[Declude.JunkMail] SKIPIFWEIGHT possible bug?
Scott, Ok, I have finally gotten around to modifying my filters to use some of the new features. It definitely is having an impact on my processor from what I can see. I think I have uncovered a bug or bugs though in terms of how thresholds are calculated and how it affects processing and logging. I have a SPAMTRAPS filter with a SKIPIFWEIGHT set and a line which got hit as follows: SKIPIFWEIGHT30 ALLRECIPS15CONTAINS[EMAIL PROTECTED] I delete messages at a score of 30, however I found the following message (headers) in my holding account which scored a 29, but didn't get any scoring from hitting my SPAMTRAPS filter with the above address: X-MailPure: X-MailPure: SPAMCOP: Listed in bl.spamcop.net X-MailPure: FIVETEN-SPAMSUPPORT: Listed in blackholes.five-ten-sg.com X-MailPure: MAILPOLICE-BULK: Listed in bulk.rhs.mailpolice.com X-MailPure: MAILPOLICE-PORN: Listed in porn.rhs.mailpolice.com X-MailPure: NOLEGITCONTENT: No legitimate content detected. X-MailPure: RECIPIENTS: [EMAIL PROTECTED] X-MailPure: X-MailPure: Spam Score: 29 X-MailPure: Scan Time: 17:38:53 on 12/02/2003 X-MailPure: Spool File: D147103b1007e35c8.SMD X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: mail117.alukud.com [67.30.133.117] X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: It seems that the order of adding points is a bit off from what I was expecting. The message should have been processed by the SPAMTRAPS filter (I believe it was), and then another 15 points should have been added which would have pushed it to 44 points and my deletion level. I searched my logs for this message to verify the results and found that there was no entry for this message in my Declude JunkMail log. Yes, really, no entry at all :) I did verify that my custom WARN action was configured for my SPAMTRAPS test and the combination of the positive and negative weighted tests indicated in the headers do equal a score of 29. Feel free to ask for a zip of the supporting files if you need them. Thanks, Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SKIPIFWEIGHT possible bug?
Ok, I have finally gotten around to modifying my filters to use some of the new features. It definitely is having an impact on my processor from what I can see. I think I have uncovered a bug or bugs though in terms of how thresholds are calculated and how it affects processing and logging. The first thing to do is make sure that you are running the latest interim release (1.76i29), and see if the problem continues. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SKIPIFWEIGHT possible bug?
Scott, I was on 1.76i28 but upgraded as suggested, and I was able to verify that the filter is now hit when the score is within the difference in points from the SKIPIFWEIGHT and it is logged. I'm not totally sure if this perfectly represents the original issue, though I tried to mimic the functionality as best I could (I couldn't add 29 points from DNS based tests before the filters, I had to do it with filters alone). I'm guessing though that this was a known problem and fixed in that release. Thanks. Matt R. Scott Perry wrote: Ok, I have finally gotten around to modifying my filters to use some of the new features. It definitely is having an impact on my processor from what I can see. I think I have uncovered a bug or bugs though in terms of how thresholds are calculated and how it affects processing and logging. The first thing to do is make sure that you are running the latest interim release (1.76i29), and see if the problem continues. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
