Re: [Declude.JunkMail] Spam box
Richard Farris wrote: Is there a box I can put in front of my Imail server that will help take some of the load off of the spam filtering that Declude is doing IMGate. http://imgate.meiway.com/ I'm seeing a reduction in rejected messages with no reduction in delivered mail. This with a pretty simplistic configuration of postfix ( IMGate ). Rod -- --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Header showing up in body
Chuck Schick wrote: How are you viewing the message? It is probably associated with the email client settings. I know some email clients have the option of showing headers - you have to make sure the option is turned off. This is also true of webmail. I know what he is talking about. Every so often I get messages that include the headers and another copy of the message in the body. This viewing the message(s) in Firefox, Mozilla Mail(1.6), and IMail web interface. Acts like the POP or IMAP server gets confused about where in the message ( or possible mbox file) and tries again. This is typically when they are large messages. My most common is a 500+ line report. Rod -- --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Woes
Matt wrote: Thanks John, you are correct about the 83.333 number, and that is still about 10 times the typical amount for domains on my server. I could only really imagine this happening if IMail was accepting all E-mail to the domains hosted on it regardless of there being an actual account...meaning a nobody alias or some sort of loop/bulk-mailing going on. Generally speaking, only about 10% to 20% of users will receive 90% of the spam. Matt, You should look at IMGate ( http://imgate.meiway.com/ ). We added in two MX spools ( inbound mail ) as watched the processor load drop about 25%. With additional IMGate tweaking we've cut processor usage down another 10%. Later we added an outbound server ( SMTP relay ) and had IMail send everything out through it. That gained some more. I'm not sure on how much this saved us but it did save more. Rod -- --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] local delivery appears to not run some external tests
Bill wrote: We had the same problem last year. It was a "bug" in one of the releases of Imail and was latter fixed. I am not sure what version had the problem but the latest version (8.20 with hotfix 2) works correctly. Thanks. It appears we stumped Declude with this one. I was going to follow up with them today. Yesterday in a flurry of INBOX cleaning I deleted this message without reading it. I just happened to realize that as I was INBOX cleaning this AM. Close call. Again thanks, Rod -- --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] local delivery appears to not run some external tests
Didn't see anything like this in the archives but of course it could be the way I was searching. We're using WAMCHECK as an externalplus and when a mail is sent using the web interface or from a client to/from domains on the same machine the results are not honored. We have tried forcing the mail out to an external SMTP server but Declude and/or iMail won't allow that to happen if the domain is local. This making any sense at all? Well I do have a message into support but since those that know our contract number etc. are away today I figured I'd attack it from multiple directions. Any thoughts or suggestions? TIA, Rod -- --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisting Issue
Chris Patterson wrote: > Hi all, > > I am having trouble with an issue where spam is getting by showing > whitelisted in the header. Neither the domain or e-mail address that it > is coming from is whitelisted in the global config, nor are they showing > as Auth-user. > > However, one of the recipients (local user) is Whitelisted; which you > can't see because they are apparently in the BCC field . > > Apparently it is causing all recipients on this e-mail to receive it as > Whitelisted. Has anyone else ran into this issue? Yes we did. Our solution was to go with an IMGate server and serialize the messages. This will not work for messages sent from user-to-user (domain-to-domain also) on the same iMail system. the mesage gets passed to Declude which does it's magic then passed back to iMail for final delivery. Any spam checks passed of failed for one recipient apply to all. The bcc issue is trickier still. Rod -- Roderick A. Anderson Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Burst a message before processing (?)
Bill wrote: > Rod, > > WAMCHECK is whitelisting the message. Currently, WAMCHECK looks at only > the first addressee to determine an action (for all addressees). I am > looking at changing this in the future but for now, that's what is > happening. Thanks Bill. We were think the same but couldn't come up with any ideas on howto get around the fact Declude/iMail passes the message to multiple recipients in the domain as one message thne I'm guessing iMail breaks it into multiple mesages for final delivery. We're using another system to spool mail (IMGate) and I think I'll have it deliver individual copies to the iMail/Declude system. This should fix it for us. Again thanks for theresponse, Rod -- --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Burst a message before processing (?)
Not sure if this is an iMail (SMTP) or Declude question (or possibly WAMCHECK). We've notice that messages with multiple To, Cc and Bcc recipients are all whitelisted if the first addressee whitelists -- the whitelisting coming from WAMCHECK. Is there a way to have a message 'burst' into multiple copies (?) before processing by Declude? Can Declude do this? If not any ideas as to how? TIA, Rod -- Roderick A. Anderson Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] user to user on same domain
R. Scott Perry wrote: > >> Does mail going fro muser to user in the same domain (and on the same >> system) go through Declude.JunkMail? > > > Yes, it should (with the exception of E-mail sent by web messaging on > IMail v7 and earlier). Thanks. I'll have to sort this out when I can get back to the project. > >> With this does anyone have a script or program that will backtrace a >> message through all the log files -- Declude and iMail -- given the >> message ID or some such? This way I can look up specifics of why the >> badheaders and spamheaders are being triggered. > > > Unfortunately, I am not aware of such a tool. Hum. Potential there. It is a problem often enough for us I'll probably write one. Has there been any message threads on the files (logs) and the key fields in them to chase them down? Rod -- Roderick A. Anderson Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] user to user on same domain
It's been a few days since I was working on this and I should have asked then but got pulled in another direction so this will have kind of vague proofs. Does mail going fro muser to user in the same domain (and on the same system) go through Declude.JunkMail? I was getting indications that is was slipping by. With this does anyone have a script or program that will backtrace a message through all the log files -- Declude and iMail -- given the message ID or some such? This way I can look up specifics of why the badheaders and spamheaders are being triggered. TIA, Rod -- Roderick A. Anderson Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] More info ref: BADHEADERS SPAMHEADERS
John Tolmachoff (Lists) wrote: > http://www.declude.com/Articles.asp?ID=100 Damn! I had this bookmarked but below a couple of other Declude articles and completely missed it. Thanks for the whack with the clue-stick. :-) Rod -- --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] More info ref: BADHEADERS SPAMHEADERS
I have a script that sends an email using the Perl module Net::SMTP_Auth. The messages come through but end up in the spam folder marked as BADHEADERS and SPAMHEADERS. Looking at the on line documentation I can't find description as to what these look for or don't find. I've also passed the message through a very old copy of Spamassassin and I see several things tagged and have fixed _them_ but I still get the BADHEADERS/SPAMHEADERS from Declude. This script is run on the mail server and uses a SMTP server on that system to send the message to another domain on the same server. (Twisted eh?) Where can I find more information about BADHEADERS/SPAMHEADERS and how to fix the messages so they don't get caught? TIA, Rod -- Roderick A. Anderson Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Urgent script help needed
John Tolmachoff wrote: > Sending from my private e-mail. > > My ISP changed the backbone last night and in doing so, screwed up the > routers. > > Bottom line, my connection from/to my servers has been down for 12 hours. > > All incoming e-mail is on my backup MX which is a IIS 5.0 Virtural SMTP > Server. They are all sitting in the inetpub\mailroot\queue directory. > > I need a script to find *.eml files that are to a client, say domain.com, > and move those files to a seperate folder for review. I can then review > those manually and the zip those files, copy to a zip disk, and move to my > computer to then send to the client. Do you have perl installed? If so this could be pretty trivial. Most MS based utilities don't have the umph needed to do heavy text processing. (This is probably why MS gave money to ActiveState to port perl to the Windows platform. ;-) I don't do a lot of the iMail/Declude maintenance (mostly I build scripts/programs to handle the actual mail boxes) so I not sure where to find a *.eml file (and the phone keeps ringing) so I don't know what the format is. But quick pseudo-code would be: get a listing of all the *.eml files in the directory open them one at a time read the first ??? lines looking for domain.com if found close the file and move the file to the other directory else close the file and do the next file HTH, Rod -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Message header review
dig -x ;; ANSWER SECTION: 102.252.235.68.in-addr.arpa. 86286 IN PTR 68-235-252-102.atlsfl.adelphia.net. dig -x 207.217.120.149 ;; ANSWER SECTION: 149.120.217.207.in-addr.arpa. 86400 IN PTR asmtp-a063f33.pas.sa.earthlink.net. Seems it indicate so. Rod -- i360 Support wrote: >Can someone help me with the header of this message. > >I think this came from earthlink.net mail server. >According to earthlink abuse they can't do anything about this type of spam since it >did not originate from their network. > >We get porn spam from this segement all the time. > > > > >Received: from asmtp-a063f33.pas.sa.earthlink.net [207.217.120.149] by >deepspace.i360.net with ESMTP > (SMTPD32-7.15) id A94339680150; Thu, 22 Jul 2004 10:12:03 -0500 >Received: from 68-235-252-102.atlsfl.adelphia.net ([68.235.252.102]) > by asmtp-a063f33.pas.sa.earthlink.net with asmtp (Exim 4.34) > id 1BnfBN-00062N-F4; Thu, 22 Jul 2004 08:08:32 -0700 >Message-ID: <[EMAIL PROTECTED]> >Reply-To: "=?windows-1251?B?Y2FtZWxsaWE=?=" <[EMAIL PROTECTED]> >From: "=?windows-1251?B?Y2FtZWxsaWE=?=" <[EMAIL PROTECTED]> >Subject: SPAM: >=?windows-1251?B?QnJpZGdldCBtb25yb2Ugc3Vja2luZyBhIGhhcmQgY29jayB2ZXJ5IGRlZXA=?= >Date: Thu, 22 Jul 2004 00:56:07 -0400 >MIME-Version: 1.0 >Content-Type: text/html; > charset="windows-1251" >Content-Transfer-Encoding: 7bit >X-Priority: 3 >X-MSMail-Priority: Normal >X-Mailer: Microsoft Outlook Express 6.00.2600. >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600. >X-ELNK-Trace: >006cdaaeaf6f69a98241270f52c7d65b7e972de0d01da9401ceba94723fb6a47959954e32e1a9354350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c >X-Originating-IP: 68.235.252.102 >X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" >X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]" >X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [840a]. >X-Declude-Sender: [EMAIL PROTECTED] [207.217.120.149] >X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. >X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, BADHEADERS, WEIGHT10 [11] >X-Note: This E-mail was sent from asmtp-a063f33.pas.sa.earthlink.net >([207.217.120.149]). >X-RCPT-TO: <[EMAIL PROTECTED]> >Status: U >X-UIDL: 384479918 > > -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude vs iMail
Once again thanks to all. I wanted to make sure I was headed in the right direction making sure the issue I need to address isn't with Declude. It is doing what we set it up to do. Now I have to get iMail to not over-ride that. Rod -- Sanford Whiteman wrote: >>Now if a user sets up forwarding, should/will iMail forward all mail >>or only that destined for the Inbox. >> >> > >FORWARD.IMA covers all mail. > >.FWD forwards selectively. > >Since this stuff is all IMail behavior (not related to Declude), you'd >learn a lot fromsometesting.Sendmailto >-@example.comtomimicDeclude's mailbox >subaddressing. > >--Sandy > > > >Sanford Whiteman, Chief Technologist >Broadleaf Systems, a division of >Cypress Integrated Systems, Inc. >e-mail: [EMAIL PROTECTED] > >SpamAssassin plugs into Declude! > http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ > >Defuse Dictionary Attacks: Turn Exchange Addresses into IMail Aliases! > > http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. >--- >[This E-mail scanned for viruses by Declude Virus] > > > -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude vs iMail
Thanks Scott and Sanford.
(That should have been a smiley instead of a question mark after the
word suggestion. :-)
OK this is what I thought. Now if a user sets up forwarding,
should/will iMail forward all mail or only that destined for the Inbox.
That is, will mail that Declude says goes into the 'spam' mailbox be
forwarded instead of 'filed'? Is this a possible over-ride behavior?
Again Thanks,
Rod
--
R. Scott Perry wrote:
>
>> Does Declude actually place messages, besides those that make it
>> through, in the folder/mailbox or does it deliver to iMail with a
>> suggestion (?) of which folder to place the message in?
>>
>> Example:
>>
>> SPAMCOPMAILBOX spam
>
>
> With the MAILBOX action, Declude JunkMail tells IMail to deliver the
> E-mail in the mailbox that you specify ("spam" in this case). It
> isn't a suggestion -- it's what Declude JunkMail expects IMail to do
> (just the same as if you had a rule to deliver it to the "spam"
> mailbox). It is possible that IMail could override this for some
> reason, but I can't think of a case where it would.
>
>-Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail
> mailservers since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in
> mailserver vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus]
>
--
Roderick A. Anderson
Project Manager
Technology Services Management Group
<http://www.technologyservicesmanagementgroup.com/>
Spokane WA, 99202
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
[Declude.JunkMail] Declude vs iMail
Does Declude actually place messages, besides those that make it through, in the folder/mailbox or does it deliver to iMail with a suggestion (?) of which folder to place the message in? Example: SPAMCOPMAILBOX spam TIA, Rod -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] E-mail message ID and declude
Is there a way to get the actions for a message from the Declude log files when all I have is the Message-ID. The To/From fields are suspect. A message made it through all our filtering and the user had already sucked it down to Outlook (LookOut?) before forwarding it to me. Now all I really have is the Message-ID and I'm trying to find out why/how it made it through Declude. Other messsages from the same source and a mostly similar content are not making it through. TIA, Rod -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] logfile naming
Thanks. I've been looking at them but since I have perl on the systems most everything I need it there. Bonno Bloksma wrote: >Hi, > >Get the UnixTools for Windows http://unxutils.sourceforge.net/ and use all >the Unix commands you've always wanted in a Windows environment. ;-) > >Met vriendelijke groet, > >Bonno Bloksma > > Rod -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] logfile naming
Yeah a real pain. My concern is mostly last July's logs getting written over or blended with this years. If they are uniquely named then no issue. A dribble of the previous days data in the next or previous days data isn't an issue for me. Thanks for the thoughts. Rod -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] logfile naming
> You could use something like: > LOGFILE spool\dec2004.log I was hoping to avoid a kludge like this. Coming from a UNIX background I don't like to manually do tasks that should be automatic (or automagical :-) and easy. I'm getting pretty good at writing scripts that run from the scheduler and do what has to be done. Thanks to all for the suggestions.. Rod -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] logfile naming
The docs say a in the filename used with LOGFILE will be replaced with the month and day. Is there a way to get the year -- four (preferred) or two digit -- included? TIA, Rod -- Roderick A. Anderson Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hung/zombie Declude Processes
The only reason this should happen is if your program doesn't end --
Declude JunkMail will wait up to an hour for it to end (although that is
being changed to 5 minutes). One thing that you can do is run Declude
JunkMail in the debug mode ("LOGLEVEL DEBUG"). If you search the log
file, you should find a line "External program started:" followed by the
name of your program. The next log file entry should be either an error
message or "External program reports exit code of:". If neither of
those appear, Declude JunkMail is probably just sitting and waiting for
your program to end. If you see your program in Task Manager, that's
definitely the case.
Scott, Is there a way to run the test for a single message. With our
e-mail traffic un-commenting the TEST line, saving the GLOBAL.CFG file,
re-commenting the TEST line and saving GLOBAL.CFG faster than I typed
this fills the queue. We upped the max number of processes to 45 but I
haven't been brave enough to tested it again since one small mistake and
we're out-of processes for an hour.
Rod
--
Roderick A. Anderson
Technology Services Management Group
<http://www.technologyservicesmanagementgroup.com/>
Spokane WA, 99202
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hung/zombie Declude Processes
>>So until I figure out why my program causes Declude to never return >>I was wondering if there is a command line switch for Declude to >>cause it to flush itself out of the process queue. >> >> >This, if it existed, would be scarcely different from ending the task >using Task Manager; it would enumerate PIDs and try to end them. You >might try using KILL.EXE (from the Resource Kit) in such situations >for a stronger tonic. > > I forgot all about this. And actually I do so little Windows Admin it doesn't surprise me. I'll go a looking for it. >>And if anyone has some ideas why Declude isn't returning I'd be very >>interested. The perl script and the executable version both exit 0 >>which is my understand as they should. And they do run run from the >>command line just fine. >> >> > >Does _Declude_ run from the command line (against a Q file, not just >on its own)? If so, check that the IMail service accounts have >permissions equivalent to the interactive (Administrator?) session. > > Great idea but I'll probably have wait to hear from Scott if this is possible. >SpamAssassin plugs into Declude! > http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ > >Defuse Dictionary Attacks: Turn Exchange Addresses into IMail Aliases! > > http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ > > Rod -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Hung/zombie Declude Processes
It's happened twice today. Declude hangs. That's the short and not very flattering story. So for the rest of the story read-on. I'm writing a new TEST (actually it is a handler that pretends to be a TEST.) Since I don't have access to a C/C++ compiler right now I thought I'd proto-type it using perl then use perl2exe to create and executable that though larger than the other external tests should work fine. Problem is every try causes Declude and my filtertest.(pl|exe) TEST to hang and go -- what we in the UNIX world call zombie. The difference is when the iMail delivery agent limit is hit no more can start so the mail spools ... and spools ... and spools until we reboot the server. All attempts to End Process fail. I get a message about not having permissions for that action. So until I figure out why my program causes Declude to never return I was wondering if there is a command line switch for Declude to cause it to flush itself out of the process queue. And if anyone has some ideas why Declude isn't returning I'd be very interested. The perl script and the executable version both exit 0 which is my understand as they should. And they do run run from the command line just fine. TIA, Rod -- Roderick A. Anderson Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] working with filters
Imail Admin wrote: >Sorry Scott, I just realized I was being Monday-morning befuddled. The >inclusion of the filter line in the global.cfg file only defines the test, >just as all the other tests are defined there. It's only when I put the >reference in the $default$.junkmail file to that test name that the test is >actually used. Sorry for being so slow... > > Actually I think it is that all tests in global.cfg are run. I just ran into this last week. I am now in search of a method to only run the test if any of a other set of tests fail? Rod -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] NEw tests runs for all email
Thanks Darrell. I was thinking this. I wrote a web interface that allows users to set their own spam filtering level from 4 predefined settings. In that case I just copy the level .junkmail file (that someone else created/defined) to the username.junkmail in the domain's directory and I never thought much about what was going on. I assumed Declude was only running the tests that were defined for that user. So I'll now change my test to exit early if a file is not present and run if it is. Again thanks, Rod -- Darrell ([EMAIL PROTECTED]) wrote: >Rod, > >It's because with seperate default.junkmail files you can have different >actions based on those tests defined in the global.config. For example I >have customers who want mail held at weight 10 while other customers want it >held at weight 20. The only way to accomplish this is having seperate >default.junkmail files for each domain. > >Darrell > > >Check out http://www.invariantsystems.com for utilities for Declude And >Imail. >IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. > >- Original Message - >From: "Roderick A. Anderson" <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> >Sent: Thursday, June 24, 2004 7:43 PM >Subject: Re: [Declude.JunkMail] NEw tests runs for all email > > > > >>OK. >> >>Is there anyway around this, perhaps by defining the test in a domain >>$default$.junkmail or individual's .junkmail file? >> >>I wonder why we put anything in the .junkmail files if all the tests in >>GLOBAL.CFG are run any. Not to pick-nits, it is just that I'm still >>pretty new to this and been assigned a near death-march task. >> >> >>Rod >>-- >> >>R. Scott Perry wrote: >> >> >> >>>>The problem is as soon as I save GLOBAL.CFG the test runs for all >>>>inbound mail not just the one juser.junkmail file I added it to. >>>> >>>> >>>That is just the way that Declude JunkMail works -- the tests will be >>>run for all users (for example, in many cases, people define tests in >>>the global.cfg file without any other reference to them, just using >>>the weighting system -- in which case the test should be run for >>>everyone). >>> >>> -Scott >>>--- >>>Declude JunkMail: The advanced anti-spam solution for IMail >>>mailservers since 2000. >>>Declude Virus: Ultra reliable virus detection and the leader in >>>mailserver vulnerability detection. >>>Find out what you've been missing: Ask for a free 30-day evaluation. >>> >>>--- >>>[This E-mail was scanned for viruses by Declude Virus >>>(http://www.declude.com)] >>> >>>--- >>>This E-mail came from the Declude.JunkMail mailing list. To >>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>type "unsubscribe Declude.JunkMail". The archives can be found >>>at http://www.mail-archive.com. >>>--- >>>[This E-mail scanned for viruses by Declude Virus] >>> >>> >>> >>-- >>Roderick A. Anderson >>Project Manager >>Technology Services Management Group >> >> ><http://www.technologyservicesmanagementgroup.com/> > > >>Spokane WA, 99202 >> >>--- >>[This E-mail scanned for viruses by Declude Virus] >> >>--- >>[This E-mail was scanned for viruses by Declude Virus >> >> >(http://www.declude.com)] > > >>--- >>This E-mail came from the Declude.JunkMail mailing list. To >>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>type "unsubscribe Declude.JunkMail". The archives can be found >>at http://www.mail-archive.com. >> >> >> > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. >--- >[This E-mail scanned for viruses by Declude Virus] > > > -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] NEw tests runs for all email
OK. Is there anyway around this, perhaps by defining the test in a domain $default$.junkmail or individual's .junkmail file? I wonder why we put anything in the .junkmail files if all the tests in GLOBAL.CFG are run any. Not to pick-nits, it is just that I'm still pretty new to this and been assigned a near death-march task. Rod -- R. Scott Perry wrote: > >> The problem is as soon as I save GLOBAL.CFG the test runs for all >> inbound mail not just the one juser.junkmail file I added it to. > > > That is just the way that Declude JunkMail works -- the tests will be > run for all users (for example, in many cases, people define tests in > the global.cfg file without any other reference to them, just using > the weighting system -- in which case the test should be run for > everyone). > >-Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers since 2000. > Declude Virus: Ultra reliable virus detection and the leader in > mailserver vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] > -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] NEw tests runs for all email
I'm in the process of creating a custom test. To test that I've got the correct calls to it, it currently just creates a unique named file and writes the command line arguments to it. It defined as an EXTERNAL test and I have added the the following line to GLOBAL.CFG MPALERT EXTERNAL nonzero "d:\iMail\Declude\mpalert.exe %ALLRECIPS% %LOCALHOST% %MAILFROM%" The problem is as soon as I save GLOBAL.CFG the test runs for all inbound mail not just the one juser.junkmail file I added it to. This should not run for all users/e-mail but only when it is in a *.junkmail file. I've looked through the list archives and get the impression this should work the way I think it should not the way it is. So is there a step or twelve I've missed or added that causes it to run for all e-mail instead of just for the ones where it is in the *.junkmail file? TIA, Rod -- Roderick A. Anderson Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Per-user alert messages
I've looked in the documentation and haven't found (can't find :-) if it is possible to have a per user alert message. We need to build the messages with custom values (fields) from a database. TIA, Rod -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filtering Tips
Scott Fisher wrote: >Here are some notes for filtering that I have compiled: > >Data Types to Search: > >ALLRECIPS searches the recipients of the e-mail message. It was broken in the earlier >1.79 versions and was fixed with 1.79i7. > > We are running 1.78 (need to do our upgrade soon it looks like). Could this be causing the error we're seeing with bounce messages not showing the real To: adderss when we use %ALLRECIPS%? and %REALRECIPS% ? Rod -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] %TO% variable
R. Scott Perry wrote: >> '[EMAIL PROTECTED]' - sends to ->'[EMAIL PROTECTED]' = >> forwards to =>'[EMAIL PROTECTED]' = forwards to >> =>'[EMAIL PROTECTED]' >> >> %ALLRECIPS% gives '[EMAIL PROTECTED]' when I need >> '[EMAIL PROTECTED]'. %MAILFROM% gives '[EMAIL PROTECTED]' which >> is great. I was hoping for a %MAILTO% that would give me >> '[EMAIL PROTECTED]'. > > > Actually, in this case, I believe Declude will actually just see > [EMAIL PROTECTED] (unless [EMAIL PROTECTED] is an alias, rather > than a forward). To %ALLRECIPS% here should be [EMAIL PROTECTED] > > You might want to try %REALRECIPS%, which will show the alternate > addresses, which contains the other address(es) that Declude JunkMail > knows about. Tried and had no luck. Gives the same as %ALLRECIPS%. Chain was actually shorter and it still came back as '[EMAIL PROTECTED]'. Any other suggestions? Could WAMCHECK be causing these problems? I didn't think so so I never mentioned it was in the pot with Declude. Rod -- Roderick A. Anderson Project Manager Technology Services Management Group <http://www.technologyservicesmanagementgroup.com/> Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] [AUTOMATED NOTE: Your mail server [66.193.33.3] is missing a reverse DNS entry. All Internet hosts are required to have a reverse DNS entry. The missing reverse DNS entry will cause your mail to be treated as spam on some servers, such as AOL.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] %TO% variable
R. Scott Perry wrote: %ALLRECIPS% gives '[EMAIL PROTECTED]' when I need '[EMAIL PROTECTED]'. %MAILFROM% gives '[EMAIL PROTECTED]' which is great. I was hoping for a %MAILTO% that would give me '[EMAIL PROTECTED]'. Actually, in this case, I believe Declude will actually just see [EMAIL PROTECTED] (unless [EMAIL PROTECTED] is an alias, rather than a forward). To %ALLRECIPS% here should be [EMAIL PROTECTED] Well this is where the issue came up. We were testing a new configuration and the bounced messages were saying [EMAIL PROTECTED] Seemed odd that it would do this but then all things e-mail seem odd at times. :-) I can see the alias situation and there might be a problem with mailing lists which I'll deal with after this. You might want to try %REALRECIPS%, which will show the alternate addresses, which contains the other address(es) that Declude JunkMail knows about. I'll give this one a try. Might give a hint as to why I'm getting the last instead of the first. The mail headers give no indication of a problem. One To: with the chain of forwards. Thanks, Rod -- --- [Certified Virus free by ASISNA Mail Services.www.asisna.com ] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] %TO% variable
Darin Cox wrote: Does %ALLRECIPS% do what you want? Darin. No it doesn't. %ALLRECIPS% gives the last address(es) delivered to not the initial address. So if the address chain (?) is '[EMAIL PROTECTED]' - sends to -> '[EMAIL PROTECTED]' = forwards to => '[EMAIL PROTECTED]' = forwards to => '[EMAIL PROTECTED]' %ALLRECIPS% gives '[EMAIL PROTECTED]' when I need '[EMAIL PROTECTED]'. %MAILFROM% gives '[EMAIL PROTECTED]' which is great. I was hoping for a %MAILTO% that would give me '[EMAIL PROTECTED]'. Best regards, Rod -- --- [Certified Virus free by ASISNA Mail Services.www.asisna.com ] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] %TO% variable
After searching the list archives, documentation and doing a test or two looking for undocumented variables with no luck I am hoping someone on this list will have a solution. We have a bounce message that needs to say who the message was sent to not the final recipient. This where someone has forwarded one account to another account that ends up at the Declude scanned account. Yup .. pretty convoluted but I'm seeing it happen. Any 'undocumented' variables or tricks I can use to get this value into the bounce message? TIA, Rod -- Roderick A. Anderson Technology Services Management Group Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] [AUTOMATED NOTE: Your mail server [66.193.33.3] is missing a reverse DNS entry. All Internet hosts are required to have a reverse DNS entry. The missing reverse DNS entry will cause your mail to be treated as spam on some servers, such as AOL.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
