELOBOGUS, IPNOTINMX, SPAMHEADERS, WEIGHT10, 
>>WEIGHT20, CYBERSITTER
>>X-Note: This E-mail was sent from (Private IP) ([10.1.1.10]).
>>X-RCPT-TO: <[EMAIL PROTECTED]>
>>
>>
>>
>>Mark Seagroves                  voice: (865) 471-3506
>>Dir, Campus Computing           fax: (865) 471-3555
>>Asst Prof, Computer Science             e-mail:  [EMAIL PROTECTED]
>>Carson-Newman College
>>
>>
>>Mark Seagroves                  voice: (865) 471-3506
>>Dir, Campus Computing           fax: (865) 471-3555
>>Asst Prof, Computer Science             e-mail:  [EMAIL PROTECTED]
>>Carson-Newman College
>
>
>Mark Seagroves                  voice: (865) 471-3506
>Dir, Campus Computing           fax: (865) 471-3555
>Asst Prof, Computer Science             e-mail:  [EMAIL PROTECTED]
>Carson-Newman College
>
>
>

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Reply via email to