CBL:Re: [Declude.JunkMail] Keyword
Does anyone have any comment on this? I would like to know myself Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet" - Original Message - From: Brian To: Declude.JunkMail@declude.com Sent: Wednesday, November 30, 2005 12:40 PM Subject: Re: [Declude.JunkMail] Keyword Given the fact that these types of tests (keyword, subjectetc) take up processor memory, is there a way to run a scan of the logs and get a list of the keywords that actually tripped the keyword filter, so that you can clean up a keyword list and remove the ones that are not doing anything? Thanks, Brian - Original Message - From: Matt To: Declude.JunkMail@declude.com Sent: Monday, November 28, 2005 8:53 PM Subject: Re: [Declude.JunkMail] Keyword Richard,That is going to be something that only the logs can tell you when you do things this way, and you would need to be running in Debug mode. The best way to tell what failed is to use a weight for the filter and then set the filter action to WARN, that way it will insert in the headers which line was failed.MattRichard Farris wrote: If I have a text file with all my keywords in it and the log file says KEYWORD HOLD (which it should) How do I know which keyword in the list of hundreds held it? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet" - Original Message - From: John T (Lists) To: Declude.JunkMail@declude.com Sent: Monday, November 28, 2005 7:17 PM Subject: RE: [Declude.JunkMail] Keyword Depends upon how it failed. If by keyword you mean a filter test like my KEYSUBJECT then in the log it will tell you which line of the associated filter file that a match was found. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Richard FarrisSent: Monday, November 28, 2005 5:11 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Keyword If you find your are holding mail because of a keyword, how do you find out which keyword it is? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet
Re: CBL:Re: [Declude.JunkMail] Keyword
I'm not a grep expert... but something along the
lines this should work
grep -i
-U"Triggered.BODY.CONTAINS.filter.BODY-KEYWORDS"
d:\imail\spool\dec1205.log
This should pull out all BODY matches from the
filter BODY-KEYWORDS
Original Message -
From:
Richard
Farris
To: Declude.JunkMail@declude.com
Sent: Tuesday, December 06, 2005 1:24
PM
Subject: CBL:Re: [Declude.JunkMail]
Keyword
Does anyone have any comment on this? I
would like to know myself
Richard FarrisEthixs Online1.270.247.
Office1.800.548.3877 Tech Support"Crossroads to a Cleaner
Internet"
- Original Message -
From:
Brian
To: Declude.JunkMail@declude.com
Sent: Wednesday, November 30, 2005
12:40 PM
Subject: Re: [Declude.JunkMail]
Keyword
Given the fact that these types of tests
(keyword, subjectetc) take up processor memory, is there a way to run a
scan of the logs and get a list of the keywords that actually tripped the
keyword filter, so that you can clean up a keyword list and remove the ones
that are not doing anything?
Thanks,
Brian
- Original Message -
From: Matt
To: Declude.JunkMail@declude.com
Sent: Monday, November 28, 2005 8:53 PM
Subject: Re: [Declude.JunkMail] Keyword
Richard,That is going to be something that only the
logs can tell you when you do things this way, and you would need to be
running in Debug mode. The best way to tell what failed is to use a
weight for the filter and then set the filter action to WARN, that way it
will insert in the headers which line was
failed.MattRichard Farris wrote:
If I have a text file with all my keywords in
it and the log file says KEYWORD HOLD (which it should)
How do I know which keyword in the list of hundreds held it?
Richard FarrisEthixs Online1.270.247.
Office1.800.548.3877 Tech Support"Crossroads to a Cleaner
Internet"
-
Original Message -
From:
John T (Lists)
To:
Declude.JunkMail@declude.com
Sent:
Monday, November 28, 2005 7:17 PM
Subject:
RE: [Declude.JunkMail] Keyword
Depends upon
how it failed. If by keyword you mean a filter test like my KEYSUBJECT
then in the log it will tell you which line of the associated filter
file that a match was found.
John
T
eServices For
You
-Original
Message-From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Richard
FarrisSent:
Monday,
November 28, 2005
5:11
PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail]
Keyword
If you
find your are holding mail because of a keyword, how do you find out
which keyword it is?
Richard FarrisEthixs
Online1.270.247. Office1.800.548.3877 Tech
Support"Crossroads to a Cleaner
Internet
Re: [Declude.JunkMail] Keyword
Given the fact that these types of tests (keyword,
subjectetc) take up processor memory, is there a way to run a scan of the
logs and get a list of the keywords that actually tripped the keyword filter, so
that you can clean up a keyword list and remove the ones that are not doing
anything?
Thanks,
Brian
- Original Message -
From: Matt
To: Declude.JunkMail@declude.com
Sent: Monday, November 28, 2005 8:53 PM
Subject: Re: [Declude.JunkMail] Keyword
Richard,That is going to be something that only the logs
can tell you when you do things this way, and you would need to be running in
Debug mode. The best way to tell what failed is to use a weight for the
filter and then set the filter action to WARN, that way it will insert in the
headers which line was failed.MattRichard Farris wrote:
If I have a text file with all my keywords in it
and the log file says KEYWORD HOLD (which it should) How do
I know which keyword in the list of hundreds held it?
Richard FarrisEthixs Online1.270.247.
Office1.800.548.3877 Tech Support"Crossroads to a Cleaner
Internet"
-
Original Message -
From:
John T (Lists)
To:
Declude.JunkMail@declude.com
Sent:
Monday, November 28, 2005 7:17 PM
Subject:
RE: [Declude.JunkMail] Keyword
Depends upon how
it failed. If by keyword you mean a filter test like my KEYSUBJECT then in
the log it will tell you which line of the associated filter file that a
match was found.
John
T
eServices For
You
-Original
Message-From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Richard
FarrisSent:
Monday,
November 28, 2005
5:11
PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail]
Keyword
If you find
your are holding mail because of a keyword, how do you find out which
keyword it is?
Richard FarrisEthixs
Online1.270.247. Office1.800.548.3877 Tech
Support"Crossroads to a Cleaner
Internet
[Declude.JunkMail] Keyword
If you find your are holding mail because of a keyword, how do you find out which keyword it is? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet
RE: [Declude.JunkMail] Keyword
Depends upon how it failed. If by keyword you mean a filter test like my KEYSUBJECT then in the log it will tell you which line of the associated filter file that a match was found. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Monday, November 28, 2005 5:11 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Keyword If you find your are holding mail because of a keyword, how do you find out which keyword it is? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet
Re: [Declude.JunkMail] Keyword
If I have a text file with all my keywords in it and the log file says KEYWORD HOLD (which it should) How do I know which keyword in the list of hundreds held it? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet" - Original Message - From: John T (Lists) To: Declude.JunkMail@declude.com Sent: Monday, November 28, 2005 7:17 PM Subject: RE: [Declude.JunkMail] Keyword Depends upon how it failed. If by keyword you mean a filter test like my KEYSUBJECT then in the log it will tell you which line of the associated filter file that a match was found. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard FarrisSent: Monday, November 28, 2005 5:11 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Keyword If you find your are holding mail because of a keyword, how do you find out which keyword it is? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet
RE: [Declude.JunkMail] Keyword
If it is a filter file, it should say something like (line 100 10 points) in the log. Post a log snippet for the message in question of send off list if you would rather. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Monday, November 28, 2005 5:25 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Keyword If I have a text file with all my keywords in it and the log file says KEYWORD HOLD (which it should) How do I know which keyword in the list of hundreds held it? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet - Original Message - From: John T (Lists) To: Declude.JunkMail@declude.com Sent: Monday, November 28, 2005 7:17 PM Subject: RE: [Declude.JunkMail] Keyword Depends upon how it failed. If by keyword you mean a filter test like my KEYSUBJECT then in the log it will tell you which line of the associated filter file that a match was found. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Monday, November 28, 2005 5:11 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Keyword If you find your are holding mail because of a keyword, how do you find out which keyword it is? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet
Re: [Declude.JunkMail] Keyword
Richard, That is going to be something that only the logs can tell you when you do things this way, and you would need to be running in Debug mode. The best way to tell what failed is to use a weight for the filter and then set the filter action to WARN, that way it will insert in the headers which line was failed. Matt Richard Farris wrote: If I have a text file with all my keywords in it and the log file says KEYWORD HOLD (which it should) How do I know which keyword in the list of hundreds held it? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet" - Original Message - From: John T (Lists) To: Declude.JunkMail@declude.com Sent: Monday, November 28, 2005 7:17 PM Subject: RE: [Declude.JunkMail] Keyword Depends upon how it failed. If by keyword you mean a filter test like my KEYSUBJECT then in the log it will tell you which line of the associated filter file that a match was found. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Richard Farris Sent: Monday, November 28, 2005 5:11 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Keyword If you find your are holding mail because of a keyword, how do you find out which keyword it is? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet
RE: [Declude.JunkMail] Keyword
asJohn said look at the log file for the message and it will tell
you the line number in the filter to look at. Only good if the filter has not
changed since the email was processed by declude.
Kevin
Bilbee
-Original Message-From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]On Behalf Of Richard
FarrisSent: Monday, November 28, 2005 5:25 PMTo:
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail]
Keyword
If I have a text file with all my keywords in it
and the log file says KEYWORD HOLD (which it should) How do
I know which keyword in the list of hundreds held it?
Richard FarrisEthixs Online1.270.247.
Office1.800.548.3877 Tech Support"Crossroads to a Cleaner
Internet"
- Original Message -
From:
John T (Lists)
To: Declude.JunkMail@declude.com
Sent: Monday, November 28, 2005 7:17
PM
Subject: RE: [Declude.JunkMail]
Keyword
Depends upon how
it failed. If by keyword you mean a filter test like my KEYSUBJECT then in
the log it will tell you which line of the associated filter file that a
match was found.
John
T
eServices For
You
-Original
Message-From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Richard FarrisSent: Monday,
November 28, 2005
5:11
PMTo:
Declude.JunkMail@declude.comSubject: [Declude.JunkMail]
Keyword
If you find
your are holding mail because of a keyword, how do you find out which
keyword it is?
Richard FarrisEthixs
Online1.270.247. Office1.800.548.3877 Tech
Support"Crossroads to a Cleaner
Internet
Re: [Declude.JunkMail] Keyword
Two options - check the headers of the message it should indicate the line (assuming the test is set to warn). If not you need log level high for it to show the line number in the logs. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Richard Farris To: Declude.JunkMail@declude.com Sent: Monday, November 28, 2005 8:11 PM Subject: [Declude.JunkMail] Keyword If you find your are holding mail because of a keyword, how do you find out which keyword it is? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet
[Declude.JunkMail] Keyword filtering AND Aliases
This is a two part question: First, I had a question about filtering using keywords. I have the following command in the global.cfg: KEYWORDFILTER filter d:\Imail\.\keywordfilter.txtx 10 0 To help stop some of the SPAM that is going through the server, keywords are added to the keywordfilter.txt file. I was wondering if this test is checking attachments and if so, how can I set it to skip over the scanning of attachments for keywords. Second, we also host a number of websites. One of our customers has a personal account on Domain A and has a business account on Domain B. They have it set to forward the e-mails from Domain B to Domain A, literally having Domain B's e-mail address set as an alias. For some reason, Declude is blocking this message. I'm not sure which test it is failing as I was told by someone else of this problem. The problem was fixed by whitelisting the domains but I was just wondering if there was a better way to do this instead of whitelisting. Sorry for the vagueness of the second question. Isaias Hernandez Internet Tech Support 979-775-6239 [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Keyword filtering AND Aliases
To help stop some of the SPAM that is going through the server, keywords are added to the keywordfilter.txt file. I was wondering if this test is checking attachments and if so, how can I set it to skip over the scanning of attachments for keywords. Yes, it is checking attachments, and no, they can't be skipped. The problem is that it requires full MIME decoding, which is very complex (it took years for web messaging to handle MIME segment properly). While we do have full MIME decoding in Declude Virus, it would not be easy to convert to Declude JunkMail. Second, we also host a number of websites. One of our customers has a personal account on Domain A and has a business account on Domain B. They have it set to forward the e-mails from Domain B to Domain A, literally having Domain B's e-mail address set as an alias. Is it an alias (a user alias set up on Domain A that has the Domain B address in it), or as a forward (where there is a user account on Domain A, and it has forwarding set up to Domain B)? For some reason, Declude is blocking this message. I'm not sure which test it is failing as I was told by someone else of this problem. The problem was fixed by whitelisting the domains but I was just wondering if there was a better way to do this instead of whitelisting. If you check the Declude JunkMail log files, you can find out what tests the E-mails are failing. You'll probably need to first check the IMail SMTP log files to find the spool file name (or you can look at the X-Declude-Spoolname: header for the spool file name), which is used to search the Declude log files. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
