Re: [Declude.JunkMail] Weight values used in Junkmail config
Dan, A couple of excellent tests to try out are Sort Monsters Sniffer and our URI filter plug-in for Declude. Both of those tests can be evaluated for free. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: "Dan Shadix" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 27, 2005 6:36 PM Subject: [Declude.JunkMail] Weight values used in Junkmail config > The config files I originally got with Junkmail use a weight range of > mostly 10 or less for individual tests. I just downloaded 2.06 and it > is the same and contains these lines: > WEIGHT10WARN > WEIGHT14SUBJECT **SPAM** > WEIGHT20HOLD%DATE% > > It appears to me that most of you are using much a much higher scale. I > can see the value of that since it provides more granularity. My > question is, does anyone have configs they are sharing or will share to > get me started. I plan to make some time to work on tuning my config to > catch more spam and it would be nice to not have to start from scratch. > > Thanks all, > > -- > > Dan Shadix > IT Systems Administrator > Terry Reilly Health Services > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Weight values used in Junkmail config
The config files I originally got with Junkmail use a weight range of mostly 10 or less for individual tests. I just downloaded 2.06 and it is the same and contains these lines: WEIGHT10WARN WEIGHT14SUBJECT **SPAM** WEIGHT20HOLD%DATE% It appears to me that most of you are using much a much higher scale. I can see the value of that since it provides more granularity. My question is, does anyone have configs they are sharing or will share to get me started. I plan to make some time to work on tuning my config to catch more spam and it would be nice to not have to start from scratch. Thanks all, -- Dan Shadix IT Systems Administrator Terry Reilly Health Services --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Multiple log lines per message
Kris, The R and L represent Remote and Local, respectively. From these log lines, it appears that there are in fact two recipients (maybe one of them is the copyall account). If you set your LOGLEVEL to DEBUG and send a similar message to a single recipient, the log file should then show the precise email addresses of each recipient. David Franco-Rocha - Original Message - From: "Kris McElroy" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 27, 2005 1:01 PM Subject: [Declude.JunkMail] Multiple log lines per message I am running declude 2.04 and I have noticed that there are 4 log lines for every message? What would cause this? What is R1, L2? How many lines per message should I have? 04/27/2005 10:43:31 Qb31e34670094d8a5 R1 Message OK 04/27/2005 10:43:31 Qb31e34670094d8a5 Tests failed [weight=16]: GIBBERISH=IGNORE ANTI-GIBBERISH=IGNORE Y!DIRECTED=IGNORE ANTI-Y!DIRECTED=IGNORE COMBO-ZOMBIEISH=IGNORE BASE64=IGNORE HELOBOGUS=IGNORE IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE WEIGHT10=IGNORE WEIGHT15=IGNORE 04/27/2005 10:43:31 Qb31e34670094d8a5 L2 Message OK 04/27/2005 10:43:31 Qb31e34670094d8a5 Tests failed [weight=16]: GIBBERISH=IGNORE ANTI-GIBBERISH=IGNORE Y!DIRECTED=IGNORE ANTI-Y!DIRECTED=IGNORE COMBO-ZOMBIEISH=WARN BASE64=WARN HELOBOGUS=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE WEIGHT10=WARN WEIGHT15=DELETE Thanks, Kris --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Multiple log lines per message (2)
Why do you think there are multiple results though? This message was sent to one person and has 3 results? Thanks, Kris -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, April 27, 2005 12:58 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Multiple log lines per message Kris, This appears to be the result of multiple recipients. The old log format would repeat the log lines for each recipient, and that does make sense when you consider that each recipient can have different actions, though for the most part they do not. Declude 2.0.6 has some new logging mechanisms that might cut this down substantially. You should probably consider upgrading as there have been many tweaks in recent times. You should also strongly consider updating the filters that you got from me a while back. The ANTI- filter tricks were retired in favor of new functionality that Declude released about a year ago. You can download the newest versions of these filters from the following location: http://www.mailpure.com/software/decludefilters/beta/ These filters are much more efficient, and they have also been upgraded in many other ways. You also only need one filter to accomplish the goals for the most part. Matt Kris McElroy wrote: >I am running declude 2.04 and I have noticed that there are 4 log lines for >every message? What would cause this? What is R1, L2? How many lines per >message should I have? > >04/27/2005 10:43:31 Qb31e34670094d8a5 R1 Message OK > >04/27/2005 10:43:31 Qb31e34670094d8a5 Tests failed [weight=16]: >GIBBERISH=IGNORE ANTI-GIBBERISH=IGNORE Y!DIRECTED=IGNORE >ANTI-Y!DIRECTED=IGNORE COMBO-ZOMBIEISH=IGNORE BASE64=IGNORE HELOBOGUS=IGNORE >IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE WEIGHT10=IGNORE WEIGHT15=IGNORE > >04/27/2005 10:43:31 Qb31e34670094d8a5 L2 Message OK > >04/27/2005 10:43:31 Qb31e34670094d8a5 Tests failed [weight=16]: >GIBBERISH=IGNORE ANTI-GIBBERISH=IGNORE Y!DIRECTED=IGNORE >ANTI-Y!DIRECTED=IGNORE COMBO-ZOMBIEISH=WARN BASE64=WARN HELOBOGUS=WARN >IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE WEIGHT10=WARN WEIGHT15=DELETE > > > > >Thanks, > >Kris > > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > > > > -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Multiple log lines per message
Kris, This appears to be the result of multiple recipients. The old log format would repeat the log lines for each recipient, and that does make sense when you consider that each recipient can have different actions, though for the most part they do not. Declude 2.0.6 has some new logging mechanisms that might cut this down substantially. You should probably consider upgrading as there have been many tweaks in recent times. You should also strongly consider updating the filters that you got from me a while back. The ANTI- filter tricks were retired in favor of new functionality that Declude released about a year ago. You can download the newest versions of these filters from the following location: http://www.mailpure.com/software/decludefilters/beta/ These filters are much more efficient, and they have also been upgraded in many other ways. You also only need one filter to accomplish the goals for the most part. Matt Kris McElroy wrote: I am running declude 2.04 and I have noticed that there are 4 log lines for every message? What would cause this? What is R1, L2? How many lines per message should I have? 04/27/2005 10:43:31 Qb31e34670094d8a5 R1 Message OK 04/27/2005 10:43:31 Qb31e34670094d8a5 Tests failed [weight=16]: GIBBERISH=IGNORE ANTI-GIBBERISH=IGNORE Y!DIRECTED=IGNORE ANTI-Y!DIRECTED=IGNORE COMBO-ZOMBIEISH=IGNORE BASE64=IGNORE HELOBOGUS=IGNORE IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE WEIGHT10=IGNORE WEIGHT15=IGNORE 04/27/2005 10:43:31 Qb31e34670094d8a5 L2 Message OK 04/27/2005 10:43:31 Qb31e34670094d8a5 Tests failed [weight=16]: GIBBERISH=IGNORE ANTI-GIBBERISH=IGNORE Y!DIRECTED=IGNORE ANTI-Y!DIRECTED=IGNORE COMBO-ZOMBIEISH=WARN BASE64=WARN HELOBOGUS=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE WEIGHT10=WARN WEIGHT15=DELETE Thanks, Kris --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Multiple log lines per message
I am running declude 2.04 and I have noticed that there are 4 log lines for every message? What would cause this? What is R1, L2? How many lines per message should I have? 04/27/2005 10:43:31 Qb31e34670094d8a5 R1 Message OK 04/27/2005 10:43:31 Qb31e34670094d8a5 Tests failed [weight=16]: GIBBERISH=IGNORE ANTI-GIBBERISH=IGNORE Y!DIRECTED=IGNORE ANTI-Y!DIRECTED=IGNORE COMBO-ZOMBIEISH=IGNORE BASE64=IGNORE HELOBOGUS=IGNORE IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE WEIGHT10=IGNORE WEIGHT15=IGNORE 04/27/2005 10:43:31 Qb31e34670094d8a5 L2 Message OK 04/27/2005 10:43:31 Qb31e34670094d8a5 Tests failed [weight=16]: GIBBERISH=IGNORE ANTI-GIBBERISH=IGNORE Y!DIRECTED=IGNORE ANTI-Y!DIRECTED=IGNORE COMBO-ZOMBIEISH=WARN BASE64=WARN HELOBOGUS=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE WEIGHT10=WARN WEIGHT15=DELETE Thanks, Kris --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Suggestions Requests
Me three. And on my busy system, the counter spends more time in the "pending" state than in the "show the number of processes" state. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Wednesday, April 27, 2005 6:57 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Suggestions Requests I'll second the nomination for removing the process counter popup! - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 27, 2005 3:45 AM Subject: [Declude.JunkMail] Suggestions Requests 1. On the new process counter program, eliminate the popup information window on start. I have created a short cut to it in the startup folder and every time I log on I have to click OK. 2. %LOCALFROM% would be similar to %LOCALRECIP% in that in notifications I could use "TO: %LOCALFROM%,%LOCALRECIP% so that the message gets sent to the local user only whether the local user sent the message or is the recipient. My intended use is in the BANNotify.eml as there is only one file available for banned notification and I only want it to go to the local user regardless of whether that user sent it or is receiving it. 3. AutoNotice when -diagsend is used. If the server named in the file is on file with Declude and has an e-mail address attributed to it, a autonotice would be sent to that e-mail address indicating that some one caused the diag to be sent to Declude. While not for my benefit, but this would be good for others when there may be multiple people working on the server. 4. ATTACHACTIONWITHHEADERS so that when the ATTACH action is used the Declude headers are written to the attached message. Declude has acknowledged this is pending and I am listing it so that hopefully it will make it into 2.0.7. 5. PREWHITELISTWITHEXTERNAL so that those that want to use PREWHITELIST can do so but still allow external programs such as AutoWhite for Declude to run. Some programs such as AutoWhite for Declude need to run on both outgoing as well as incoming. John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Suggestions Requests
I'll second the nomination for removing the process counter popup! - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 27, 2005 3:45 AM Subject: [Declude.JunkMail] Suggestions Requests 1. On the new process counter program, eliminate the popup information window on start. I have created a short cut to it in the startup folder and every time I log on I have to click OK. 2. %LOCALFROM% would be similar to %LOCALRECIP% in that in notifications I could use "TO: %LOCALFROM%,%LOCALRECIP% so that the message gets sent to the local user only whether the local user sent the message or is the recipient. My intended use is in the BANNotify.eml as there is only one file available for banned notification and I only want it to go to the local user regardless of whether that user sent it or is receiving it. 3. AutoNotice when -diagsend is used. If the server named in the file is on file with Declude and has an e-mail address attributed to it, a autonotice would be sent to that e-mail address indicating that some one caused the diag to be sent to Declude. While not for my benefit, but this would be good for others when there may be multiple people working on the server. 4. ATTACHACTIONWITHHEADERS so that when the ATTACH action is used the Declude headers are written to the attached message. Declude has acknowledged this is pending and I am listing it so that hopefully it will make it into 2.0.7. 5. PREWHITELISTWITHEXTERNAL so that those that want to use PREWHITELIST can do so but still allow external programs such as AutoWhite for Declude to run. Some programs such as AutoWhite for Declude need to run on both outgoing as well as incoming. John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Suggestions Requests
1. On the new process counter program, eliminate the popup information window on start. I have created a short cut to it in the startup folder and every time I log on I have to click OK. 2. %LOCALFROM% would be similar to %LOCALRECIP% in that in notifications I could use "TO: %LOCALFROM%,%LOCALRECIP% so that the message gets sent to the local user only whether the local user sent the message or is the recipient. My intended use is in the BANNotify.eml as there is only one file available for banned notification and I only want it to go to the local user regardless of whether that user sent it or is receiving it. 3. AutoNotice when -diagsend is used. If the server named in the file is on file with Declude and has an e-mail address attributed to it, a autonotice would be sent to that e-mail address indicating that some one caused the diag to be sent to Declude. While not for my benefit, but this would be good for others when there may be multiple people working on the server. 4. ATTACHACTIONWITHHEADERS so that when the ATTACH action is used the Declude headers are written to the attached message. Declude has acknowledged this is pending and I am listing it so that hopefully it will make it into 2.0.7. 5. PREWHITELISTWITHEXTERNAL so that those that want to use PREWHITELIST can do so but still allow external programs such as AutoWhite for Declude to run. Some programs such as AutoWhite for Declude need to run on both outgoing as well as incoming. John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
