subject:"RE\: \[Declude.JunkMail\] Filter \?"

Wow - really? When was that changed? I know that the filter test itself
did not show as failed, but the WEIGHT always carried over!
 
Take a look at Scott's reply when this feature was implemented and the
weight-result of the END was being discussed:
http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html
 
[1] the E-mail will stop processing, 
[2] the test will *not* fail (this may change -- I'm not sure why it was set
up that way), and 
[3] the weight will be exactly what it should have been when END was
reached.
 
And it's only logical.
 
If you WANTED a filter to return 0, then you would simply place the 'END'
lines at the BEGINNING of the Filter!
 
If you place the 'END' line behind other lines that accumulated weight, then
it clearly is the intention that the weights be COUNTED and that only any
FURTHER weights not be added!


Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, November 17, 2006 10:06 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?


The END function means END the filter and do not add any of the points for
that filter. If the END condition is met it is as if the filter never ran.

David B
www.declude.com

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:00 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?


Hi,
 
Can anyone confirm that the 'END' statement is functioning properly. I've
been noticing/suspecting that certain test combinations had much too little
weights and I finally have time to debug that.
 
This is the entry in the GLOBAL.CFG
 

CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0


Means - the filter itself has a weight of 0 - all weights would be assigned
IN the filter
 
Here CONTENTfilter.txt:
 

SKIPIFWEIGHT 20
MAXWEIGHT 9
 
TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP
 
TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED 6 CONTAINS INV-URIBL-WT3
TESTSFAILED 7 CONTAINS INV-URIBL-WT4
 
TESTSFAILED END CONTAINS SPAMCOP
TESTSFAILED END CONTAINS NJABLSOURCES
TESTSFAILED END CONTAINS AHBLSOURCES
TESTSFAILED END CONTAINS AHBLPSSL
TESTSFAILED END CONTAINS SORBS-SPAM
TESTSFAILED END CONTAINS SENDERDB-BLOCK
TESTSFAILED END CONTAINS SBL
 
TESTSFAILED 2 CONTAINS SNIFFER-IP

As far as I can tell, the Filter works fine as long as there is only SNIFFER
and/or URIBL and will return the proper weights around 7 through 9.  
 
However, if it hits the END statement is appears as if it always returns
ZERO.  In other words, it loses the weight that had been accumulated up to
that point.
 
Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 
 

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

2006-11-17 Thread David Barker

Andy,
 
The post says it's actually set up right now so that:

[1] the E-mail will stop processing, 
[2] the test will *not* fail (this may change -- I'm not sure why it was set
up that way), and 
[3] the weight will be exactly what it should have been when END was
reached.

Which means that Scott may have changed it, checking the release notes for
1.77

JM ADD filter test type now can have END in place of the weight
(any match will 'turn off' test)

We certainly have not changed the code.

I have added the STOP suggestion to our wishlist

David




From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:42 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High


Wow - really? When was that changed? I know that the filter test itself
did not show as failed, but the WEIGHT always carried over!
 
Take a look at Scott's reply when this feature was implemented and the
weight-result of the END was being discussed:
http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html
 
[1] the E-mail will stop processing, 
[2] the test will *not* fail (this may change -- I'm not sure why it was set
up that way), and 
[3] the weight will be exactly what it should have been when END was
reached.
 
And it's only logical.
 
If you WANTED a filter to return 0, then you would simply place the 'END'
lines at the BEGINNING of the Filter!
 
If you place the 'END' line behind other lines that accumulated weight, then
it clearly is the intention that the weights be COUNTED and that only any
FURTHER weights not be added!


Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 



From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, November 17, 2006 10:06 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?


The END function means END the filter and do not add any of the points for
that filter. If the END condition is met it is as if the filter never ran.

David B
www.declude.com



From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:00 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?


Hi,
 
Can anyone confirm that the 'END' statement is functioning properly. I've
been noticing/suspecting that certain test combinations had much too little
weights and I finally have time to debug that.
 
This is the entry in the GLOBAL.CFG
 

CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0


Means - the filter itself has a weight of 0 - all weights would be assigned
IN the filter
 
Here CONTENTfilter.txt:
 

SKIPIFWEIGHT 20
MAXWEIGHT 9
 
TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP
 
TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED 6 CONTAINS INV-URIBL-WT3
TESTSFAILED 7 CONTAINS INV-URIBL-WT4
 
TESTSFAILED END CONTAINS SPAMCOP
TESTSFAILED END CONTAINS NJABLSOURCES
TESTSFAILED END CONTAINS AHBLSOURCES
TESTSFAILED END CONTAINS AHBLPSSL
TESTSFAILED END CONTAINS SORBS-SPAM
TESTSFAILED END CONTAINS SENDERDB-BLOCK
TESTSFAILED END CONTAINS SBL
 
TESTSFAILED 2 CONTAINS SNIFFER-IP

As far as I can tell, the Filter works fine as long as there is only SNIFFER
and/or URIBL and will return the proper weights around 7 through 9.  
 
However, if it hits the END statement is appears as if it always returns
ZERO.  In other words, it loses the weight that had been accumulated up to
that point.
 
Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 
 

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

2006-11-17 Thread Craig Edmonds

me too.
 
I thought the purpose of the end function was so that if the email reaches a
certain weight, like 50, declude drops any further tests, thus saving
precious CPU.
 
Kindest Regards
Craig Edmonds
123 Marbella Internet
W: www.123marbella.com http://www.123marbella.com/ 
E : [EMAIL PROTECTED]
  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 4:42 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High


Wow - really? When was that changed? I know that the filter test itself
did not show as failed, but the WEIGHT always carried over!
 
Take a look at Scott's reply when this feature was implemented and the
weight-result of the END was being discussed:
http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html
 
[1] the E-mail will stop processing, 
[2] the test will *not* fail (this may change -- I'm not sure why it was set
up that way), and 
[3] the weight will be exactly what it should have been when END was
reached.
 
And it's only logical.
 
If you WANTED a filter to return 0, then you would simply place the 'END'
lines at the BEGINNING of the Filter!
 
If you place the 'END' line behind other lines that accumulated weight, then
it clearly is the intention that the weights be COUNTED and that only any
FURTHER weights not be added!


Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, November 17, 2006 10:06 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?


The END function means END the filter and do not add any of the points for
that filter. If the END condition is met it is as if the filter never ran.

David B
www.declude.com

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:00 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?


Hi,
 
Can anyone confirm that the 'END' statement is functioning properly. I've
been noticing/suspecting that certain test combinations had much too little
weights and I finally have time to debug that.
 
This is the entry in the GLOBAL.CFG
 

CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0


Means - the filter itself has a weight of 0 - all weights would be assigned
IN the filter
 
Here CONTENTfilter.txt:
 

SKIPIFWEIGHT 20
MAXWEIGHT 9
 
TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP
 
TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED 6 CONTAINS INV-URIBL-WT3
TESTSFAILED 7 CONTAINS INV-URIBL-WT4
 
TESTSFAILED END CONTAINS SPAMCOP
TESTSFAILED END CONTAINS NJABLSOURCES
TESTSFAILED END CONTAINS AHBLSOURCES
TESTSFAILED END CONTAINS AHBLPSSL
TESTSFAILED END CONTAINS SORBS-SPAM
TESTSFAILED END CONTAINS SENDERDB-BLOCK
TESTSFAILED END CONTAINS SBL
 
TESTSFAILED 2 CONTAINS SNIFFER-IP

As far as I can tell, the Filter works fine as long as there is only SNIFFER
and/or URIBL and will return the proper weights around 7 through 9.  
 
However, if it hits the END statement is appears as if it always returns
ZERO.  In other words, it loses the weight that had been accumulated up to
that point.
 
Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 
 

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Darn - I got burned.
 
Some interims release in 2004 changed the END behavior - where it stopped
carrying over the weight:
http://www.mail-archive.com/declude.junkmail@declude.com/msg20850.html
 
This behavior makes NO sense at all. But now that I've upgraded Imail and
Declude there's no way going back. For now I'll have to work around it and
change my filters.
 
Yes, if the 'END' now behaves like a 'CANCEL', then we need a 'STOP'
directive to restore the previous capability of using filters to simulate
and/or conditions in a somewhat efficient manner.
 
This is a huge gotcha!


Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Friday, November 17, 2006 10:33 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?


Can we request a STOP function that woul dstop the filter and exit with the
current weight?

- Original Message - 
From: David  mailto:[EMAIL PROTECTED] Barker 
To: declude.junkmail@declude.com 
Sent: Friday, November 17, 2006 9:05 AM
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

The END function means END the filter and do not add any of the points for
that filter. If the END condition is met it is as if the filter never ran.


David B
www.declude.com

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:00 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?


Hi,
 
Can anyone confirm that the 'END' statement is functioning properly. I've
been noticing/suspecting that certain test combinations had much too little
weights and I finally have time to debug that.
 
This is the entry in the GLOBAL.CFG
 

CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0


Means - the filter itself has a weight of 0 - all weights would be assigned
IN the filter
 
Here CONTENTfilter.txt:
 

SKIPIFWEIGHT 20
MAXWEIGHT 9
 
TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP
 
TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED 6 CONTAINS INV-URIBL-WT3
TESTSFAILED 7 CONTAINS INV-URIBL-WT4
 
TESTSFAILED END CONTAINS SPAMCOP
TESTSFAILED END CONTAINS NJABLSOURCES
TESTSFAILED END CONTAINS AHBLSOURCES
TESTSFAILED END CONTAINS AHBLPSSL
TESTSFAILED END CONTAINS SORBS-SPAM
TESTSFAILED END CONTAINS SENDERDB-BLOCK
TESTSFAILED END CONTAINS SBL
 
TESTSFAILED 2 CONTAINS SNIFFER-IP

As far as I can tell, the Filter works fine as long as there is only SNIFFER
and/or URIBL and will return the proper weights around 7 through 9.  
 
However, if it hits the END statement is appears as if it always returns
ZERO.  In other words, it loses the weight that had been accumulated up to
that point.
 
Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 
 

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Hi Craig,
 
no actually, that you CAN accomplish with the 
 
SKIPIFWEIGHT 20
MAXWEIGHT 9
 
directives at the beginning of the filter.


Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig
Edmonds
Sent: Friday, November 17, 2006 10:57 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High


me too.
 
I thought the purpose of the end function was so that if the email reaches a
certain weight, like 50, declude drops any further tests, thus saving
precious CPU.
 
Kindest Regards
Craig Edmonds
123 Marbella Internet
W: www.123marbella.com http://www.123marbella.com/ 
E : [EMAIL PROTECTED]
  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 4:42 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High


Wow - really? When was that changed? I know that the filter test itself
did not show as failed, but the WEIGHT always carried over!
 
Take a look at Scott's reply when this feature was implemented and the
weight-result of the END was being discussed:
http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html
 
[1] the E-mail will stop processing, 
[2] the test will *not* fail (this may change -- I'm not sure why it was set
up that way), and 
[3] the weight will be exactly what it should have been when END was
reached.
 
And it's only logical.
 
If you WANTED a filter to return 0, then you would simply place the 'END'
lines at the BEGINNING of the Filter!
 
If you place the 'END' line behind other lines that accumulated weight, then
it clearly is the intention that the weights be COUNTED and that only any
FURTHER weights not be added!


Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, November 17, 2006 10:06 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?


The END function means END the filter and do not add any of the points for
that filter. If the END condition is met it is as if the filter never ran.

David B
www.declude.com

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:00 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?


Hi,
 
Can anyone confirm that the 'END' statement is functioning properly. I've
been noticing/suspecting that certain test combinations had much too little
weights and I finally have time to debug that.
 
This is the entry in the GLOBAL.CFG
 

CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0


Means - the filter itself has a weight of 0 - all weights would be assigned
IN the filter
 
Here CONTENTfilter.txt:
 

SKIPIFWEIGHT 20
MAXWEIGHT 9
 
TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP
 
TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED 6 CONTAINS INV-URIBL-WT3
TESTSFAILED 7 CONTAINS INV-URIBL-WT4
 
TESTSFAILED END CONTAINS SPAMCOP
TESTSFAILED END CONTAINS NJABLSOURCES
TESTSFAILED END CONTAINS AHBLSOURCES
TESTSFAILED END CONTAINS AHBLPSSL
TESTSFAILED END CONTAINS SORBS-SPAM
TESTSFAILED END CONTAINS SENDERDB-BLOCK
TESTSFAILED END CONTAINS SBL
 
TESTSFAILED 2 CONTAINS SNIFFER-IP

As far as I can tell, the Filter works fine as long as there is only SNIFFER
and/or URIBL and will return the proper weights around 7 through 9.  
 
However, if it hits the END statement is appears as if it always returns
ZERO.  In other words, it loses the weight that had been accumulated up to
that point.
 
Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 
 

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

The purpose of the END function was so that you could make some portion of a
filter conditional.
 
It was not meant to be a start of filter directive, it was meant to be
usable anywhere in the filter...
 
In fact, in the 2003 post Scott was musing that he might change the fact
that it's not counting the test as triggered - but in September 2004 users
apparently found out that instead it was made worse by resetting the weight
as well.

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig
Edmonds
Sent: Friday, November 17, 2006 10:57 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High


me too.
 
I thought the purpose of the end function was so that if the email reaches a
certain weight, like 50, declude drops any further tests, thus saving
precious CPU.
 
Kindest Regards
Craig Edmonds
123 Marbella Internet
W: www.123marbella.com http://www.123marbella.com/ 
E : [EMAIL PROTECTED]
  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 4:42 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High


Wow - really? When was that changed? I know that the filter test itself
did not show as failed, but the WEIGHT always carried over!
 
Take a look at Scott's reply when this feature was implemented and the
weight-result of the END was being discussed:
http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html
 
[1] the E-mail will stop processing, 
[2] the test will *not* fail (this may change -- I'm not sure why it was set
up that way), and 
[3] the weight will be exactly what it should have been when END was
reached.
 
And it's only logical.
 
If you WANTED a filter to return 0, then you would simply place the 'END'
lines at the BEGINNING of the Filter!
 
If you place the 'END' line behind other lines that accumulated weight, then
it clearly is the intention that the weights be COUNTED and that only any
FURTHER weights not be added!


Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, November 17, 2006 10:06 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?


The END function means END the filter and do not add any of the points for
that filter. If the END condition is met it is as if the filter never ran.

David B
www.declude.com

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:00 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?


Hi,
 
Can anyone confirm that the 'END' statement is functioning properly. I've
been noticing/suspecting that certain test combinations had much too little
weights and I finally have time to debug that.
 
This is the entry in the GLOBAL.CFG
 

CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0


Means - the filter itself has a weight of 0 - all weights would be assigned
IN the filter
 
Here CONTENTfilter.txt:
 

SKIPIFWEIGHT 20
MAXWEIGHT 9
 
TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP
 
TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED 6 CONTAINS INV-URIBL-WT3
TESTSFAILED 7 CONTAINS INV-URIBL-WT4
 
TESTSFAILED END CONTAINS SPAMCOP
TESTSFAILED END CONTAINS NJABLSOURCES
TESTSFAILED END CONTAINS AHBLSOURCES
TESTSFAILED END CONTAINS AHBLPSSL
TESTSFAILED END CONTAINS SORBS-SPAM
TESTSFAILED END CONTAINS SENDERDB-BLOCK
TESTSFAILED END CONTAINS SBL
 
TESTSFAILED 2 CONTAINS SNIFFER-IP

As far as I can tell, the Filter works fine as long as there is only SNIFFER
and/or URIBL and will return the proper weights around 7 through 9.  
 
However, if it hits the END statement is appears as if it always returns
ZERO.  In other words, it loses the weight that had been accumulated up to
that point.
 
Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 
 

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Nope, never was that way. You want to use MAXWEIGHT for that.

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig
Edmonds
Sent: Friday, November 17, 2006 7:57 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High

 

me too.

 

I thought the purpose of the end function was so that if the email reaches a
certain weight, like 50, declude drops any further tests, thus saving
precious CPU.

 

Kindest Regards
Craig Edmonds
123 Marbella Internet
W: www.123marbella.com http://www.123marbella.com/ 
E : [EMAIL PROTECTED]

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 4:42 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High

Wow - really? When was that changed? I know that the filter test itself
did not show as failed, but the WEIGHT always carried over!

 

Take a look at Scott's reply when this feature was implemented and the
weight-result of the END was being discussed:

http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

 

[1] the E-mail will stop processing, 
[2] the test will *not* fail (this may change -- I'm not sure why it was set
up that way), and 
[3] the weight will be exactly what it should have been when END was
reached.

 

And it's only logical.

 

If you WANTED a filter to return 0, then you would simply place the 'END'
lines at the BEGINNING of the Filter!

 

If you place the 'END' line behind other lines that accumulated weight, then
it clearly is the intention that the weights be COUNTED and that only any
FURTHER weights not be added!

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, November 17, 2006 10:06 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

The END function means END the filter and do not add any of the points for
that filter. If the END condition is met it is as if the filter never ran.


David B

www.declude.com

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:00 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Hi,

 

Can anyone confirm that the 'END' statement is functioning properly. I've
been noticing/suspecting that certain test combinations had much too little
weights and I finally have time to debug that.

 

This is the entry in the GLOBAL.CFG

 

CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0

Means - the filter itself has a weight of 0 - all weights would be assigned
IN the filter

 

Here CONTENTfilter.txt:

 

SKIPIFWEIGHT 20
MAXWEIGHT 9

 

TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP

 

TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED 6 CONTAINS INV-URIBL-WT3
TESTSFAILED 7 CONTAINS INV-URIBL-WT4

 

TESTSFAILED END CONTAINS SPAMCOP
TESTSFAILED END CONTAINS NJABLSOURCES
TESTSFAILED END CONTAINS AHBLSOURCES
TESTSFAILED END CONTAINS AHBLPSSL
TESTSFAILED END CONTAINS SORBS-SPAM
TESTSFAILED END CONTAINS SENDERDB-BLOCK
TESTSFAILED END CONTAINS SBL

 

TESTSFAILED 2 CONTAINS SNIFFER-IP

As far as I can tell, the Filter works fine as long as there is only SNIFFER
and/or URIBL and will return the proper weights around 7 through 9.  

 

However, if it hits the END statement is appears as if it always returns
ZERO.  In other words, it loses the weight that had been accumulated up to
that point.

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

END still works the way Scott intended it to work, ENDs the filter at that
point with no fail.

No need to add STOP.

John T
eServices For You

Life is a succession of lessons which must be lived to be understood.
Ralph Waldo Emerson (1802-1882)



 -Original Message-
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
 Barker
 Sent: Friday, November 17, 2006 7:53 AM
 To: declude.junkmail@declude.com
 Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
 
 Andy,
 
 The post says it's actually set up right now so that:
 
 [1] the E-mail will stop processing,
 [2] the test will *not* fail (this may change -- I'm not sure why it was
set
 up that way), and
 [3] the weight will be exactly what it should have been when END was
 reached.
 
 Which means that Scott may have changed it, checking the release notes for
 1.77
 
 JM   ADD filter test type now can have END in place of the weight
 (any match will 'turn off' test)
 
 We certainly have not changed the code.
 
 I have added the STOP suggestion to our wishlist
 
 David
 
 
 
 
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
 Schmidt
 Sent: Friday, November 17, 2006 10:42 AM
 To: declude.junkmail@declude.com
 Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
 WEIGHT?
 Importance: High
 
 
 Wow - really? When was that changed? I know that the filter test itself
 did not show as failed, but the WEIGHT always carried over!
 
 Take a look at Scott's reply when this feature was implemented and the
 weight-result of the END was being discussed:
 http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html
 
 [1] the E-mail will stop processing,
 [2] the test will *not* fail (this may change -- I'm not sure why it was
set
 up that way), and
 [3] the weight will be exactly what it should have been when END was
 reached.
 
 And it's only logical.
 
 If you WANTED a filter to return 0, then you would simply place the 'END'
 lines at the BEGINNING of the Filter!
 
 If you place the 'END' line behind other lines that accumulated weight,
then
 it clearly is the intention that the weights be COUNTED and that only any
 FURTHER weights not be added!
 
 
 Best Regards
 Andy Schmidt
 
 Phone:  +1 201 934-3414 x20 (Business)
 Fax:+1 201 934-9206
 
 
 
 
 
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
 Barker
 Sent: Friday, November 17, 2006 10:06 AM
 To: declude.junkmail@declude.com
 Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
 WEIGHT?
 
 
 The END function means END the filter and do not add any of the points for
 that filter. If the END condition is met it is as if the filter never ran.
 
 David B
 www.declude.com
 
 
 
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
 Schmidt
 Sent: Friday, November 17, 2006 10:00 AM
 To: declude.junkmail@declude.com
 Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
 
 
 Hi,
 
 Can anyone confirm that the 'END' statement is functioning properly. I've
 been noticing/suspecting that certain test combinations had much too
little
 weights and I finally have time to debug that.
 
 This is the entry in the GLOBAL.CFG
 
 
   CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0
 
 
 Means - the filter itself has a weight of 0 - all weights would be
assigned
 IN the filter
 
 Here CONTENTfilter.txt:
 
 
   SKIPIFWEIGHT 20
   MAXWEIGHT 9
 
   TESTSFAILED 7 CONTAINS SNIFFER
   TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
   TESTSFAILED 1 CONTAINS SNIFFER-PORN
   TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
   TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
   TESTSFAILED -2 CONTAINS SNIFFER-IP
 
   TESTSFAILED 4 CONTAINS INV-URIBL-WT1
   TESTSFAILED 5 CONTAINS INV-URIBL-WT2
   TESTSFAILED 6 CONTAINS INV-URIBL-WT3
   TESTSFAILED 7 CONTAINS INV-URIBL-WT4
 
   TESTSFAILED END CONTAINS SPAMCOP
   TESTSFAILED END CONTAINS NJABLSOURCES
   TESTSFAILED END CONTAINS AHBLSOURCES
   TESTSFAILED END CONTAINS AHBLPSSL
   TESTSFAILED END CONTAINS SORBS-SPAM
   TESTSFAILED END CONTAINS SENDERDB-BLOCK
   TESTSFAILED END CONTAINS SBL
 
   TESTSFAILED 2 CONTAINS SNIFFER-IP
 
 As far as I can tell, the Filter works fine as long as there is only
SNIFFER
 and/or URIBL and will return the proper weights around 7 through 9.
 
 However, if it hits the END statement is appears as if it always returns
 ZERO.  In other words, it loses the weight that had been accumulated up to
 that point.
 
 Best Regards
 Andy Schmidt
 
 Phone:  +1 201 934-3414 x20 (Business)
 Fax:+1 201 934-9206
 
 
 ---
 This E-mail came from the Declude.JunkMail mailing list. To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail. The archives can be found
 at http://www.mail-archive.com

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Was never changed. Look at the directives. END means end the filter. What
you should have been using is MAXWEIGHT at the top, or STOPATFIRSTHIT.

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 7:42 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High

 

Wow - really? When was that changed? I know that the filter test itself
did not show as failed, but the WEIGHT always carried over!

 

Take a look at Scott's reply when this feature was implemented and the
weight-result of the END was being discussed:

http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

 

[1] the E-mail will stop processing, 
[2] the test will *not* fail (this may change -- I'm not sure why it was set
up that way), and 
[3] the weight will be exactly what it should have been when END was
reached.

 

And it's only logical.

 

If you WANTED a filter to return 0, then you would simply place the 'END'
lines at the BEGINNING of the Filter!

 

If you place the 'END' line behind other lines that accumulated weight, then
it clearly is the intention that the weights be COUNTED and that only any
FURTHER weights not be added!

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, November 17, 2006 10:06 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

The END function means END the filter and do not add any of the points for
that filter. If the END condition is met it is as if the filter never ran.


David B

www.declude.com

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:00 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Hi,

 

Can anyone confirm that the 'END' statement is functioning properly. I've
been noticing/suspecting that certain test combinations had much too little
weights and I finally have time to debug that.

 

This is the entry in the GLOBAL.CFG

 

CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0

Means - the filter itself has a weight of 0 - all weights would be assigned
IN the filter

 

Here CONTENTfilter.txt:

 

SKIPIFWEIGHT 20
MAXWEIGHT 9

 

TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP

 

TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED 6 CONTAINS INV-URIBL-WT3
TESTSFAILED 7 CONTAINS INV-URIBL-WT4

 

TESTSFAILED END CONTAINS SPAMCOP
TESTSFAILED END CONTAINS NJABLSOURCES
TESTSFAILED END CONTAINS AHBLSOURCES
TESTSFAILED END CONTAINS AHBLPSSL
TESTSFAILED END CONTAINS SORBS-SPAM
TESTSFAILED END CONTAINS SENDERDB-BLOCK
TESTSFAILED END CONTAINS SBL

 

TESTSFAILED 2 CONTAINS SNIFFER-IP

As far as I can tell, the Filter works fine as long as there is only SNIFFER
and/or URIBL and will return the proper weights around 7 through 9.  

 

However, if it hits the END statement is appears as if it always returns
ZERO.  In other words, it loses the weight that had been accumulated up to
that point.

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

2006-11-17 Thread Scott Fisher

Just because it's the way the Scott wanted it, doesn't mean there isn't room 
for improvement.

Especially when he changed the functionality of it mid-stream.

I'd still like the STOP option.

- Original Message - 
From: John T (Lists) [EMAIL PROTECTED]

To: declude.junkmail@declude.com
Sent: Friday, November 17, 2006 10:33 AM
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes 
WEIGHT?



END still works the way Scott intended it to work, ENDs the filter at that
point with no fail.

No need to add STOP.

John T
eServices For You

Life is a succession of lessons which must be lived to be understood.
Ralph Waldo Emerson (1802-1882)




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, November 17, 2006 7:53 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes

WEIGHT?


Andy,

The post says it's actually set up right now so that:

[1] the E-mail will stop processing,
[2] the test will *not* fail (this may change -- I'm not sure why it was

set

up that way), and
[3] the weight will be exactly what it should have been when END was
reached.

Which means that Scott may have changed it, checking the release notes for
1.77

JM ADD filter test type now can have END in place of the weight
(any match will 'turn off' test)

We certainly have not changed the code.

I have added the STOP suggestion to our wishlist

David




From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:42 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High


Wow - really? When was that changed? I know that the filter test itself
did not show as failed, but the WEIGHT always carried over!

Take a look at Scott's reply when this feature was implemented and the
weight-result of the END was being discussed:
http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

[1] the E-mail will stop processing,
[2] the test will *not* fail (this may change -- I'm not sure why it was

set

up that way), and
[3] the weight will be exactly what it should have been when END was
reached.

And it's only logical.

If you WANTED a filter to return 0, then you would simply place the 'END'
lines at the BEGINNING of the Filter!

If you place the 'END' line behind other lines that accumulated weight,

then

it clearly is the intention that the weights be COUNTED and that only any
FURTHER weights not be added!


Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206





From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, November 17, 2006 10:06 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?


The END function means END the filter and do not add any of the points for
that filter. If the END condition is met it is as if the filter never ran.

David B
www.declude.com



From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:00 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes

WEIGHT?



Hi,

Can anyone confirm that the 'END' statement is functioning properly. I've
been noticing/suspecting that certain test combinations had much too

little

weights and I finally have time to debug that.

This is the entry in the GLOBAL.CFG


CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0


Means - the filter itself has a weight of 0 - all weights would be

assigned

IN the filter

Here CONTENTfilter.txt:


SKIPIFWEIGHT 20
MAXWEIGHT 9

TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP

TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED 6 CONTAINS INV-URIBL-WT3
TESTSFAILED 7 CONTAINS INV-URIBL-WT4

TESTSFAILED END CONTAINS SPAMCOP
TESTSFAILED END CONTAINS NJABLSOURCES
TESTSFAILED END CONTAINS AHBLSOURCES
TESTSFAILED END CONTAINS AHBLPSSL
TESTSFAILED END CONTAINS SORBS-SPAM
TESTSFAILED END CONTAINS SENDERDB-BLOCK
TESTSFAILED END CONTAINS SBL

TESTSFAILED 2 CONTAINS SNIFFER-IP

As far as I can tell, the Filter works fine as long as there is only

SNIFFER

and/or URIBL and will return the proper weights around 7 through 9.

However, if it hits the END statement is appears as if it always returns
ZERO.  In other words, it loses the weight that had been accumulated up to
that point.

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206


---
This E-mail came from the Declude.JunkMail mailing list

Re: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

2006-11-17 Thread Scott Fisher

The END functionality was changed over a year ago. (I couldn't get to the 
release notes to check when)

When I first started using end, it would end the filter and return the current 
weight of the filter.
  - Original Message - 
  From: John T (Lists) 
  To: declude.junkmail@declude.com 
  Sent: Friday, November 17, 2006 10:34 AM
  Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes 
WEIGHT?

  Was never changed. Look at the directives. END means end the filter. What you 
should have been using is MAXWEIGHT at the top, or STOPATFIRSTHIT.

  John T

  eServices For You

  Life is a succession of lessons which must be lived to be understood.

  Ralph Waldo Emerson (1802-1882)

  -Original Message-
  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt
  Sent: Friday, November 17, 2006 7:42 AM
  To: declude.junkmail@declude.com
  Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes 
WEIGHT?
  Importance: High

  Wow - really? When was that changed? I know that the filter test itself did 
not show as failed, but the WEIGHT always carried over!

  Take a look at Scott's reply when this feature was implemented and the 
weight-result of the END was being discussed:

  http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

  [1] the E-mail will stop processing, 
  [2] the test will *not* fail (this may change -- I'm not sure why it was set 
up that way), and 
  [3] the weight will be exactly what it should have been when END was reached.

  And it's only logical.

  If you WANTED a filter to return 0, then you would simply place the 'END' 
lines at the BEGINNING of the Filter!

  If you place the 'END' line behind other lines that accumulated weight, then 
it clearly is the intention that the weights be COUNTED and that only any 
FURTHER weights not be added!

  Best Regards
  Andy Schmidt

  Phone:  +1 201 934-3414 x20 (Business)
  Fax:+1 201 934-9206 

--

  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker
  Sent: Friday, November 17, 2006 10:06 AM
  To: declude.junkmail@declude.com
  Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes 
WEIGHT?

  The END function means END the filter and do not add any of the points for 
that filter. If the END condition is met it is as if the filter never ran.

  David B

  www.declude.com

--

  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt
  Sent: Friday, November 17, 2006 10:00 AM
  To: declude.junkmail@declude.com
  Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

  Hi,

  Can anyone confirm that the 'END' statement is functioning properly. I've 
been noticing/suspecting that certain test combinations had much too little 
weights and I finally have time to debug that.

  This is the entry in the GLOBAL.CFG

CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0

  Means - the filter itself has a weight of 0 - all weights would be assigned 
IN the filter

  Here CONTENTfilter.txt:

SKIPIFWEIGHT 20
MAXWEIGHT 9

TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP

TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED 6 CONTAINS INV-URIBL-WT3
TESTSFAILED 7 CONTAINS INV-URIBL-WT4

TESTSFAILED END CONTAINS SPAMCOP
TESTSFAILED END CONTAINS NJABLSOURCES
TESTSFAILED END CONTAINS AHBLSOURCES
TESTSFAILED END CONTAINS AHBLPSSL
TESTSFAILED END CONTAINS SORBS-SPAM
TESTSFAILED END CONTAINS SENDERDB-BLOCK
TESTSFAILED END CONTAINS SBL

TESTSFAILED 2 CONTAINS SNIFFER-IP

  As far as I can tell, the Filter works fine as long as there is only SNIFFER 
and/or URIBL and will return the proper weights around 7 through 9.  

  However, if it hits the END statement is appears as if it always returns 
ZERO.  In other words, it loses the weight that had been accumulated up to that 
point.

  Best Regards
  Andy Schmidt

  Phone:  +1 201 934-3414 x20 (Business)
  Fax:+1 201 934-9206 

  ---
  This E-mail came from the Declude.JunkMail mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type unsubscribe Declude.JunkMail. The archives can be found
  at http://www.mail-archive.com. 
  ---
  This E-mail came from the Declude.JunkMail mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type unsubscribe Declude.JunkMail. The archives can be found
  at http://www.mail-archive.com. 

  ---
  This E-mail came from the Declude.JunkMail mailing list

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Hi John,
 
 Was never changed. 
 
Please read the URL I posted:
http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html
 
As you can tell, ORIGINALLY it did return the weight. He was thinking of it
even FAILING the test (if there was a weight).
 
 What you should have been using is MAXWEIGHT at the top, or
STOPATFIRSTHIT. 
 
Kindly, please read the sample I had posted (bottom of this message). Your
reply doesn't address the issue of trying to make some sections of a test
conditional. Example, the goal is to return either 1 or 2 or 3 if test1 or
test2 occur with test3 - and to only add test4 and test5, if test3 is not
true.
 

SKIPIFWEIGHT 20

MAXWEIGHT 3

 

TESTSFAILED 1 CONTAINS test1
TESTSFAILED 1 CONTAINS test2

 

TESTSFAILED END CONTAINS test3

 

TESTSFAILED 1 CONTAINS test4

TESTSFAILED 1 CONTAINS test5

etc etc

 

Please demonstrate how MAXWEIGHT or STOPATFIRSTHIT would do this in a single
filter?

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 11:34 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?



Was never changed. Look at the directives. END means end the filter. What
you should have been using is MAXWEIGHT at the top, or STOPATFIRSTHIT.

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 7:42 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High

 

Wow - really? When was that changed? I know that the filter test itself
did not show as failed, but the WEIGHT always carried over!

 

Take a look at Scott's reply when this feature was implemented and the
weight-result of the END was being discussed:

http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

 

[1] the E-mail will stop processing, 
[2] the test will *not* fail (this may change -- I'm not sure why it was set
up that way), and 
[3] the weight will be exactly what it should have been when END was
reached.

 

And it's only logical.

 

If you WANTED a filter to return 0, then you would simply place the 'END'
lines at the BEGINNING of the Filter!

 

If you place the 'END' line behind other lines that accumulated weight, then
it clearly is the intention that the weights be COUNTED and that only any
FURTHER weights not be added!

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, November 17, 2006 10:06 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

The END function means END the filter and do not add any of the points for
that filter. If the END condition is met it is as if the filter never ran.


David B

www.declude.com

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:00 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Hi,

 

Can anyone confirm that the 'END' statement is functioning properly. I've
been noticing/suspecting that certain test combinations had much too little
weights and I finally have time to debug that.

 

This is the entry in the GLOBAL.CFG

 

CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0

Means - the filter itself has a weight of 0 - all weights would be assigned
IN the filter

 

Here CONTENTfilter.txt:

 

SKIPIFWEIGHT 20
MAXWEIGHT 9

 

TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP

 

TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED 6 CONTAINS INV-URIBL-WT3
TESTSFAILED 7 CONTAINS INV-URIBL-WT4

 

TESTSFAILED END CONTAINS SPAMCOP
TESTSFAILED END CONTAINS NJABLSOURCES
TESTSFAILED END CONTAINS AHBLSOURCES
TESTSFAILED END CONTAINS AHBLPSSL
TESTSFAILED END CONTAINS SORBS-SPAM
TESTSFAILED END CONTAINS SENDERDB-BLOCK
TESTSFAILED END CONTAINS SBL

 

TESTSFAILED 2 CONTAINS SNIFFER-IP

As far as I can tell, the Filter works fine as long as there is only SNIFFER
and/or URIBL and will return the proper weights around 7 through 9.  

 

However, if it hits the END statement is appears as if it always returns
ZERO.  In other words, it loses the weight that had been accumulated up to
that point.

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

 No need to add STOP.

Cool, then please educate me on how do you do this in a single filter:

  SKIPIFWEIGHT 20
  MAXWEIGHT 3

  #these weights will be always be added (if contains is true)
  TESTSFAILED 1 CONTAINS test1
  TESTSFAILED 1 CONTAINS test2

  # do not add more weight if test3 triggered
  TESTSFAILED STOP CONTAINS test3

  # these weights will only be added if test3 did not trigger
  TESTSFAILED 1 CONTAINS test4
  TESTSFAILED 1 CONTAINS test5

etc etc
 
Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 11:33 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

END still works the way Scott intended it to work, ENDs the filter at that
point with no fail.

No need to add STOP.

John T
eServices For You

Life is a succession of lessons which must be lived to be understood.
Ralph Waldo Emerson (1802-1882)



 -Original Message-
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
 David Barker
 Sent: Friday, November 17, 2006 7:53 AM
 To: declude.junkmail@declude.com
 Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 
 flushes
WEIGHT?
 
 Andy,
 
 The post says it's actually set up right now so that:
 
 [1] the E-mail will stop processing,
 [2] the test will *not* fail (this may change -- I'm not sure why it 
 was
set
 up that way), and
 [3] the weight will be exactly what it should have been when END was 
 reached.
 
 Which means that Scott may have changed it, checking the release notes 
 for
 1.77
 
 JM   ADD filter test type now can have END in place of the weight
 (any match will 'turn off' test)
 
 We certainly have not changed the code.
 
 I have added the STOP suggestion to our wishlist
 
 David
 
 
 
 
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
 Andy Schmidt
 Sent: Friday, November 17, 2006 10:42 AM
 To: declude.junkmail@declude.com
 Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 
 flushes WEIGHT?
 Importance: High
 
 
 Wow - really? When was that changed? I know that the filter test 
 itself did not show as failed, but the WEIGHT always carried over!
 
 Take a look at Scott's reply when this feature was implemented and the 
 weight-result of the END was being discussed:
 http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html
 
 [1] the E-mail will stop processing,
 [2] the test will *not* fail (this may change -- I'm not sure why it 
 was
set
 up that way), and
 [3] the weight will be exactly what it should have been when END was 
 reached.
 
 And it's only logical.
 
 If you WANTED a filter to return 0, then you would simply place the 'END'
 lines at the BEGINNING of the Filter!
 
 If you place the 'END' line behind other lines that accumulated 
 weight,
then
 it clearly is the intention that the weights be COUNTED and that only 
 any FURTHER weights not be added!
 
 
 Best Regards
 Andy Schmidt
 
 Phone:  +1 201 934-3414 x20 (Business)
 Fax:+1 201 934-9206
 
 
 
 
 
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
 David Barker
 Sent: Friday, November 17, 2006 10:06 AM
 To: declude.junkmail@declude.com
 Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 
 flushes WEIGHT?
 
 
 The END function means END the filter and do not add any of the points 
 for that filter. If the END condition is met it is as if the filter never
ran.
 
 David B
 www.declude.com
 
 
 
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
 Andy Schmidt
 Sent: Friday, November 17, 2006 10:00 AM
 To: declude.junkmail@declude.com
 Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
 
 
 Hi,
 
 Can anyone confirm that the 'END' statement is functioning properly. 
 I've been noticing/suspecting that certain test combinations had much 
 too
little
 weights and I finally have time to debug that.
 
 This is the entry in the GLOBAL.CFG
 
 
   CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0
 
 
 Means - the filter itself has a weight of 0 - all weights would be
assigned
 IN the filter
 
 Here CONTENTfilter.txt:
 
 
   SKIPIFWEIGHT 20
   MAXWEIGHT 9
 
   TESTSFAILED 7 CONTAINS SNIFFER
   TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
   TESTSFAILED 1 CONTAINS SNIFFER-PORN
   TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
   TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
   TESTSFAILED -2 CONTAINS SNIFFER-IP
 
   TESTSFAILED 4 CONTAINS INV-URIBL-WT1
   TESTSFAILED 5 CONTAINS INV-URIBL-WT2
   TESTSFAILED 6 CONTAINS INV-URIBL-WT3
   TESTSFAILED 7 CONTAINS INV-URIBL-WT4
 
   TESTSFAILED END CONTAINS SPAMCOP
   TESTSFAILED END CONTAINS NJABLSOURCES
   TESTSFAILED END CONTAINS AHBLSOURCES

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

That link only shows that Scott was thinking of changing it from 0 weight to
a fail which would have added the weight. That explains his point 3 in that
what ever the weight of the message was before the test will remain.
Remember, to add weight, the test must FAIL. He stated it did not FAIL and
therefore weight was never added. 

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 9:29 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

 

Hi John,

 

 Was never changed. 

 

Please read the URL I posted:

http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

 

As you can tell, ORIGINALLY it did return the weight. He was thinking of it
even FAILING the test (if there was a weight).

 

 What you should have been using is MAXWEIGHT at the top, or
STOPATFIRSTHIT. 

 

Kindly, please read the sample I had posted (bottom of this message). Your
reply doesn't address the issue of trying to make some sections of a test
conditional. Example, the goal is to return either 1 or 2 or 3 if test1 or
test2 occur with test3 - and to only add test4 and test5, if test3 is not
true.

 

SKIPIFWEIGHT 20

MAXWEIGHT 3

 

TESTSFAILED 1 CONTAINS test1
TESTSFAILED 1 CONTAINS test2

 

TESTSFAILED END CONTAINS test3

 

TESTSFAILED 1 CONTAINS test4

TESTSFAILED 1 CONTAINS test5

etc etc

 

Please demonstrate how MAXWEIGHT or STOPATFIRSTHIT would do this in a single
filter?

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 11:34 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

Was never changed. Look at the directives. END means end the filter. What
you should have been using is MAXWEIGHT at the top, or STOPATFIRSTHIT.

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 7:42 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High

 

Wow - really? When was that changed? I know that the filter test itself
did not show as failed, but the WEIGHT always carried over!

 

Take a look at Scott's reply when this feature was implemented and the
weight-result of the END was being discussed:

http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

 

[1] the E-mail will stop processing, 
[2] the test will *not* fail (this may change -- I'm not sure why it was set
up that way), and 
[3] the weight will be exactly what it should have been when END was
reached.

 

And it's only logical.

 

If you WANTED a filter to return 0, then you would simply place the 'END'
lines at the BEGINNING of the Filter!

 

If you place the 'END' line behind other lines that accumulated weight, then
it clearly is the intention that the weights be COUNTED and that only any
FURTHER weights not be added!

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, November 17, 2006 10:06 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

The END function means END the filter and do not add any of the points for
that filter. If the END condition is met it is as if the filter never ran.


David B

www.declude.com

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:00 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Hi,

 

Can anyone confirm that the 'END' statement is functioning properly. I've
been noticing/suspecting that certain test combinations had much too little
weights and I finally have time to debug that.

 

This is the entry in the GLOBAL.CFG

 

CONTENT  filter  D:\IMail\Declude\CONTENTfilter.txt x 0 0

Means - the filter itself has a weight of 0 - all weights would be assigned
IN the filter

 

Here CONTENTfilter.txt:

 

SKIPIFWEIGHT 20
MAXWEIGHT 9

 

TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP

 

TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Hi John,
 
you read it that way?
 
It's actually set up right now so that 
[1] the E-mail will stop processing, 
[2] the test will *not* fail (this may change -- I'm not sure why it was set
up that way), and 
[3] the weight will be exactly what it should have been when END was
reached.

If I read it, [1] and [3] (which is that the weight will be what it was when
END was reached) are stated as fact - and it regarding [2] (that the test
did NOT fail) he said this may change. My reading is, that the possible
change that the NOT fail might be changed to a fail?
 
Am I reading it wrong?


Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 01:05 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?



That link only shows that Scott was thinking of changing it from 0 weight to
a fail which would have added the weight. That explains his point 3 in that
what ever the weight of the message was before the test will remain.
Remember, to add weight, the test must FAIL. He stated it did not FAIL and
therefore weight was never added. 

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 9:29 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

 

Hi John,

 

 Was never changed. 

 

Please read the URL I posted:

http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

 

As you can tell, ORIGINALLY it did return the weight. He was thinking of it
even FAILING the test (if there was a weight).

 

 What you should have been using is MAXWEIGHT at the top, or
STOPATFIRSTHIT. 

 

Kindly, please read the sample I had posted (bottom of this message). Your
reply doesn't address the issue of trying to make some sections of a test
conditional. Example, the goal is to return either 1 or 2 or 3 if test1 or
test2 occur with test3 - and to only add test4 and test5, if test3 is not
true.

 

SKIPIFWEIGHT 20

MAXWEIGHT 3

 

TESTSFAILED 1 CONTAINS test1
TESTSFAILED 1 CONTAINS test2

 

TESTSFAILED END CONTAINS test3

 

TESTSFAILED 1 CONTAINS test4

TESTSFAILED 1 CONTAINS test5

etc etc

 

Please demonstrate how MAXWEIGHT or STOPATFIRSTHIT would do this in a single
filter?

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 11:34 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

Was never changed. Look at the directives. END means end the filter. What
you should have been using is MAXWEIGHT at the top, or STOPATFIRSTHIT.

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 7:42 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?
Importance: High

 

Wow - really? When was that changed? I know that the filter test itself
did not show as failed, but the WEIGHT always carried over!

 

Take a look at Scott's reply when this feature was implemented and the
weight-result of the END was being discussed:

http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

 

[1] the E-mail will stop processing, 
[2] the test will *not* fail (this may change -- I'm not sure why it was set
up that way), and 
[3] the weight will be exactly what it should have been when END was
reached.

 

And it's only logical.

 

If you WANTED a filter to return 0, then you would simply place the 'END'
lines at the BEGINNING of the Filter!

 

If you place the 'END' line behind other lines that accumulated weight, then
it clearly is the intention that the weights be COUNTED and that only any
FURTHER weights not be added!

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, November 17, 2006 10:06 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

The END function means END the filter and do not add any of the points for
that filter. If the END condition is met it is as if the filter never ran.


David B

www.declude.com

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

 Why the requirement of single filter? 
 
Clarity? It's easier for me to follow a logic, if it's enclosed in a SINGLE
source document (= filter).
 
If the logical is spread over multiple source documents, I have to first
scour the Global.CFG to see which filters are active, then inspect each one
to see if by chance any one of them might have any effect.


Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 12:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?



Why the requirement of single filter?

 

I have different combo filters created like this:

 

ComboFilterA

REM If testa and testb fail, and if testc or testd fail, add 10

ENDONFIRSTHIT

TESTSFAILED END NOTCONTAINS testa

TESTSFAILED END NOTCONTAINS testb

TESTSFAILED 10 CONTAINS testc

TESTSFAILED 10 CONTAINS testd

 

ComboFilterB

REM If testc and testd fail, and if teste or testf fail, add 20

ENDONFIRSTHIT

TESTSFAILED END NOTCONTAINS testc

TESTSFAILED END NOTCONTAINS testd

TESTSFAILED 10 CONTAINS teste

TESTSFAILED 10 CONTAINS testf

 

IMHO, that is a much cleaner and neater way to do it. You could also use
MAXWEIGHT instead of ENDONFIRSTHIT and then assign different weights to
different test.

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 9:29 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

 

Hi John,

 

 Was never changed. 

 

Please read the URL I posted:

http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

 

As you can tell, ORIGINALLY it did return the weight. He was thinking of it
even FAILING the test (if there was a weight).

 

 What you should have been using is MAXWEIGHT at the top, or
STOPATFIRSTHIT. 

 

Kindly, please read the sample I had posted (bottom of this message). Your
reply doesn't address the issue of trying to make some sections of a test
conditional. Example, the goal is to return either 1 or 2 or 3 if test1 or
test2 occur with test3 - and to only add test4 and test5, if test3 is not
true.

 

SKIPIFWEIGHT 20

MAXWEIGHT 3

 

TESTSFAILED 1 CONTAINS test1
TESTSFAILED 1 CONTAINS test2

 

TESTSFAILED END CONTAINS test3

 

TESTSFAILED 1 CONTAINS test4

TESTSFAILED 1 CONTAINS test5

etc etc

 

Please demonstrate how MAXWEIGHT or STOPATFIRSTHIT would do this in a single
filter?

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Any filter that I do not have as active is moved to \declude\filters\notused
from \declude\filtes so that my filters folder only contains filters that I
am currently using.

 

In your example, you are putting the IF statement after the THEN statement.
I am not a programmer, but IF (the test of what you want to be quantified)
always comes before THEN (the result you want to occur depending upon
whether the test of the quantification failed or passed, meaning did it meat
the criteria which is the defined IF statement), so the first part of your
example does not make any sense. You only want weight added if test3 failed,
so you have to quantify that FIRST and then say what occurs by adding
weight. 

 

So, you have to have to filters since both sections rely upon testing IF
test3 has failed or not.

 

What is the logic of the second part anyways, to add weight for test4 and
test5 IF test1 and test2 failed?

 

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:48 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

 

 Why the requirement of single filter? 

 

Clarity? It's easier for me to follow a logic, if it's enclosed in a SINGLE
source document (= filter).

 

If the logical is spread over multiple source documents, I have to first
scour the Global.CFG to see which filters are active, then inspect each one
to see if by chance any one of them might have any effect.

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 12:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

Why the requirement of single filter?

 

I have different combo filters created like this:

 

ComboFilterA

REM If testa and testb fail, and if testc or testd fail, add 10

ENDONFIRSTHIT

TESTSFAILED END NOTCONTAINS testa

TESTSFAILED END NOTCONTAINS testb

TESTSFAILED 10 CONTAINS testc

TESTSFAILED 10 CONTAINS testd

 

ComboFilterB

REM If testc and testd fail, and if teste or testf fail, add 20

ENDONFIRSTHIT

TESTSFAILED END NOTCONTAINS testc

TESTSFAILED END NOTCONTAINS testd

TESTSFAILED 10 CONTAINS teste

TESTSFAILED 10 CONTAINS testf

 

IMHO, that is a much cleaner and neater way to do it. You could also use
MAXWEIGHT instead of ENDONFIRSTHIT and then assign different weights to
different test.

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 9:29 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

 

Hi John,

 

 Was never changed. 

 

Please read the URL I posted:

http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

 

As you can tell, ORIGINALLY it did return the weight. He was thinking of it
even FAILING the test (if there was a weight).

 

 What you should have been using is MAXWEIGHT at the top, or
STOPATFIRSTHIT. 

 

Kindly, please read the sample I had posted (bottom of this message). Your
reply doesn't address the issue of trying to make some sections of a test
conditional. Example, the goal is to return either 1 or 2 or 3 if test1 or
test2 occur with test3 - and to only add test4 and test5, if test3 is not
true.

 

SKIPIFWEIGHT 20

MAXWEIGHT 3

 

TESTSFAILED 1 CONTAINS test1
TESTSFAILED 1 CONTAINS test2

 

TESTSFAILED END CONTAINS test3

 

TESTSFAILED 1 CONTAINS test4

TESTSFAILED 1 CONTAINS test5

etc etc

 

Please demonstrate how MAXWEIGHT or STOPATFIRSTHIT would do this in a single
filter?

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

2006-11-17 Thread Matt


Andy,

Using 'combo' filters is the way to go here.  It does work, and while 
extra functionality would ease such things, I have always been required 
to work within the framework and as a result I use many sets of combo 
filters to do exactly what you were trying to do here in one file.


It is good that END results in no hit for the filter.  If this changed, 
it would screw up my system in a big way, and probably result in me 
blocking virtually all legitimate E-mail.  There is a definite need for 
a function that aborts a filter entirely, and this is what Scott 
provided with END.


A STOP function would not be a bad idea, and to create ABORT in the 
place of END (same thing, different name), and depricating END as Andrew 
suggested in 2004 would make sense as far as confusion goes and also to 
add extra functionality, but that is in fact a feature request.


Matt



Andy Schmidt wrote:

 Why the requirement of single filter? 
 
Clarity? It's easier for me to follow a logic, if it's enclosed in a 
SINGLE source document (= filter).
 
If the logical is spread over multiple source documents, I have to 
first scour the Global.CFG to see which filters are active, 
then inspect each one to see if by chance any one of them might have 
any effect.


Best Regards
*/Andy Schmidt/*/
/
Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206

 



*From:* [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] *On Behalf Of 
*John T (Lists)

*Sent:* Friday, November 17, 2006 12:57 PM
*To:* declude.junkmail@declude.com
*Subject:* RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 
flushes WEIGHT?


Why the requirement of single filter?

 


I have different combo filters created like this:

 


ComboFilterA

REM If testa and testb fail, and if testc or testd fail, add 10

ENDONFIRSTHIT

TESTSFAILED END NOTCONTAINS testa

TESTSFAILED END NOTCONTAINS testb

TESTSFAILED 10 CONTAINS testc

TESTSFAILED 10 CONTAINS testd

 


ComboFilterB

REM If testc and testd fail, and if teste or testf fail, add 20

ENDONFIRSTHIT

TESTSFAILED END NOTCONTAINS testc

TESTSFAILED END NOTCONTAINS testd

TESTSFAILED 10 CONTAINS teste

TESTSFAILED 10 CONTAINS testf

 

IMHO, that is a much cleaner and neater way to do it. You could also 
use MAXWEIGHT instead of ENDONFIRSTHIT and then assign different 
weights to different test.


 


**John T**

**eServices For You**

 


*Life is a succession of lessons which must be lived to be understood.*

*Ralph Waldo Emerson (1802-1882)*

** 

 


-Original Message-
*From:* [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] *On Behalf Of 
*Andy Schmidt

*Sent:* Friday, November 17, 2006 9:29 AM
*To:* declude.junkmail@declude.com
*Subject:* RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 
flushes WEIGHT?


 


Hi John,

 


 Was never changed. 

 


Please read the URL I posted:

http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

 

As you can tell, ORIGINALLY it did return the weight. He was thinking 
of it even FAILING the test (if there was a weight).


 

 What you should have been using is MAXWEIGHT at the top, or 
STOPATFIRSTHIT. 


 

Kindly, please read the sample I had posted (bottom of this message). 
Your reply doesn't address the issue of trying to make some sections 
of a test conditional. Example, the goal is to return either 1 or 2 or 
3 if test1 or test2 occur with test3 - and to only add test4 and 
test5, if test3 is not true.


 


SKIPIFWEIGHT 20

MAXWEIGHT 3

 


TESTSFAILED 1 CONTAINS test1
TESTSFAILED 1 CONTAINS test2

 


TESTSFAILED END CONTAINS test3

 


TESTSFAILED 1 CONTAINS test4

TESTSFAILED 1 CONTAINS test5

etc etc

 

Please demonstrate how MAXWEIGHT or STOPATFIRSTHIT would do this in a 
single filter?


Best Regards
*/Andy Schmidt/*/
/
Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206

 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Hi John:
 
 What is the logic of the second part anyways, to add weight for test4 and
test5 IF test1 and test2 failed? 
 
If you have several blacklists of the same family (e.g., multiple open-relay
filters, or multiple open-proxy filters) I like to group them together.  I
give a big weight to the entire group (the filter itself) and then may add
an increment for blacklists with few false positives (each contains
clause).
 
Simiarly with Sniffer or invURIBL.  There is some overlap between those two,
and there is a potential overlap between Sniffer-IP and blacklists of
recent spam sources (e.g., SpamCop, MXRate-Block).
 
I have a filter that processes my various Sniffer types and invURIBL
returns. At some point, I'd like to stop and first look if certain other
Blacklist Tests had fired. If so, I'm done.  If not, I want to add a little
extra for Sniffer-IP.
 



Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 02:41 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?



Any filter that I do not have as active is moved to \declude\filters\notused
from \declude\filtes so that my filters folder only contains filters that I
am currently using.

 

In your example, you are putting the IF statement after the THEN statement.
I am not a programmer, but IF (the test of what you want to be quantified)
always comes before THEN (the result you want to occur depending upon
whether the test of the quantification failed or passed, meaning did it meat
the criteria which is the defined IF statement), so the first part of your
example does not make any sense. You only want weight added if test3 failed,
so you have to quantify that FIRST and then say what occurs by adding
weight. 

 

So, you have to have to filters since both sections rely upon testing IF
test3 has failed or not.

 

What is the logic of the second part anyways, to add weight for test4 and
test5 IF test1 and test2 failed?

 

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:48 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

 

 Why the requirement of single filter? 

 

Clarity? It's easier for me to follow a logic, if it's enclosed in a SINGLE
source document (= filter).

 

If the logical is spread over multiple source documents, I have to first
scour the Global.CFG to see which filters are active, then inspect each one
to see if by chance any one of them might have any effect.

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 12:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

Why the requirement of single filter?

 

I have different combo filters created like this:

 

ComboFilterA

REM If testa and testb fail, and if testc or testd fail, add 10

ENDONFIRSTHIT

TESTSFAILED END NOTCONTAINS testa

TESTSFAILED END NOTCONTAINS testb

TESTSFAILED 10 CONTAINS testc

TESTSFAILED 10 CONTAINS testd

 

ComboFilterB

REM If testc and testd fail, and if teste or testf fail, add 20

ENDONFIRSTHIT

TESTSFAILED END NOTCONTAINS testc

TESTSFAILED END NOTCONTAINS testd

TESTSFAILED 10 CONTAINS teste

TESTSFAILED 10 CONTAINS testf

 

IMHO, that is a much cleaner and neater way to do it. You could also use
MAXWEIGHT instead of ENDONFIRSTHIT and then assign different weights to
different test.

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 9:29 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

 

Hi John,

 

 Was never changed. 

 

Please read the URL I posted:

http://www.mail-archive.com/declude.junkmail@declude.com/msg14009.html

 

As you can tell, ORIGINALLY it did return the weight. He was thinking of it
even FAILING the test (if there was a weight).

 

 What you should have been using is MAXWEIGHT at the top, or
STOPATFIRSTHIT. 

 

Kindly, please read the sample I had posted (bottom of this message). Your
reply doesn't address the issue of trying to make some sections of a test
conditional. Example, the goal is to return either 1 or 2 or 3 if test1 or
test2 occur with test3 - and to only add test4

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

OK, I understand that better but you will always be better off grouping each
intent into a different combo filter. Then, you can even have a combo filter
dependent upon another combo filter by why of order of list and including
the name of the combo filter as an IF statement in the next one.

 

Combo filters need to be viewed as a different type of test rather than a
normal filter test. If you write down in groups want you want to do, it will
be easy to then create them.

 

Say if you want to add 12 if 4 or more rbl tests failed. You would create a
combo filter like this:

MINWEIGHTTOFAIL12

MAXWEIGHT12

TESTSFAILED 3CONTAINS rbl1

TESTSFAILED 3CONTAINS rbl2

TESTSFAILED 3CONTAINS rbl3

TESTSFAILED 3CONTAINS rbl4

TESTSFAILED 3CONTAINS rbl5

TESTSFAILED 3CONTAINS rbl6

TESTSFAILED 3CONTAINS rbl7

TESTSFAILED 3CONTAINS rbl8

 

That way, at least 4 have to hit to equal 12 before it will see this test as
failing, but it will only add 12 and not more.

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 2:13 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

 

Hi John:

 

 What is the logic of the second part anyways, to add weight for test4 and
test5 IF test1 and test2 failed? 

 

If you have several blacklists of the same family (e.g., multiple open-relay
filters, or multiple open-proxy filters) I like to group them together.  I
give a big weight to the entire group (the filter itself) and then may add
an increment for blacklists with few false positives (each contains
clause).

 

Simiarly with Sniffer or invURIBL.  There is some overlap between those two,
and there is a potential overlap between Sniffer-IP and blacklists of
recent spam sources (e.g., SpamCop, MXRate-Block).

 

I have a filter that processes my various Sniffer types and invURIBL
returns. At some point, I'd like to stop and first look if certain other
Blacklist Tests had fired. If so, I'm done.  If not, I want to add a little
extra for Sniffer-IP.

 

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 02:41 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

Any filter that I do not have as active is moved to \declude\filters\notused
from \declude\filtes so that my filters folder only contains filters that I
am currently using.

 

In your example, you are putting the IF statement after the THEN statement.
I am not a programmer, but IF (the test of what you want to be quantified)
always comes before THEN (the result you want to occur depending upon
whether the test of the quantification failed or passed, meaning did it meat
the criteria which is the defined IF statement), so the first part of your
example does not make any sense. You only want weight added if test3 failed,
so you have to quantify that FIRST and then say what occurs by adding
weight. 

 

So, you have to have to filters since both sections rely upon testing IF
test3 has failed or not.

 

What is the logic of the second part anyways, to add weight for test4 and
test5 IF test1 and test2 failed?

 

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:48 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

 

 Why the requirement of single filter? 

 

Clarity? It's easier for me to follow a logic, if it's enclosed in a SINGLE
source document (= filter).

 

If the logical is spread over multiple source documents, I have to first
scour the Global.CFG to see which filters are active, then inspect each one
to see if by chance any one of them might have any effect.

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 12:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

Why the requirement of single filter?

 

I have different combo filters created like this:

 

ComboFilterA

REM If testa and testb fail, and if testc or testd fail, add 10

ENDONFIRSTHIT

TESTSFAILED END NOTCONTAINS testa

TESTSFAILED END NOTCONTAINS

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

I'm familiar with MAXWEIGHT and I'm using it.
 
It doesn't address this particular application.
 
Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 05:52 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?



OK, I understand that better but you will always be better off grouping each
intent into a different combo filter. Then, you can even have a combo filter
dependent upon another combo filter by why of order of list and including
the name of the combo filter as an IF statement in the next one.

 

Combo filters need to be viewed as a different type of test rather than a
normal filter test. If you write down in groups want you want to do, it will
be easy to then create them.

 

Say if you want to add 12 if 4 or more rbl tests failed. You would create a
combo filter like this:

MINWEIGHTTOFAIL12

MAXWEIGHT12

TESTSFAILED 3CONTAINS rbl1

TESTSFAILED 3CONTAINS rbl2

TESTSFAILED 3CONTAINS rbl3

TESTSFAILED 3CONTAINS rbl4

TESTSFAILED 3CONTAINS rbl5

TESTSFAILED 3CONTAINS rbl6

TESTSFAILED 3CONTAINS rbl7

TESTSFAILED 3CONTAINS rbl8

 

That way, at least 4 have to hit to equal 12 before it will see this test as
failing, but it will only add 12 and not more.

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 2:13 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

 

Hi John:

 

 What is the logic of the second part anyways, to add weight for test4 and
test5 IF test1 and test2 failed? 

 

If you have several blacklists of the same family (e.g., multiple open-relay
filters, or multiple open-proxy filters) I like to group them together.  I
give a big weight to the entire group (the filter itself) and then may add
an increment for blacklists with few false positives (each contains
clause).

 

Simiarly with Sniffer or invURIBL.  There is some overlap between those two,
and there is a potential overlap between Sniffer-IP and blacklists of
recent spam sources (e.g., SpamCop, MXRate-Block).

 

I have a filter that processes my various Sniffer types and invURIBL
returns. At some point, I'd like to stop and first look if certain other
Blacklist Tests had fired. If so, I'm done.  If not, I want to add a little
extra for Sniffer-IP.

 

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 


  _  


From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)
Sent: Friday, November 17, 2006 02:41 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

Any filter that I do not have as active is moved to \declude\filters\notused
from \declude\filtes so that my filters folder only contains filters that I
am currently using.

 

In your example, you are putting the IF statement after the THEN statement.
I am not a programmer, but IF (the test of what you want to be quantified)
always comes before THEN (the result you want to occur depending upon
whether the test of the quantification failed or passed, meaning did it meat
the criteria which is the defined IF statement), so the first part of your
example does not make any sense. You only want weight added if test3 failed,
so you have to quantify that FIRST and then say what occurs by adding
weight. 

 

So, you have to have to filters since both sections rely upon testing IF
test3 has failed or not.

 

What is the logic of the second part anyways, to add weight for test4 and
test5 IF test1 and test2 failed?

 

 

John T

eServices For You

 

Life is a succession of lessons which must be lived to be understood.

Ralph Waldo Emerson (1802-1882)

 

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday, November 17, 2006 10:48 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?

 

 Why the requirement of single filter? 

 

Clarity? It's easier for me to follow a logic, if it's enclosed in a SINGLE
source document (= filter).

 

If the logical is spread over multiple source documents, I have to first
scour the Global.CFG to see which filters are active, then inspect each one
to see if by chance any one of them might have any effect.

 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

 

 


  _  


From: [EMAIL PROTECTED] [mailto

Re: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

2006-11-17 Thread Matt


Andy,

Taking your original filter, this is what you would do (note the 
NOTCONTAINS line in the second filter):


   # ADD-WEIGHT
   TESTSFAILED 7 CONTAINS SNIFFER
   TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
   TESTSFAILED 1 CONTAINS SNIFFER-PORN
   TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
   TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
   TESTSFAILED -2 CONTAINS SNIFFER-IP

   TESTSFAILED 4 CONTAINS INV-URIBL-WT1

   TESTSFAILED 5 CONTAINS INV-URIBL-WT2
   TESTSFAILED 6 CONTAINS INV-URIBL-WT3
   TESTSFAILED 7 CONTAINS INV-URIBL-WT4

   -


   # EXTRA-WEIGHT
   TESTSFAILED END NOTCONTAINS ADD-WEIGHT

   TESTSFAILED END CONTAINS SPAMCOP
   TESTSFAILED END CONTAINS NJABLSOURCES
   TESTSFAILED END CONTAINS AHBLSOURCES
   TESTSFAILED END CONTAINS AHBLPSSL
   TESTSFAILED END CONTAINS SORBS-SPAM
   TESTSFAILED END CONTAINS SENDERDB-BLOCK
   TESTSFAILED END CONTAINS SBL

   TESTSFAILED 2 CONTAINS SNIFFER-IP


In your Global.cfg, you would only need to make sure that ADD-WEIGHT 
appear before EXTRA-WEIGHT.


Matt





Andy Schmidt wrote:

I'm familiar with MAXWEIGHT and I'm using it.
 
It doesn't address this particular application.
 
Best Regards

*/Andy Schmidt/*/
/
Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206

-Original Message-
*From:* [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] *On
Behalf Of *John T (Lists)
*Sent:* Friday, November 17, 2006 05:52 PM
*To:* declude.junkmail@declude.com
*Subject:* RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14
flushes WEIGHT?

OK, I understand that better but you will always be better off
grouping each intent into a different combo filter. Then, you can
even have a combo filter dependent upon another combo filter by
why of order of list and including the name of the combo filter as
an IF statement in the next one.

 


Combo filters need to be viewed as a different type of test rather
than a normal filter test. If you write down in groups want you
want to do, it will be easy to then create them.

 


Say if you want to add 12 if 4 or more rbl tests failed. You would
create a combo filter like this:

MINWEIGHTTOFAIL12

MAXWEIGHT12

TESTSFAILED 3CONTAINS rbl1

TESTSFAILED 3CONTAINS rbl2

TESTSFAILED 3CONTAINS rbl3

TESTSFAILED 3CONTAINS rbl4

TESTSFAILED 3CONTAINS rbl5

TESTSFAILED 3CONTAINS rbl6

TESTSFAILED 3CONTAINS rbl7

TESTSFAILED 3CONTAINS rbl8

 


That way, at least 4 have to hit to equal 12 before it will see
this test as failing, but it will only add 12 and not more.

 


**John T**

**eServices For You**

 


*Life is a succession of lessons which must be lived to be
understood.*

*Ralph Waldo Emerson (1802-1882)*

** 

 


-Original Message-
*From:* [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] *On
Behalf Of *Andy Schmidt
*Sent:* Friday, November 17, 2006 2:13 PM
*To:* declude.junkmail@declude.com
*Subject:* RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14
flushes WEIGHT?

 


Hi John:

 


 What is the logic of the second part anyways, to add weight for
test4 and test5 IF test1 and test2 failed? 

 


If you have several blacklists of the same family (e.g., multiple
open-relay filters, or multiple open-proxy filters) I like to
group them together.  I give a big weight to the entire group (the
filter itself) and then may add an increment for blacklists with
few false positives (each contains clause).

 


Simiarly with Sniffer or invURIBL.  There is some overlap between
those two, and there is a potential overlap between Sniffer-IP and
blacklists of recent spam sources (e.g., SpamCop, MXRate-Block).

 


I have a filter that processes my various Sniffer types and
invURIBL returns. At some point, I'd like to stop and first look
if certain other Blacklist Tests had fired. If so, I'm done.  If
not, I want to add a little extra for Sniffer-IP.

 

 


Best Regards
*/Andy Schmidt/*/
/
Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206

 

 




*From:* [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] *On
Behalf Of *John T (Lists)
*Sent:* Friday, November 17, 2006 02:41 PM
*To:* declude.junkmail@declude.com
*Subject:* RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14
flushes WEIGHT?

Any filter that I do not have as active is moved to
\declude\filters\notused from \declude\filtes so that my filters
folder only contains filters that I am currently using.

 


In your example, you are putting the IF statement after the THEN
statement. I am not a programmer

RE: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes WEIGHT?

Yes, thanks Matt. Obviously, that's how I worked around it when I first
notice this issue this morning (to two filters with proper placement in the
Global.cfg.)
 
For simplicity of maintenance and for easier comprehension down the road, I
still hope that a STOP directive will be added so that this circumvention
won't be necessary any more.

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Friday, November 17, 2006 08:53 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Filter 'END' statement in 4.3.14 flushes
WEIGHT?


Andy,

Taking your original filter, this is what you would do (note the NOTCONTAINS
line in the second filter):


# ADD-WEIGHT

TESTSFAILED 7 CONTAINS SNIFFER
TESTSFAILED 1 CONTAINS SNIFFER-SCAMS
TESTSFAILED 1 CONTAINS SNIFFER-PORN
TESTSFAILED 2 CONTAINS SNIFFER-MALWARE
TESTSFAILED 1 CONTAINS SNIFFER-OBFUSC
TESTSFAILED -2 CONTAINS SNIFFER-IP
 
TESTSFAILED 4 CONTAINS INV-URIBL-WT1
TESTSFAILED 5 CONTAINS INV-URIBL-WT2
TESTSFAILED 6 CONTAINS INV-URIBL-WT3
TESTSFAILED 7 CONTAINS INV-URIBL-WT4

-

# EXTRA-WEIGHT

TESTSFAILED END NOTCONTAINS ADD-WEIGHT

TESTSFAILED END CONTAINS SPAMCOP
TESTSFAILED END CONTAINS NJABLSOURCES
TESTSFAILED END CONTAINS AHBLSOURCES
TESTSFAILED END CONTAINS AHBLPSSL
TESTSFAILED END CONTAINS SORBS-SPAM
TESTSFAILED END CONTAINS SENDERDB-BLOCK
TESTSFAILED END CONTAINS SBL
 
TESTSFAILED 2 CONTAINS SNIFFER-IP

In your Global.cfg, you would only need to make sure that ADD-WEIGHT appear
before EXTRA-WEIGHT.

Matt







---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Filter question

2006-02-14 Thread Matt





Move the whitelist setting to a custom filter and place an END on the
filter for the condition that you want to track elsewhere:

MAILFROM END IS [EMAIL PROTECTED]
REMOTEIP WHITELIST IS 12.34.56.78

Have a good evening,

Matt


John T (Lists) wrote:

  
  
  
  
  
  I
need to create a filter for a client that I am gatewaying their
Exchange
server.
  
  I
have their server listed in the Global.cfg for whitelisting. (WHITELIST
IP yaddayaddayadda)
  
  Now
there is a need to create a filter file so that if the e-mail is from a
broadcast address and to an address on the list, to route to back to
the sales
manager.
  
  --
  MAILFROM
END NOTCONTAINS [EMAIL PROTECTED]
  ALLRECIPS
0 CONTAINS e-mailaddresslisted
  --
  
  On
Failure, route to [EMAIL PROTECTED]
  
  Is
there a way to
override a whitelist?
  
  John T
  eServices
For You
  
  "Seek,
and ye shall
find!"

RE: [Declude.JunkMail] Filter question

2006-02-14 Thread John T $Lists$










Thanks Matt.





John T

eServices For You



Seek, and ye shall
find!







-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Tuesday, February 14, 2006
3:46 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail]
Filter question



Move the whitelist setting to a custom filter and place an END on the
filter for the condition that you want to track elsewhere:

MAILFROM END IS [EMAIL PROTECTED]
REMOTEIP WHITELIST IS 12.34.56.78

Have a good evening,

Matt


John T (Lists) wrote: 

I need to create
a filter for a client that I am gatewaying their Exchange server.



I have their
server listed in the Global.cfg for whitelisting. (WHITELIST IP
yaddayaddayadda)



Now there is a
need to create a filter file so that if the e-mail is from a broadcast address
and to an address on the list, to route to back to the sales manager.



--

MAILFROM
END
NOTCONTAINS [EMAIL PROTECTED]

ALLRECIPS
0
CONTAINS
e-mailaddresslisted

--



On Failure, route
to [EMAIL PROTECTED]



Is there a way to
override a whitelist?



John T

eServices For You



Seek, and ye shall
find!

Re: [Declude.JunkMail] Filter Syntax

2006-01-23 Thread Scott Fisher




If you wanted to whitelist you could 
go:
MAILFROM WHITELIST IS [EMAIL PROTECTED]
MAILFROM WHITELIST ENDSWITH 
@domain.com

If you wanted to just add negative 
weight.

MAILFROM 0 IS [EMAIL PROTECTED]
MAILFROM 0 ENDSWITH @domain.com

The tofile:
ALLRECIPS 0 CONTAINS [EMAIL PROTECTED]
(You can use the IS, but the syntax is pretty 
harsh)

Now that said. I wouldn't whitelist on the 
MAILFROM, that is too easily forged.
It would be better to whitelist on a REVDNS or an 
REMOTEIP.
REVDNS -30 ENDSWITH .domain.com
REMOTEIP -30 IS 192.168.0.0
REMOTEIP -30 CIDR 192.168.0.0/24

  - Original Message - 
  From: 
  Chris Martin 
  To: declude.junkmail@declude.com 
  
  Sent: Monday, January 23, 2006 10:57 
  AM
  Subject: [Declude.JunkMail] Filter 
  Syntax
  
  
  I am setting up a 
  filter to whitelist some domains. Currently, we have them directly in 
  the global.cfg file but there is getting to be too many, so I am wanting to 
  use a file to do the job and then assign a negative weight to it. I 
  thought I had it but I can't seem to get the file to fire. We are using 
  declude junkmail pro 3.0.5
  
  In Declude I 
  have:
  mywhitelist 
  filter 
  c:/location/mywhitelist.txt 
  x -30 0
  
  In the text file, 
  I have:
  MAILFROM 0 IS [EMAIL PROTECTED]
  and
  MAILFROM 0 IS 
  @domain.com
  
  I would also like 
  to set up a whitelist to text file:
  RECIP 
  0 IS[EMAIL PROTECTED]
  
  Any suggestions on 
  how to make this work would be appreciated.
  
  
  Chris 
  Martin

RE: [Declude.JunkMail] Filter Syntax

2006-01-23 Thread John Carter




Is the filter file method any better than that found in the 
manual.

In $default$.junkmail add "WHITELISTFILE 
[location]\whitelist.txt"
Then in the WHITELIST.TXT, put addresses, domains, 
etc.
 @mec.ms .sirsi.com
 [EMAIL PROTECTED]

John C


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Scott 
FisherSent: Monday, January 23, 2006 11:29 AMTo: 
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Filter 
Syntax

If you wanted to whitelist you could 
go:
MAILFROM WHITELIST IS [EMAIL PROTECTED]
MAILFROM WHITELIST ENDSWITH 
@domain.com

If you wanted to just add negative 
weight.

MAILFROM 0 IS [EMAIL PROTECTED]
MAILFROM 0 ENDSWITH @domain.com

The tofile:
ALLRECIPS 0 CONTAINS [EMAIL PROTECTED]
(You can use the IS, but the syntax is pretty 
harsh)

Now that said. I wouldn't whitelist on the 
MAILFROM, that is too easily forged.
It would be better to whitelist on a REVDNS or an 
REMOTEIP.
REVDNS -30 ENDSWITH .domain.com
REMOTEIP -30 IS 192.168.0.0
REMOTEIP -30 CIDR 192.168.0.0/24

  - Original Message - 
  From: 
  Chris Martin 
  To: declude.junkmail@declude.com 
  
  Sent: Monday, January 23, 2006 10:57 
  AM
  Subject: [Declude.JunkMail] Filter 
  Syntax
  
  
  I am setting up a 
  filter to whitelist some domains. Currently, we have them directly in 
  the global.cfg file but there is getting to be too many, so I am wanting to 
  use a file to do the job and then assign a negative weight to it. I 
  thought I had it but I can't seem to get the file to fire. We are using 
  declude junkmail pro 3.0.5
  
  In Declude I 
  have:
  mywhitelist 
  filter 
  c:/location/mywhitelist.txt 
  x -30 0
  
  In the text file, 
  I have:
  MAILFROM 0 IS [EMAIL PROTECTED]
  and
  MAILFROM 0 IS 
  @domain.com
  
  I would also like 
  to set up a whitelist to text file:
  RECIP 
  0 IS[EMAIL PROTECTED]
  
  Any suggestions on 
  how to make this work would be appreciated.
  
  
  Chris 
  Martin

RE: [Declude.JunkMail] Filter idea!

2005-09-13 Thread Chuck Schick

I would say that 90% of my subject tests use the operator CONTAINS.  This is
usually for the 5000 variations of drug names.  

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com  

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Tuesday, September 13, 2005 12:44 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Filter idea!


I do not know why I did not think of this before. Of course, knowing my
fortune, many of you probably already figured this out.

It appears that using IS to check the subject line has always been iffy.

I thought of a solution: Use ENDSWITH instead of IS.

Just an FYI.

John T
eServices For You



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Filter idea!

2005-09-13 Thread Scott Fisher

To handle the drug obfuscations, I've written an external program the 
deobfuscates and dedups the subject and then runs a filter file against it.

http://it.farmprogress.com/declude/obfsubj.htm

- Original Message - 
From: Chuck Schick [EMAIL PROTECTED]

To: Declude.JunkMail@declude.com
Sent: Tuesday, September 13, 2005 9:29 AM
Subject: RE: [Declude.JunkMail] Filter idea!

I would say that 90% of my subject tests use the operator CONTAINS.  This 
is

usually for the 5000 variations of drug names.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Tuesday, September 13, 2005 12:44 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Filter idea!

I do not know why I did not think of this before. Of course, knowing my
fortune, many of you probably already figured this out.

It appears that using IS to check the subject line has always been iffy.

I thought of a solution: Use ENDSWITH instead of IS.

Just an FYI.

John T
eServices For You

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Filter not triggering

2005-07-26 Thread Nick Hayer


Hi David,

Are you aware of any bugs with the CONTAINS filter statement?

Thanks!

-Nick


David Barker wrote:


Kevin,

After reviewing your files you had sent me this is the problem you are
having:

1. The email you received was encoded in BASE64 (Msg failed BASE64)

2. In your global.cfg you have the following directive:

DECODE  OFF

Therefore your STOCKFILTER did not trigger - as nowhere in the encoded text
of the email is the following phrase (OTC:

In order for your filters to work on encoded messages I would suggest
commenting out #DECODE  OFF

David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Monday, July 25, 2005 10:10 AM
To: JunkMail Declude
Subject: [Declude.JunkMail] Filter not triggering


The attached email is not getting trapped by my STOCKFILTER??? Here are the
log lines. They do not indicate any issues with the STOCKFILTER. In the
STOCKFILTER this line should be hitting

BODY 10 CONTAINS (OTC:

Any idea why this email is not triggering this line and assigning 10
points Could declude not be decoding the BASE64 This also seems to
be an intermittent issue!


07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping E-mail
due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail
due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping E-mail
due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 .  Total weight = 2.
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting
[EMAIL PROTECTED] to file
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting
[EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded
text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]  IP: 200.182.78.150 ID:
M2005072419564304108

07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN
BASE64=WARN IPNOTINMX=IGNORE 
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [copyall_account]

= IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting
[EMAIL PROTECTED] to file
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting
[EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded
text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L2 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED] [EMAIL PROTECTED]
IP: 200.182.78.150 ID: M2005072419564304108

07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN
BASE64=WARN IPNOTINMX=IGNORE 
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for

[EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Cumulative action(s) taken on this
email = IGNORE WARN  [LAST ACTION=WARN]



Kevin Bilbee

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter not triggering

2005-07-26 Thread David Barker

Kevin,
 
After reviewing your files you had sent me this is the problem you are
having:
 
1. The email you received was encoded in BASE64 (Msg failed BASE64)
 
2. In your global.cfg you have the following directive:
 
DECODE  OFF
 
Therefore your STOCKFILTER did not trigger - as nowhere in the encoded text
of the email is the following phrase (OTC:
 
In order for your filters to work on encoded messages I would suggest
commenting out #DECODE  OFF
 
David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Monday, July 25, 2005 10:10 AM
To: JunkMail Declude
Subject: [Declude.JunkMail] Filter not triggering


The attached email is not getting trapped by my STOCKFILTER??? Here are the
log lines. They do not indicate any issues with the STOCKFILTER. In the
STOCKFILTER this line should be hitting
 
BODY 10 CONTAINS (OTC:

Any idea why this email is not triggering this line and assigning 10
points Could declude not be decoding the BASE64 This also seems to
be an intermittent issue!
 
 
07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping E-mail
due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail
due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping E-mail
due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 .  Total weight = 2.
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting
[EMAIL PROTECTED] to file
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting
[EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded
text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]  IP: 200.182.78.150 ID:
M2005072419564304108
 
07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN
BASE64=WARN IPNOTINMX=IGNORE 
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [copyall_account]
= IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting
[EMAIL PROTECTED] to file
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting
[EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded
text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L2 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED] [EMAIL PROTECTED]
IP: 200.182.78.150 ID: M2005072419564304108
 
07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN
BASE64=WARN IPNOTINMX=IGNORE 
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for
[EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Cumulative action(s) taken on this
email = IGNORE WARN  [LAST ACTION=WARN]

 
 
Kevin Bilbee

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter not triggering

2005-07-26 Thread David Barker

Nick,

I am not aware of any bugs with the CONTAINS filter statement.

However there are some items on our wish list, currently CONTAINS  searches
for a string eg. ABC

So this will trigger XXXABCXXX

Currently there is not a way to use CONTAINS with SPACEABC as the config
file does not see the space as in

BODY10  CONTAINSSPACEABC

Because we allow for spaces between CONTAINS and the text. We are looking
into providing a way where you can include spaces such as:

BODY10  CONTAINS ABC

*Please note SPACE is not syntax it is just there so you can see the space
I am talking about :)

David B
www.declude.com



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Tuesday, July 26, 2005 1:19 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter not triggering

Hi David,

Are you aware of any bugs with the CONTAINS filter statement?

Thanks!

-Nick


David Barker wrote:

Kevin,
 
After reviewing your files you had sent me this is the problem you are
having:
 
1. The email you received was encoded in BASE64 (Msg failed BASE64)
 
2. In your global.cfg you have the following directive:
 
DECODE  OFF
 
Therefore your STOCKFILTER did not trigger - as nowhere in the encoded 
text of the email is the following phrase (OTC:
 
In order for your filters to work on encoded messages I would suggest 
commenting out #DECODE  OFF
 
David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Monday, July 25, 2005 10:10 AM
To: JunkMail Declude
Subject: [Declude.JunkMail] Filter not triggering


The attached email is not getting trapped by my STOCKFILTER??? Here are 
the log lines. They do not indicate any issues with the STOCKFILTER. In 
the STOCKFILTER this line should be hitting
 
BODY 10 CONTAINS (OTC:

Any idea why this email is not triggering this line and assigning 10 
points Could declude not be decoding the BASE64 This also seems 
to be an intermittent issue!
 
 
07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 .  Total weight = 2.
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file 
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting 
[EMAIL PROTECTED] to file 
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not 
supporting [EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary 
encoded text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: 
[EMAIL PROTECTED]
To: [EMAIL PROTECTED]  IP: 200.182.78.150 ID:
M2005072419564304108
 
07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: 
NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for 
[copyall_account] = IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file 
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting 
[EMAIL PROTECTED] to file 
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not 
supporting [EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary 
encoded text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L2 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: 
[EMAIL PROTECTED]
To: [EMAIL PROTECTED] 
[EMAIL PROTECTED]
IP: 200.182.78.150 ID: M2005072419564304108
 
07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: 
NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for 
[EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Cumulative action(s

RE: [Declude.JunkMail] Filter not triggering

2005-07-26 Thread John Carter

Then may I ask why prior to 2.0.6.12(or so) did the following work

HEADER 1 CONTAINS gfsinc.com  against the header information of:

Received: from mail.gfsinc.com [206.165.223.43] by bobcat.jcjc.edu
  (SMTPD32-8.15) id A9D24988001E; Wed, 09 Mar 2005 23:23:30 -0600


Now to catch this, I have to use

HEADER 1 CONTAINS mail.gfsinc.com


So if gfsinc.com changes to mail2.gfsinc.com, it is not caught.

John 


 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Barker
Sent: Tuesday, July 26, 2005 12:27 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Filter not triggering

Nick,

I am not aware of any bugs with the CONTAINS filter statement.

However there are some items on our wish list, currently CONTAINS  searches
for a string eg. ABC

So this will trigger XXXABCXXX

Currently there is not a way to use CONTAINS with SPACEABC as the config
file does not see the space as in

BODY10  CONTAINSSPACEABC

Because we allow for spaces between CONTAINS and the text. We are looking
into providing a way where you can include spaces such as:

BODY10  CONTAINS ABC

*Please note SPACE is not syntax it is just there so you can see the space
I am talking about :)

David B
www.declude.com



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Tuesday, July 26, 2005 1:19 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter not triggering

Hi David,

Are you aware of any bugs with the CONTAINS filter statement?

Thanks!

-Nick


David Barker wrote:

Kevin,
 
After reviewing your files you had sent me this is the problem you are
having:
 
1. The email you received was encoded in BASE64 (Msg failed BASE64)
 
2. In your global.cfg you have the following directive:
 
DECODE  OFF
 
Therefore your STOCKFILTER did not trigger - as nowhere in the encoded 
text of the email is the following phrase (OTC:
 
In order for your filters to work on encoded messages I would suggest 
commenting out #DECODE  OFF
 
David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Monday, July 25, 2005 10:10 AM
To: JunkMail Declude
Subject: [Declude.JunkMail] Filter not triggering


The attached email is not getting trapped by my STOCKFILTER??? Here are 
the log lines. They do not indicate any issues with the STOCKFILTER. In 
the STOCKFILTER this line should be hitting
 
BODY 10 CONTAINS (OTC:

Any idea why this email is not triggering this line and assigning 10 
points Could declude not be decoding the BASE64 This also seems 
to be an intermittent issue!
 
 
07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 .  Total weight = 2.
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file 
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting 
[EMAIL PROTECTED] to file 
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not 
supporting [EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary 
encoded text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: 
[EMAIL PROTECTED]
To: [EMAIL PROTECTED]  IP: 200.182.78.150 ID:
M2005072419564304108
 
07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: 
NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for 
[copyall_account] = IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file 
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting 
[EMAIL PROTECTED] to file 
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not 
supporting [EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36

Re: [Declude.JunkMail] Filter not triggering

2005-07-26 Thread Scott Fisher


I use this method in one of my external programs to look for a space.
Working this way would mean no existing filters would need to be changed.
Different characters could be used as a space substitute, which means no 
character would be locked out of being used in filters. I'd hate to see a  
chosen as a space character, then I couldn't filter for that quote.


The filter file contains the lines:
SPACECHAR ~  (this means in the filter 
replace all ~ with spaces). Can be set to any character you want.

BODY 1 CONTAINS ~ABC  (the ~ will be replaced with a space)

It takes me 7 lines of vb code to get this working:
Dim strspacechar As String =  

If UCase(strfilterarray(0)) = SPACECHAR Then 
strfilterarray is a breakout of my filter lines.

strspacechar = Left(strfilterarray(1), 1)
End If

If strspacecharThen
strmatch = Replace(strmatch, strspacechar,  )strmatch 
is the filter line to match (~ABC)

End If

If I were more ambitious, I might also add code for SPACECHAR OFF that would 
reset the strspacechar back to  


- Original Message - 
From: David Barker [EMAIL PROTECTED]

To: Declude.JunkMail@declude.com
Sent: Tuesday, July 26, 2005 12:26 PM
Subject: RE: [Declude.JunkMail] Filter not triggering



Nick,

I am not aware of any bugs with the CONTAINS filter statement.

However there are some items on our wish list, currently CONTAINS 
searches

for a string eg. ABC

So this will trigger XXXABCXXX

Currently there is not a way to use CONTAINS with SPACEABC as the config
file does not see the space as in

BODY 10 CONTAINS SPACEABC

Because we allow for spaces between CONTAINS and the text. We are looking
into providing a way where you can include spaces such as:

BODY 10 CONTAINS  ABC

*Please note SPACE is not syntax it is just there so you can see the 
space

I am talking about :)

David B
www.declude.com



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Tuesday, July 26, 2005 1:19 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter not triggering

Hi David,

Are you aware of any bugs with the CONTAINS filter statement?

Thanks!

-Nick


David Barker wrote:


Kevin,

After reviewing your files you had sent me this is the problem you are
having:

1. The email you received was encoded in BASE64 (Msg failed BASE64)

2. In your global.cfg you have the following directive:

DECODE  OFF

Therefore your STOCKFILTER did not trigger - as nowhere in the encoded
text of the email is the following phrase (OTC:

In order for your filters to work on encoded messages I would suggest
commenting out #DECODE  OFF

David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Monday, July 25, 2005 10:10 AM
To: JunkMail Declude
Subject: [Declude.JunkMail] Filter not triggering


The attached email is not getting trapped by my STOCKFILTER??? Here are
the log lines. They do not indicate any issues with the STOCKFILTER. In
the STOCKFILTER this line should be hitting

BODY 10 CONTAINS (OTC:

Any idea why this email is not triggering this line and assigning 10
points Could declude not be decoding the BASE64 This also seems
to be an intermittent issue!


07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 .  Total weight = 2.
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting
[EMAIL PROTECTED] to file
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not
supporting [EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary
encoded text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From:
[EMAIL PROTECTED]
To: [EMAIL PROTECTED]  IP: 200.182.78.150 ID:
M2005072419564304108

07/24

RE: [Declude.JunkMail] Filter not triggering

2005-07-25 Thread Kevin Bilbee

No. I used to get nabbed by that, it is the first thing I check when having
problems.


Kevin Bilbee

 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] Behalf Of Guhl, Markus
 (LDS)
 Sent: Monday, July 25, 2005 7:22 AM
 To: Declude.JunkMail@declude.com
 Subject: AW: [Declude.JunkMail] Filter not triggering


 hi kevin,

 just guessing: is there a blank at the end of your filterline? if
 there is one,
 then the filter will not be hit by (OTC:C

 mfg
 i.a.
 gez. markus guhl
 ***
 lds nrw
 ref. 241
 tel.: 0211 9449 2578
 fax.: 0211 9449 8344
 mailto:[EMAIL PROTECTED]
 ***



 -Ursprüngliche Nachricht-
 Von: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] Auftrag von Kevin Bilbee
 Gesendet: Montag, 25. Juli 2005 16:10
 An: JunkMail Declude
 Betreff: [Declude.JunkMail] Filter not triggering


 The attached email is not getting trapped by my STOCKFILTER???
 Here are the log
 lines. They do not indicate any issues with the STOCKFILTER. In
 the STOCKFILTER
 this line should be hitting

 BODY 10 CONTAINS (OTC:

 Any idea why this email is not triggering this line and assigning
 10 points
 Could declude not be decoding the BASE64 This also seems to be an
 intermittent issue!


 07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not
 skipping E-mail due
 to current weight of 2.
 07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not
 skipping E-mail due
 to current weight of 2.
 07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not
 skipping E-mail
 due to current weight of 2.
 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
 07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not
 skipping E-mail
 due to current weight of 2.
 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
 07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not
 skipping E-mail due
 to current weight of 2.
 07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 .  Total weight = 2.
 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
 D:\IMAIL\Declude\$default$.junkmail.
 07/24/2005 19:57:36 Q551E097C0333 Redirecting
 [EMAIL PROTECTED] to file
 D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting
 [EMAIL PROTECTED]). Action=WARN.
 07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary
 encoded text
 or HTML section was found in this E-mail.). Action=WARN.
 07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
 07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
 07/24/2005 19:57:36 Q551E097C0333 From:
 [EMAIL PROTECTED] To:
 [EMAIL PROTECTED]  IP: 200.182.78.150 ID:
 M2005072419564304108

 07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]:
 NOABUSE=WARN
 BASE64=WARN IPNOTINMX=IGNORE
 07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for
 [copyall_account] =
 IGNORE WARN  [LAST ACTION=WARN]
 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
 D:\IMAIL\Declude\$default$.junkmail.
 07/24/2005 19:57:36 Q551E097C0333 Redirecting
 [EMAIL PROTECTED]
 to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting
 [EMAIL PROTECTED]). Action=WARN.
 07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary
 encoded text
 or HTML section was found in this E-mail.). Action=WARN.
 07/24/2005 19:57:36 Q551E097C0333 L2 Message OK
 07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
 07/24/2005 19:57:36 Q551E097C0333 From:
 [EMAIL PROTECTED] To:
 [EMAIL PROTECTED] [EMAIL PROTECTED]  IP:
 200.182.78.150 ID: M2005072419564304108

 07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]:
 NOABUSE=WARN
 BASE64=WARN IPNOTINMX=IGNORE
 07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for
 [EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
 07/24/2005 19:57:36 Q551E097C0333 Cumulative action(s) taken
 on this email =
 IGNORE WARN  [LAST ACTION=WARN]



 Kevin Bilbee
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter not triggering

2005-07-25 Thread John Carter




I have reported to Declude a problem with the "CONTAINS" 
statement. Prior to 2.0.6 (or somewhere around there)it worked 
oncharacter match, but after an upgrade to Declude it only works on a word 
match. (In other words you could not longer match on a string of characters 
within a word.) This would affect your situation.

I believe the fix is caught up in the wait for the newest 
version (the one they are testing now.)

John


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin 
BilbeeSent: Monday, July 25, 2005 9:10 AMTo: JunkMail 
DecludeSubject: [Declude.JunkMail] Filter not 
triggering

The attached email is not getting trapped by my 
STOCKFILTER??? Here are the log lines. They do not indicate any issues with the 
STOCKFILTER. In the STOCKFILTER this line should be hitting

BODY 10CONTAINS (OTC:
Any idea why this email is not triggering this line 
and assigning 10 points Could declude not be decoding the BASE64 This 
also seems to be an intermittent issue!


07/24/2005 19:57:36 Q551E097C0333 Filter 
HELOFILTER: Not skipping E-mail due to current weight of 2.07/24/2005 
19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail due to current 
weight of 2.07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not 
skipping E-mail due to current weight of 2.07/24/2005 19:57:36 
Q551E097C0333 Filter: Set max weight to 19.07/24/2005 19:57:36 
Q551E097C0333 Filter: Set max weight to 13.07/24/2005 19:57:36 
Q551E097C0333 Filter: Set max weight to 14.07/24/2005 19:57:36 
Q551E097C0333 Filter: Set max weight to 5.07/24/2005 19:57:36 
Q551E097C0333 Filter STOCKFILTER: Not skipping E-mail due to current weight 
of 2.07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 
15.07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping 
E-mail due to current weight of 2.07/24/2005 19:57:36 Q551E097C0333 
NOABUSE:2 . Total weight = 2.07/24/2005 19:57:36 Q551E097C0333 
Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail.07/24/2005 
19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] 
to file 
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.07/24/2005 
19:57:36 Q551E097C0333 Msg failed NOABUSE ("Not supporting [EMAIL PROTECTED]"). Action="">07/24/2005 
19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML 
section was found in this E-mail.). Action="">07/24/2005 19:57:36 
Q551E097C0333 L1 Message OK07/24/2005 19:57:36 Q551E097C0333 
Subject: Stocks in Play07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] 
To: [EMAIL PROTECTED] 
IP: 200.182.78.150 ID: M2005072419564304108

07/24/2005 19:57:36 Q551E097C0333 Tests failed 
[weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 
Q551E097C0333 Action(s) taken for [copyall_account] = IGNORE WARN 
[LAST ACTION="">07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG 
file D:\IMAIL\Declude\$default$.junkmail.07/24/2005 19:57:36 
Q551E097C0333 Redirecting [EMAIL PROTECTED] to 
file 
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.07/24/2005 
19:57:36 Q551E097C0333 Msg failed NOABUSE ("Not supporting [EMAIL PROTECTED]"). Action="">07/24/2005 
19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML 
section was found in this E-mail.). Action="">07/24/2005 19:57:36 
Q551E097C0333 L2 Message OK07/24/2005 19:57:36 Q551E097C0333 
Subject: Stocks in Play07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] 
To: [EMAIL PROTECTED] 
[EMAIL PROTECTED] 
IP: 200.182.78.150 ID: M2005072419564304108

07/24/2005 19:57:36 Q551E097C0333 Tests failed 
[weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 
Q551E097C0333 Action(s) taken for [EMAIL PROTECTED] = IGNORE 
WARN [LAST ACTION="">07/24/2005 19:57:36 Q551E097C0333 
Cumulative action(s) taken on this email = IGNORE WARN [LAST 
ACTION="">


Kevin Bilbee

Re: [Declude.JunkMail] Filter not triggering

2005-07-25 Thread Nick Hayer





Declude support -

Would you comment on this? Is there a problem with 'CONTAINS' ? Would
you kindly share what other issues are being addresses in 'one they are
testing now' ?

Thanks!

-Nick


John Carter wrote:

  
  
  
  I have reported to Declude a
problem with the "CONTAINS" statement. Prior to 2.0.6 (or somewhere
around there)it worked oncharacter match, but after an upgrade to
Declude it only works on a word match. (In other words you could not
longer match on a string of characters within a word.) This would
affect your situation.
  
  I believe the fix is caught up
in the wait for the newest version (the one they are testing now.)
  
  John
  
  
  From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Kevin
Bilbee
  Sent: Monday, July 25, 2005 9:10 AM
  To: JunkMail Declude
  Subject: [Declude.JunkMail] Filter not triggering
  
  
  The attached email is not getting
trapped by my STOCKFILTER??? Here are the log lines. They do not
indicate any issues with the STOCKFILTER. In the STOCKFILTER this line
should be hitting
  
  BODY 10CONTAINS (OTC:
  
  Any idea why this email is not
triggering this line and assigning 10 points Could declude not be
decoding the BASE64 This also seems to be an intermittent issue!
  
  
  07/24/2005 19:57:36
Q551E097C0333 Filter HELOFILTER: Not skipping E-mail due to current
weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 . Total weight = 2.
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED]
to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE ("Not
supporting [EMAIL PROTECTED]").
Action="">
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary
encoded text or HTML section was found in this E-mail.). Action="">
07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
IP: 200.182.78.150 ID: M2005072419564304108
  
  07/24/2005 19:57:36
Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN
IPNOTINMX=IGNORE 
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for
[copyall_account] = IGNORE WARN [LAST ACTION="">
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED]
to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE ("Not
supporting [EMAIL PROTECTED]").
Action="">
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary
encoded text or HTML section was found in this E-mail.). Action="">
07/24/2005 19:57:36 Q551E097C0333 L2 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
  [EMAIL PROTECTED]
IP: 200.182.78.150 ID: M2005072419564304108
  
  07/24/2005 19:57:36
Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN
IPNOTINMX=IGNORE 
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for
[[EMAIL PROTECTED]] = IGNORE WARN [LAST ACTION="">
07/24/2005 19:57:36 Q551E097C0333 Cumulative action(s) taken on
this email = IGNORE WARN [LAST ACTION="">
  
  
  
  Kevin Bilbee

RE: [Declude.JunkMail] Filter not triggering

2005-07-25 Thread Kevin Bilbee




Well 
that would explain why many of my filters are not as effective as they used to 
be. Has Declude announced when the fix will be available



Kevin 
Bilbee

  -Original Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]On Behalf Of John 
  CarterSent: Monday, July 25, 2005 8:05 AMTo: 
  Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Filter 
  not triggering
  I have reported to Declude a problem with the "CONTAINS" 
  statement. Prior to 2.0.6 (or somewhere around there)it worked 
  oncharacter match, but after an upgrade to Declude it only works on a 
  word match. (In other words you could not longer match on a string of 
  characters within a word.) This would affect your 
  situation.
  
  I believe the fix is caught up in the wait for the newest 
  version (the one they are testing now.)
  
  John
  
  
  From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Kevin 
  BilbeeSent: Monday, July 25, 2005 9:10 AMTo: JunkMail 
  DecludeSubject: [Declude.JunkMail] Filter not 
  triggering
  
  The attached email is not getting trapped by my 
  STOCKFILTER??? Here are the log lines. They do not indicate any issues with 
  the STOCKFILTER. In the STOCKFILTER this line should be hitting
  
  BODY 10CONTAINS (OTC:
  Any idea why this email is not triggering this 
  line and assigning 10 points Could declude not be decoding the BASE64 
  This also seems to be an intermittent issue!
  
  
  07/24/2005 19:57:36 Q551E097C0333 Filter 
  HELOFILTER: Not skipping E-mail due to current weight of 2.07/24/2005 
  19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail due to 
  current weight of 2.07/24/2005 19:57:36 Q551E097C0333 Filter 
  REVDNSFILTER: Not skipping E-mail due to current weight of 2.07/24/2005 
  19:57:36 Q551E097C0333 Filter: Set max weight to 19.07/24/2005 
  19:57:36 Q551E097C0333 Filter: Set max weight to 13.07/24/2005 
  19:57:36 Q551E097C0333 Filter: Set max weight to 14.07/24/2005 
  19:57:36 Q551E097C0333 Filter: Set max weight to 5.07/24/2005 19:57:36 
  Q551E097C0333 Filter STOCKFILTER: Not skipping E-mail due to current 
  weight of 2.07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight 
  to 15.07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not 
  skipping E-mail due to current weight of 2.07/24/2005 19:57:36 
  Q551E097C0333 NOABUSE:2 . Total weight = 2.07/24/2005 19:57:36 
  Q551E097C0333 Using [incoming] CFG file 
  D:\IMAIL\Declude\$default$.junkmail.07/24/2005 19:57:36 Q551E097C0333 
  Redirecting [EMAIL PROTECTED] 
  to file 
  D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.07/24/2005 
  19:57:36 Q551E097C0333 Msg failed NOABUSE ("Not supporting [EMAIL PROTECTED]"). Action="">07/24/2005 
  19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML 
  section was found in this E-mail.). Action="">07/24/2005 19:57:36 
  Q551E097C0333 L1 Message OK07/24/2005 19:57:36 Q551E097C0333 
  Subject: Stocks in Play07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] 
  To: [EMAIL PROTECTED] 
  IP: 200.182.78.150 ID: M2005072419564304108
  
  07/24/2005 19:57:36 Q551E097C0333 Tests 
  failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 
  19:57:36 Q551E097C0333 Action(s) taken for [copyall_account] = IGNORE 
  WARN [LAST ACTION="">07/24/2005 19:57:36 Q551E097C0333 Using 
  [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail.07/24/2005 
  19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] 
  to file 
  D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.07/24/2005 
  19:57:36 Q551E097C0333 Msg failed NOABUSE ("Not supporting [EMAIL PROTECTED]"). Action="">07/24/2005 
  19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML 
  section was found in this E-mail.). Action="">07/24/2005 19:57:36 
  Q551E097C0333 L2 Message OK07/24/2005 19:57:36 Q551E097C0333 
  Subject: Stocks in Play07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] 
  To: [EMAIL PROTECTED] 
  [EMAIL PROTECTED] 
  IP: 200.182.78.150 ID: M2005072419564304108
  
  07/24/2005 19:57:36 Q551E097C0333 Tests 
  failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 
  19:57:36 Q551E097C0333 Action(s) taken for [EMAIL PROTECTED] 
  = IGNORE WARN [LAST ACTION="">07/24/2005 19:57:36 
  Q551E097C0333 Cumulative action(s) taken on this email = IGNORE WARN 
  [LAST ACTION="">
  
  
  Kevin 
Bilbee

Re: [Declude.JunkMail] Filter not triggering

2005-07-25 Thread Matt





Kevin,

Just a thought if you wanted to confirm this as a bug, maybe try a
filter for this same message, but match a full word to see if it
triggers. I did decode this segment and there is no additional
encoding or other tricks that would cause a filter to not hit.

IMO, knowing about bugs like this would be very helpful at times,
especially considering the time that it would take each one of us that
was affected by it to figure it out on our own. Maybe if Declude
doesn't want to post this information on their site, we could take it
upon ourselves to share such information with the list when it is
discovered. This is for the most part how the list used to function in
the old days, though most of us seemed to desire a page dedicated to
the topic regardless.

Matt





Kevin Bilbee wrote:

  
  
  
  Well that would explain why many of my filters
are not as effective as they used to be. Has Declude announced when the
fix will be available
  
  
  
  Kevin Bilbee
  
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of John
Carter
Sent: Monday, July 25, 2005 8:05 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Filter not triggering


I have reported to Declude a
problem with the "CONTAINS" statement. Prior to 2.0.6 (or somewhere
around there)it worked oncharacter match, but after an upgrade to
Declude it only works on a word match. (In other words you could not
longer match on a string of characters within a word.) This would
affect your situation.

I believe the fix is caught up
in the wait for the newest version (the one they are testing now.)

John


 From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Kevin
Bilbee
Sent: Monday, July 25, 2005 9:10 AM
To: JunkMail Declude
Subject: [Declude.JunkMail] Filter not triggering


The attached email is not getting
trapped by my STOCKFILTER??? Here are the log lines. They do not
indicate any issues with the STOCKFILTER. In the STOCKFILTER this line
should be hitting

BODY 10CONTAINS (OTC:

Any idea why this email is not
triggering this line and assigning 10 points Could declude not be
decoding the BASE64 This also seems to be an intermittent issue!


07/24/2005 19:57:36
Q551E097C0333 Filter HELOFILTER: Not skipping E-mail due to current
weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 . Total weight = 2.
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED]
to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE ("Not
supporting [EMAIL PROTECTED]").
Action="">
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary
encoded text or HTML section was found in this E-mail.). Action="">
07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
IP: 200.182.78.150 ID: M2005072419564304108

07/24/2005 19:57:36
Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN
IPNOTINMX=IGNORE 
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for
[copyall_account] = IGNORE WARN [LAST ACTION="">
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED]
to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE ("Not
supporting [EMAIL PROTECTED]").
Action="">
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary
encoded text or HTML section was found in this E-mail.). Action="">
07/24/2005 19:57:36 Q551E097C0333 L2 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
[EMAIL PROTECTED]
I

Re: [Declude.JunkMail] Filter not triggering

2005-07-25 Thread declude

This is one of the main problems with the "new" Declude - lack
of communication! In the old days, Scott would monitor this list and
respond to posts throughout the day. Now, we are lucky if they respond
even bi-weekly. The last post from Declude was 7/15/05 - 10 days
ago,. Prior to that, the last significant postwas on 6/29/05 -
approx. 2 weeks before that. Why is it so difficult for them to post on a
regular basis? It seem like such an easy thing to do that builds customer
loyalty. On the other hand, lack of it breeds resentment. We all
want Declude to succeed. If they do - we do.

Declude, could you please work on this?

Don

- Original Message -

From:
Matt
To: Declude.JunkMail@declude.com

Sent: Monday, July 25, 2005 1:47 PM
Subject: Re: [Declude.JunkMail] Filter
not triggering
Kevin,Just a thought if you wanted to confirm this as a
bug, maybe try a filter for this same message, but match a full word to see if
it triggers. I did decode this segment and there is no additional
encoding or other tricks that would cause a filter to not hit.IMO,
knowing about bugs like this would be very helpful at times, especially
considering the time that it would take each one of us that was affected by it
to figure it out on our own. Maybe if Declude doesn't want to post this
information on their site, we could take it upon ourselves to share such
information with the list when it is discovered. This is for the most
part how the list used to function in the old days, though most of us seemed
to desire a page dedicated to the topic
regardless.MattKevin Bilbee wrote:

Well that would explain why many of my filters are not as effective
as they used to be. Has Declude announced when the fix will be
available

Kevin Bilbee

-Original Message-From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On
Behalf Of John CarterSent: Monday, July 25, 2005 8:05
AMTo: Declude.JunkMail@declude.comSubject:
RE: [Declude.JunkMail] Filter not triggering
I have reported to Declude a problem with the
"CONTAINS" statement. Prior to 2.0.6 (or somewhere around
there)it worked oncharacter match, but after an upgrade to
Declude it only works on a word match. (In other words you could not
longer match on a string of characters within a word.) This would
affect your situation.

I believe the fix is caught up in the wait for the
newest version (the one they are testing now.)

John

From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Kevin BilbeeSent: Monday, July 25, 2005
9:10 AMTo: JunkMail DecludeSubject:
[Declude.JunkMail] Filter not triggering
The attached email is not getting trapped by
my STOCKFILTER??? Here are the log lines. They do not indicate any issues
with the STOCKFILTER. In the STOCKFILTER this line should be
hitting

BODY 10CONTAINS (OTC:
Any idea why this email is not triggering
this line and assigning 10 points Could declude not be decoding the
BASE64 This also seems to be an intermittent issue!

07/24/2005 19:57:36 Q551E097C0333 Filter
HELOFILTER: Not skipping E-mail due to current weight of 2.07/24/2005
19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail due to
current weight of 2.07/24/2005 19:57:36 Q551E097C0333 Filter
REVDNSFILTER: Not skipping E-mail due to current weight of
2.07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to
19.07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to
13.07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to
14.07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to
5.07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not
skipping E-mail due to current weight of 2.07/24/2005 19:57:36
Q551E097C0333 Filter: Set max weight to 15.07/24/2005 19:57:36
Q551E097C0333 Filter BODYFILTER: Not skipping E-mail due to current
weight of 2.07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 .
Total weight = 2.07/24/2005 19:57:36 Q551E097C0333 Using
[incoming] CFG file D:\IMAIL\Declude\$default$.junkmail.07/24/2005
19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED]
to file
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.07/24/2005
19:57:36 Q551E097C0333 Msg failed NOABUSE ("Not supporting [EMAIL PROTECTED]"). Action="">07/24/2005
19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or
HTML section was found in this E-mail.). Action="">07/24/2005
19:57:36 Q551E097C0333 L1 Message OK07/24/2005 19:57:36
Q551

Re: [Declude.JunkMail] Filter not triggering

2005-07-25 Thread David Barker





Kevin,Please email me a copy of your global.cfg with the filter you 
are using as well as the email body and header of the email that did not trigger 
the test and I will have a look at it. dbarker @ 
declude.comThanksDavid Bwww.declude.com

  From: Kevin Bilbee 


  To: Declude.JunkMail@declude.com 
  
  Sent: Monday, July 25, 2005 11:16 
AM
  Subject: RE: [Declude.JunkMail] Filter 
  not triggering
  
  Well 
  that would explain why many of my filters are not as effective as they used to 
  be. Has Declude announced when the fix will be 
  available
  
  
  
  Kevin Bilbee
  
-Original Message-From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]On Behalf Of John 
CarterSent: Monday, July 25, 2005 8:05 AMTo: Declude.JunkMail@declude.comSubject: 
RE: [Declude.JunkMail] Filter not triggering
I have reported to Declude a problem with the 
"CONTAINS" statement. Prior to 2.0.6 (or somewhere around 
there)it worked oncharacter match, but after an upgrade to 
Declude it only works on a word match. (In other words you could not longer 
match on a string of characters within a word.) This would affect your 
situation.

I believe the fix is caught up in the wait for the 
newest version (the one they are testing now.)

John


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin 
BilbeeSent: Monday, July 25, 2005 9:10 AMTo: JunkMail 
DecludeSubject: [Declude.JunkMail] Filter not 
triggering

The attached email is not getting trapped by my 
STOCKFILTER??? Here are the log lines. They do not indicate any issues with 
the STOCKFILTER. In the STOCKFILTER this line should be hitting

BODY 10CONTAINS (OTC:
Any idea why this email is not triggering this 
line and assigning 10 points Could declude not be decoding the 
BASE64 This also seems to be an intermittent issue!


07/24/2005 19:57:36 Q551E097C0333 Filter 
HELOFILTER: Not skipping E-mail due to current weight of 2.07/24/2005 
19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail due to 
current weight of 2.07/24/2005 19:57:36 Q551E097C0333 Filter 
REVDNSFILTER: Not skipping E-mail due to current weight of 2.07/24/2005 
19:57:36 Q551E097C0333 Filter: Set max weight to 19.07/24/2005 
19:57:36 Q551E097C0333 Filter: Set max weight to 13.07/24/2005 
19:57:36 Q551E097C0333 Filter: Set max weight to 14.07/24/2005 
19:57:36 Q551E097C0333 Filter: Set max weight to 5.07/24/2005 
19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping E-mail due to 
current weight of 2.07/24/2005 19:57:36 Q551E097C0333 Filter: Set 
max weight to 15.07/24/2005 19:57:36 Q551E097C0333 Filter 
BODYFILTER: Not skipping E-mail due to current weight of 2.07/24/2005 
19:57:36 Q551E097C0333 NOABUSE:2 . Total weight = 2.07/24/2005 
19:57:36 Q551E097C0333 Using [incoming] CFG file 
D:\IMAIL\Declude\$default$.junkmail.07/24/2005 19:57:36 
Q551E097C0333 Redirecting [EMAIL PROTECTED] 
to file 
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.07/24/2005 
19:57:36 Q551E097C0333 Msg failed NOABUSE ("Not supporting [EMAIL PROTECTED]"). Action="">07/24/2005 
19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML 
section was found in this E-mail.). Action="">07/24/2005 19:57:36 
Q551E097C0333 L1 Message OK07/24/2005 19:57:36 Q551E097C0333 
Subject: Stocks in Play07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] 
To: [EMAIL PROTECTED] 
IP: 200.182.78.150 ID: M2005072419564304108

07/24/2005 19:57:36 Q551E097C0333 Tests 
failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 
19:57:36 Q551E097C0333 Action(s) taken for [copyall_account] = IGNORE 
WARN [LAST ACTION="">07/24/2005 19:57:36 Q551E097C0333 Using 
[incoming] CFG file D:\IMAIL\Declude\$default$.junkmail.07/24/2005 
19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] 
to file 
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.07/24/2005 
19:57:36 Q551E097C0333 Msg failed NOABUSE ("Not supporting [EMAIL PROTECTED]"). Action="">07/24/2005 
19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML 
section was found in this E-mail.). Action="">07/24/2005 19:57:36 
Q551E097C0333 L2 Message OK07/24/2005 19:57:36 Q551E097C0333 
Subject: Stocks in Play07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] 
To: [EMAIL PROTECTED] 
[EMAIL PROTECTED] 
IP: 200.182.78.150 ID: M2005072419564304108

07/24/2005 19:57:36 Q551E097C0333 Tests 
failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 
19:57:36 Q551E0

RE: [Declude.JunkMail] filter files

2005-03-23 Thread Don Schreiner

I also strongly recommend Sniffer. We have used for a couple of years. As
spam patterns and variants change daily, it's rule base also changes and is
updated. It significantly reduced the time we spent managing Spam. 

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
Sent: Tuesday, March 22, 2005 10:36 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] filter files

I would definitely recommend message sniffer.

Stu


At 07:54 PM 3/21/2005 -0600, you wrote:
Thanks to both of you.  I am looking to get mostly obscene stuff, but the
medical stuff would be very good to catch also.  I will start with this and
then adventure out on my own:D
On a side note has anyone used Message Sniffer, and would it help with this
type of stuff or am i looking in the wrong direction?

Thanks again,

Joe


-- Original Message --
From: David Barker [EMAIL PROTECTED]
Reply-To: Declude.JunkMail@declude.com
Date:  Mon, 21 Mar 2005 16:04:55 -0500

Joe here is a very basic filter but hopefully will help get you started:
 
SKIPIFWEIGHT 16
 
MINWEIGHTTOFAIL  3
MAXWEIGHT   12
 
#Subject
SUBJECT 3 CONTAINS Online Pharmacy
 
#Words
BODY 5 CONTAINS Meds
BODY 2 CONTAINS cheap Perscriptions
BODY 2 CONTAINS No prescription required
BODY 2 CONTAINS No Doctor Visits
 
#Medication
BODY 2 CONTAINS codiene
BODY 2 CONTAINS Codeine
BODY 2 CONTAINS vicodin
BODY 2 CONTAINS viagra
BODY 2 CONTAINS Cialis
 
#URBL
BODY 12 CONTAINS fopq.org
BODY 12 CONTAINS awayhowbad.com
BODY 12 CONTAINS royalmeds.info
BODY 12 CONTAINS uncompromisingmind.com
BODY 12 CONTAINS simply-meds.com
BODY 12 CONTAINS ritheworldofall.com
BODY 12 CONTAINS medberthgood.com
 
#Spam Indicators
BODY 12 CONTAINS Cia|is
BODY 12 CONTAINS Cialls

Here are some good links too:

http://www.mailpure.com/software/decludefilters/
http://it.farmprogress.com/declude/declude.htm
http://www.declude.com/Articles.asp?ID=100

David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joe Raykiewicz
Sent: Monday, March 21, 2005 3:44 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] filter files



I am currently thinking about using a filter file to filter out some
unwanted messages.  Does anyone have some sample filter files that I could
use as a starting point?  I sure would appreciate some help getting
started
on this.

 

Joe



__ NOD32 1.1030 (20050319) Information __

This message was checked by NOD32 antivirus system.
http://www.nod32.com


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

 

 
___
Webmail delivered by Microlandcomputers.com


 
   
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] filter files

2005-03-22 Thread Dan Horne

Sniffer will be your best test.  Without a doubt. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joe Raykiewicz
Sent: Monday, March 21, 2005 8:54 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] filter files

Thanks to both of you.  I am looking to get mostly obscene stuff, but
the medical stuff would be very good to catch also.  I will start with
this and then adventure out on my own:D On a side note has anyone
used Message Sniffer, and would it help with this type of stuff or am i
looking in the wrong direction?

Thanks again,

Joe


-- Original Message --
From: David Barker [EMAIL PROTECTED]
Reply-To: Declude.JunkMail@declude.com
Date:  Mon, 21 Mar 2005 16:04:55 -0500

Joe here is a very basic filter but hopefully will help get you
started:
 
SKIPIFWEIGHT 16
 
MINWEIGHTTOFAIL  3
MAXWEIGHT   12
 
#Subject
SUBJECT 3 CONTAINS Online Pharmacy
 
#Words
BODY 5 CONTAINS Meds
BODY 2 CONTAINS cheap Perscriptions
BODY 2 CONTAINS No prescription required BODY 2 CONTAINS No Doctor 
Visits
 
#Medication
BODY 2 CONTAINS codiene
BODY 2 CONTAINS Codeine
BODY 2 CONTAINS vicodin
BODY 2 CONTAINS viagra
BODY 2 CONTAINS Cialis
 
#URBL
BODY 12 CONTAINS fopq.org
BODY 12 CONTAINS awayhowbad.com
BODY 12 CONTAINS royalmeds.info
BODY 12 CONTAINS uncompromisingmind.com BODY 12 CONTAINS 
simply-meds.com BODY 12 CONTAINS ritheworldofall.com BODY 12 CONTAINS 
medberthgood.com
 
#Spam Indicators
BODY 12 CONTAINS Cia|is
BODY 12 CONTAINS Cialls

Here are some good links too:

http://www.mailpure.com/software/decludefilters/
http://it.farmprogress.com/declude/declude.htm
http://www.declude.com/Articles.asp?ID=100

David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joe Raykiewicz
Sent: Monday, March 21, 2005 3:44 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] filter files



I am currently thinking about using a filter file to filter out some 
unwanted messages.  Does anyone have some sample filter files that I 
could use as a starting point?  I sure would appreciate some help 
getting started on this.

 

Joe



__ NOD32 1.1030 (20050319) Information __

This message was checked by NOD32 antivirus system.
http://www.nod32.com


---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
unsubscribe Declude.JunkMail.  The archives can be found at 
http://www.mail-archive.com.

 

 
___
Webmail delivered by Microlandcomputers.com


 
   
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] filter files

2005-03-22 Thread Scott Fisher

I use Message Sniffer. It is very effective. It catches about 96% of all the 
spam messages that come in here (and about 2% of what's left is spam in 
Chinese).

- Original Message - 
From: Joe Raykiewicz [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Monday, March 21, 2005 7:54 PM
Subject: RE: [Declude.JunkMail] filter files


Thanks to both of you.  I am looking to get mostly obscene stuff, but the 
medical stuff would be very good to catch also.  I will start with this 
and then adventure out on my own:D
On a side note has anyone used Message Sniffer, and would it help with 
this type of stuff or am i looking in the wrong direction?

Thanks again,
Joe
-- Original Message --
From: David Barker [EMAIL PROTECTED]
Reply-To: Declude.JunkMail@declude.com
Date:  Mon, 21 Mar 2005 16:04:55 -0500
Joe here is a very basic filter but hopefully will help get you started:
SKIPIFWEIGHT 16
MINWEIGHTTOFAIL  3
MAXWEIGHT   12
#Subject
SUBJECT 3 CONTAINS Online Pharmacy
#Words
BODY 5 CONTAINS Meds
BODY 2 CONTAINS cheap Perscriptions
BODY 2 CONTAINS No prescription required
BODY 2 CONTAINS No Doctor Visits
#Medication
BODY 2 CONTAINS codiene
BODY 2 CONTAINS Codeine
BODY 2 CONTAINS vicodin
BODY 2 CONTAINS viagra
BODY 2 CONTAINS Cialis
#URBL
BODY 12 CONTAINS fopq.org
BODY 12 CONTAINS awayhowbad.com
BODY 12 CONTAINS royalmeds.info
BODY 12 CONTAINS uncompromisingmind.com
BODY 12 CONTAINS simply-meds.com
BODY 12 CONTAINS ritheworldofall.com
BODY 12 CONTAINS medberthgood.com
#Spam Indicators
BODY 12 CONTAINS Cia|is
BODY 12 CONTAINS Cialls
Here are some good links too:
http://www.mailpure.com/software/decludefilters/
http://it.farmprogress.com/declude/declude.htm
http://www.declude.com/Articles.asp?ID=100
David B
www.declude.com

From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joe Raykiewicz
Sent: Monday, March 21, 2005 3:44 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] filter files

I am currently thinking about using a filter file to filter out some
unwanted messages.  Does anyone have some sample filter files that I could
use as a starting point?  I sure would appreciate some help getting 
started
on this.


Joe

__ NOD32 1.1030 (20050319) Information __
This message was checked by NOD32 antivirus system.
http://www.nod32.com
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

___
Webmail delivered by Microlandcomputers.com

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] filter files

2005-03-22 Thread David Barker

Joe,

Sniffer well definitely add a lot of value to scanning content.

David B
www.declude.com 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joe Raykiewicz
Sent: Monday, March 21, 2005 8:54 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] filter files

Thanks to both of you.  I am looking to get mostly obscene stuff, but the
medical stuff would be very good to catch also.  I will start with this and
then adventure out on my own:D On a side note has anyone used Message
Sniffer, and would it help with this type of stuff or am i looking in the
wrong direction?

Thanks again,

Joe


-- Original Message --
From: David Barker [EMAIL PROTECTED]
Reply-To: Declude.JunkMail@declude.com
Date:  Mon, 21 Mar 2005 16:04:55 -0500

Joe here is a very basic filter but hopefully will help get you started:
 
SKIPIFWEIGHT 16
 
MINWEIGHTTOFAIL  3
MAXWEIGHT   12
 
#Subject
SUBJECT 3 CONTAINS Online Pharmacy
 
#Words
BODY 5 CONTAINS Meds
BODY 2 CONTAINS cheap Perscriptions
BODY 2 CONTAINS No prescription required BODY 2 CONTAINS No Doctor 
Visits
 
#Medication
BODY 2 CONTAINS codiene
BODY 2 CONTAINS Codeine
BODY 2 CONTAINS vicodin
BODY 2 CONTAINS viagra
BODY 2 CONTAINS Cialis
 
#URBL
BODY 12 CONTAINS fopq.org
BODY 12 CONTAINS awayhowbad.com
BODY 12 CONTAINS royalmeds.info
BODY 12 CONTAINS uncompromisingmind.com BODY 12 CONTAINS 
simply-meds.com BODY 12 CONTAINS ritheworldofall.com BODY 12 CONTAINS 
medberthgood.com
 
#Spam Indicators
BODY 12 CONTAINS Cia|is
BODY 12 CONTAINS Cialls

Here are some good links too:

http://www.mailpure.com/software/decludefilters/
http://it.farmprogress.com/declude/declude.htm
http://www.declude.com/Articles.asp?ID=100

David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joe Raykiewicz
Sent: Monday, March 21, 2005 3:44 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] filter files



I am currently thinking about using a filter file to filter out some 
unwanted messages.  Does anyone have some sample filter files that I 
could use as a starting point?  I sure would appreciate some help 
getting started on this.

 

Joe



__ NOD32 1.1030 (20050319) Information __

This message was checked by NOD32 antivirus system.
http://www.nod32.com


---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
unsubscribe Declude.JunkMail.  The archives can be found at 
http://www.mail-archive.com.

 

 
___
Webmail delivered by Microlandcomputers.com


 
   
---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.


__ NOD32 1.1031 (20050321) Information __

This message was checked by NOD32 antivirus system.
http://www.nod32.com


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] filter files

2005-03-22 Thread smb

I would definitely recommend message sniffer.

Stu


At 07:54 PM 3/21/2005 -0600, you wrote:
Thanks to both of you.  I am looking to get mostly obscene stuff, but the
medical stuff would be very good to catch also.  I will start with this and
then adventure out on my own:D
On a side note has anyone used Message Sniffer, and would it help with this
type of stuff or am i looking in the wrong direction?

Thanks again,

Joe


-- Original Message --
From: David Barker [EMAIL PROTECTED]
Reply-To: Declude.JunkMail@declude.com
Date:  Mon, 21 Mar 2005 16:04:55 -0500

Joe here is a very basic filter but hopefully will help get you started:
 
SKIPIFWEIGHT 16
 
MINWEIGHTTOFAIL  3
MAXWEIGHT   12
 
#Subject
SUBJECT 3 CONTAINS Online Pharmacy
 
#Words
BODY 5 CONTAINS Meds
BODY 2 CONTAINS cheap Perscriptions
BODY 2 CONTAINS No prescription required
BODY 2 CONTAINS No Doctor Visits
 
#Medication
BODY 2 CONTAINS codiene
BODY 2 CONTAINS Codeine
BODY 2 CONTAINS vicodin
BODY 2 CONTAINS viagra
BODY 2 CONTAINS Cialis
 
#URBL
BODY 12 CONTAINS fopq.org
BODY 12 CONTAINS awayhowbad.com
BODY 12 CONTAINS royalmeds.info
BODY 12 CONTAINS uncompromisingmind.com
BODY 12 CONTAINS simply-meds.com
BODY 12 CONTAINS ritheworldofall.com
BODY 12 CONTAINS medberthgood.com
 
#Spam Indicators
BODY 12 CONTAINS Cia|is
BODY 12 CONTAINS Cialls

Here are some good links too:

http://www.mailpure.com/software/decludefilters/
http://it.farmprogress.com/declude/declude.htm
http://www.declude.com/Articles.asp?ID=100

David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joe Raykiewicz
Sent: Monday, March 21, 2005 3:44 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] filter files



I am currently thinking about using a filter file to filter out some
unwanted messages.  Does anyone have some sample filter files that I could
use as a starting point?  I sure would appreciate some help getting started
on this.

 

Joe



__ NOD32 1.1030 (20050319) Information __

This message was checked by NOD32 antivirus system.
http://www.nod32.com


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

 

 
___
Webmail delivered by Microlandcomputers.com


 
   
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] filter files

2005-03-21 Thread Scott Fisher




Is there any mail in specific you are trying to 
target?

  - Original Message - 
  From: 
  Joe 
  Raykiewicz 
  To: declude.junkmail@declude.com 
  
  Sent: Monday, March 21, 2005 2:43 
PM
  Subject: [Declude.JunkMail] filter 
  files
  
  
  I am currently thinking about 
  using a filter file to filter out some unwanted messages. Does anyone 
  have some sample filter files that I could use as a starting point? I 
  sure would appreciate some help getting started on 
  this.
  
  Joe

RE: [Declude.JunkMail] filter files

2005-03-21 Thread David Barker

Joe here is a very basic filter but hopefully will help get you started:
 
SKIPIFWEIGHT 16
 
MINWEIGHTTOFAIL  3
MAXWEIGHT   12
 
#Subject
SUBJECT 3 CONTAINS Online Pharmacy
 
#Words
BODY 5 CONTAINS Meds
BODY 2 CONTAINS cheap Perscriptions
BODY 2 CONTAINS No prescription required
BODY 2 CONTAINS No Doctor Visits
 
#Medication
BODY 2 CONTAINS codiene
BODY 2 CONTAINS Codeine
BODY 2 CONTAINS vicodin
BODY 2 CONTAINS viagra
BODY 2 CONTAINS Cialis
 
#URBL
BODY 12 CONTAINS fopq.org
BODY 12 CONTAINS awayhowbad.com
BODY 12 CONTAINS royalmeds.info
BODY 12 CONTAINS uncompromisingmind.com
BODY 12 CONTAINS simply-meds.com
BODY 12 CONTAINS ritheworldofall.com
BODY 12 CONTAINS medberthgood.com
 
#Spam Indicators
BODY 12 CONTAINS Cia|is
BODY 12 CONTAINS Cialls

Here are some good links too:

http://www.mailpure.com/software/decludefilters/
http://it.farmprogress.com/declude/declude.htm
http://www.declude.com/Articles.asp?ID=100

David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joe Raykiewicz
Sent: Monday, March 21, 2005 3:44 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] filter files



I am currently thinking about using a filter file to filter out some
unwanted messages.  Does anyone have some sample filter files that I could
use as a starting point?  I sure would appreciate some help getting started
on this.

 

Joe



__ NOD32 1.1030 (20050319) Information __

This message was checked by NOD32 antivirus system.
http://www.nod32.com


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] filter files

2005-03-21 Thread Joe Raykiewicz

Thanks to both of you.  I am looking to get mostly obscene stuff, but the 
medical stuff would be very good to catch also.  I will start with this and 
then adventure out on my own:D
On a side note has anyone used Message Sniffer, and would it help with this 
type of stuff or am i looking in the wrong direction?

Thanks again,

Joe


-- Original Message --
From: David Barker [EMAIL PROTECTED]
Reply-To: Declude.JunkMail@declude.com
Date:  Mon, 21 Mar 2005 16:04:55 -0500

Joe here is a very basic filter but hopefully will help get you started:
 
SKIPIFWEIGHT 16
 
MINWEIGHTTOFAIL  3
MAXWEIGHT   12
 
#Subject
SUBJECT 3 CONTAINS Online Pharmacy
 
#Words
BODY 5 CONTAINS Meds
BODY 2 CONTAINS cheap Perscriptions
BODY 2 CONTAINS No prescription required
BODY 2 CONTAINS No Doctor Visits
 
#Medication
BODY 2 CONTAINS codiene
BODY 2 CONTAINS Codeine
BODY 2 CONTAINS vicodin
BODY 2 CONTAINS viagra
BODY 2 CONTAINS Cialis
 
#URBL
BODY 12 CONTAINS fopq.org
BODY 12 CONTAINS awayhowbad.com
BODY 12 CONTAINS royalmeds.info
BODY 12 CONTAINS uncompromisingmind.com
BODY 12 CONTAINS simply-meds.com
BODY 12 CONTAINS ritheworldofall.com
BODY 12 CONTAINS medberthgood.com
 
#Spam Indicators
BODY 12 CONTAINS Cia|is
BODY 12 CONTAINS Cialls

Here are some good links too:

http://www.mailpure.com/software/decludefilters/
http://it.farmprogress.com/declude/declude.htm
http://www.declude.com/Articles.asp?ID=100

David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joe Raykiewicz
Sent: Monday, March 21, 2005 3:44 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] filter files



I am currently thinking about using a filter file to filter out some
unwanted messages.  Does anyone have some sample filter files that I could
use as a starting point?  I sure would appreciate some help getting started
on this.

 

Joe



__ NOD32 1.1030 (20050319) Information __

This message was checked by NOD32 antivirus system.
http://www.nod32.com


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

 

 
___
Webmail delivered by Microlandcomputers.com


 
   
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter question

2005-02-24 Thread Marc Catuogno

I have my own domain in the spamdomains test and then I have Whitelist Auth
so almost anytime something appears to me from [EMAIL PROTECTED] if it isn't
whitelisted because of authentication it adds quite a bit of weight.  The
major down side is that when people send e-mail from websites that have you
fill in the from address.  Since these don't authenticate they often get
caught as well.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Carter
Sent: Thursday, February 24, 2005 8:58 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Filter question

The following header lines are the basis of my question.  The from domain
(mine) does not match the from [IP] address (not mine.)

Received: from jcjc.edu [65.240.76.232] by bobcat.jcjc.edu with ESMTP
  (SMTPD32-8.15) id AB4F105B014E; Wed, 23 Feb 2005 17:01:35 -0600
From: Returned mail [EMAIL PROTECTED]
To: [EMAIL PROTECTED]

This may have been discussed before and I just didn't use the right search
words, but ...  has anyone worked on a filter/external program/whatever that
could check for match/mismatch of the from address and the from IP in the
Received: line.  Example: One could specify the domains and IP's that must
match each other.  If they don't, boost the score by whatever makes one
happy.

My logic: whether it is an uncaught virus (like MyDoom.BE) or junk mail, it
doesn't matter. If your users see email supposedly from you, they are going
to be more likely to open it and suffer the results. Is this worth working
on?  Has someone done something on this?

Thanks,
John


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Filter question

2005-02-24 Thread Darin Cox

What about SPF?  One of the benefits of having SPF records is that you can
easily add weight to email with your domain in the FROM address that does
not originate from designated sources (i.e. your servers).

Darin.

- Original Message - 
From: Marc Catuogno [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Thursday, February 24, 2005 9:54 AM
Subject: RE: [Declude.JunkMail] Filter question

I have my own domain in the spamdomains test and then I have Whitelist Auth
so almost anytime something appears to me from [EMAIL PROTECTED] if it isn't
whitelisted because of authentication it adds quite a bit of weight.  The
major down side is that when people send e-mail from websites that have you
fill in the from address.  Since these don't authenticate they often get
caught as well.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Carter
Sent: Thursday, February 24, 2005 8:58 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Filter question

The following header lines are the basis of my question.  The from domain
(mine) does not match the from [IP] address (not mine.)

Received: from jcjc.edu [65.240.76.232] by bobcat.jcjc.edu with ESMTP
  (SMTPD32-8.15) id AB4F105B014E; Wed, 23 Feb 2005 17:01:35 -0600
From: Returned mail [EMAIL PROTECTED]
To: [EMAIL PROTECTED]

This may have been discussed before and I just didn't use the right search
words, but ...  has anyone worked on a filter/external program/whatever that
could check for match/mismatch of the from address and the from IP in the
Received: line.  Example: One could specify the domains and IP's that must
match each other.  If they don't, boost the score by whatever makes one
happy.

My logic: whether it is an uncaught virus (like MyDoom.BE) or junk mail, it
doesn't matter. If your users see email supposedly from you, they are going
to be more likely to open it and suffer the results. Is this worth working
on?  Has someone done something on this?

Thanks,
John

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter / VBS for empty body wanted

2005-02-14 Thread Kami Razvan




No.. that won't work.

I am yet to see a body that is "blank".. it always has some HTML 
characters or some character that does not show up.

May be others have had better luck but that has never worked for 
us.

Kami


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Scott 
FisherSent: Monday, February 14, 2005 11:03 AMTo: 
Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Filter / VBS 
for empty body wanted

Does anyone have a Filter or a VBS script for 
determining if a message has an empty body?

Will BODY 1 ISBLANK 
work?

RE: [Declude.JunkMail] Filter / VBS for empty body wanted

2005-02-14 Thread Andy Schmidt

Title: Message



Well - 
I HAVE seen blank ones - but those were legitimate Outlook (?) generated 
emails for shared folder synchronizations. They had no body, just an 
attachment. So I had a fairly high false positive rate.

Best 
RegardsAndy SchmidtHM Systems Software, 
Inc.600 East Crescent Avenue, 
Suite 203Upper Saddle River, NJ 07458-1846Phone: +1 201 934-3414 x20 
(Business)Fax: +1 201 934-9206http://www.HM-Software.com/ 

  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Kami RazvanSent: Monday, February 14, 2005 
  11:11 AMTo: Declude.JunkMail@declude.comSubject: RE: 
  [Declude.JunkMail] Filter / VBS for empty body wanted
  No.. that won't work.
  
  I am yet to see a body that is "blank".. it always has some HTML 
  characters or some character that does not show up.
  
  May be others have had better luck but that has never worked for 
  us.
  
  Kami
  
  
  From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Scott 
  FisherSent: Monday, February 14, 2005 11:03 AMTo: 
  Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Filter / 
  VBS for empty body wanted
  
  Does anyone have a Filter or a VBS script for 
  determining if a message has an empty body?
  
  Will BODY 1 ISBLANK 
work?
attachment: HMSoftSmall.jpg

Re: [Declude.JunkMail] Filter for blank subject lines

2005-01-06 Thread Matt





If you are still having issues, just let me know and I'll code
something up for you.

Matt



[EMAIL PROTECTED] wrote:

  
  
  looks like it's time to learn
some VBScript.
  
  I can see how your HELOISREVDNS
works, but after toying with it a bit, I'm at a loss on how to move
from two defined strings to comparing a blank space. No biggie... I'll
figure something out.
  
  
  From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Matt
  Sent: Wednesday, January 05, 2005 5:15 PM
  To: Declude.JunkMail@declude.com
  Subject: Re: [Declude.JunkMail] Filter for blank subject lines
  
  
No problem at all. I'm guilty of much worse, besides, I responded
inappropriately.
  
I seem to recall the ISBLANK option not working with SUBJECT. Could be
wrong though, but a test of this would seem definitive. Make sure
there are no tabs or spaces following ISBLANK, unlike other filters,
this is just three columns.
  
If it is confirmed not to work and you know VBScript, this could be
done in a few lines of code and worked into Declude as an external test
like so:
  1) Split on double line break
2) Check first array position (using InStr) for CRLFSubject:
CRLF
3) If a match is found, return an exit code (using WScript.Quit) of 10,
otherwise an exit code of 0.
  
See the HELOISREVDNS filter on my site for an example of a simple
script and configuration that can be used in Declude as an external
test.
  
 http://www.mailpure.com/software/decludefilters/beta/
  
Matt
  
  
  
  [EMAIL PROTECTED] wrote:
  
I have pro and my filters work, yet ISBLANK, IS BLANK, IS, and IS , all pass
mail with blank subjects through.  White listing plays no part. Do you know
if that is supposed to work for sure?

Thanks.

Sorry for the vent earlier.  I got my ass chewed REAL good today because I
forget to do something.  Normally I'd catch it in my "end of the day" email
reviews... but this one had no subject, so I (accidentally?) overlooked it.
Had it carried even the vaguest of subject lines, I think it would have
caught my attention last night before I left for the day.

Anywho, I'm determined to get them to include subject lines one way or
another.  Ideally it'll be mandatory as forced by either DecludeJunkMail or
Imail.



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Scott Fisher
Sent: Wednesday, January 05, 2005 2:24 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter for blank subject lines


If you have Junkmail Pro, try this as a Filter:
SUBJECT 10ISBLANK

- Original Message -
From: [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Wednesday, January 05, 2005 2:25 PM
Subject: [Declude.JunkMail] Filter for blank subject lines


  

  Any previous talk on filtering for blank subject lines is 2 years old, so
I'd like to present the question again, and/or make a new feature request.

Within our corp, we have several employees who enjoy send their mails with
no subject what-so-ever.  Wrist slaps have done nothing to correct this
problem.  I'd like very much to bounce mails lacking subjects, informing


the
  

  sender that to complete the delivery, they must resend with a completed
subject line.

I've tried using both SUBJECTCHARS and CONTSPACES, but they don't seem to
work as I'd like.

Is there a specific test or filter I can use to detect blank subject


lines?
  

  TIA


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus


(http://www.declude.com)]
  

  ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  
  
  
  -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Filter for blank subject lines

2005-01-05 Thread Scott Fisher

If you have Junkmail Pro, try this as a Filter:
SUBJECT 10ISBLANK

- Original Message - 
From: [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Wednesday, January 05, 2005 2:25 PM
Subject: [Declude.JunkMail] Filter for blank subject lines

 Any previous talk on filtering for blank subject lines is 2 years old, so
 I'd like to present the question again, and/or make a new feature request.

 Within our corp, we have several employees who enjoy send their mails with
 no subject what-so-ever.  Wrist slaps have done nothing to correct this
 problem.  I'd like very much to bounce mails lacking subjects, informing
the
 sender that to complete the delivery, they must resend with a completed
 subject line.

 I've tried using both SUBJECTCHARS and CONTSPACES, but they don't seem to
 work as I'd like.

 Is there a specific test or filter I can use to detect blank subject
lines?

 TIA

 ---
 [This E-mail scanned for viruses by Declude Virus]

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Filter for blank subject lines

Since a sizeable amount of blank subjects are spam and come from forged 
addresses, please don't bounce such messages.  It's called backscatter, 
and it is a very large problem, typically amounting to 1% to 2% of my 
total mail volume.  This is also common enough that you would also upset 
many customers.

If you tweak your setup properly, you can tag blank subjects with a 
little weight and still not have issues with blocking legitimate E-mail 
while improving spam detection.

Matt

[EMAIL PROTECTED] wrote:
Any previous talk on filtering for blank subject lines is 2 years old, so
I'd like to present the question again, and/or make a new feature request.
Within our corp, we have several employees who enjoy send their mails with
no subject what-so-ever.  Wrist slaps have done nothing to correct this
problem.  I'd like very much to bounce mails lacking subjects, informing the
sender that to complete the delivery, they must resend with a completed
subject line.
I've tried using both SUBJECTCHARS and CONTSPACES, but they don't seem to
work as I'd like.
Is there a specific test or filter I can use to detect blank subject lines?
TIA
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
 

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Filter for blank subject lines

2005-01-05 Thread Bill Landry

My read is that he is only attempting to enforce the subject requirement on
his on users within his own domain.  So if he builds his rules
appropriately, either as a specific domain rule or a combo filter, he should
be able to apply the subject requirement to his own users/domain without
affecting or bouncing messages to anyone outside his userbase/domain.

Bill
- Original Message - 
From: Matt [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Wednesday, January 05, 2005 12:34 PM
Subject: Re: [Declude.JunkMail] Filter for blank subject lines

 Since a sizeable amount of blank subjects are spam and come from forged
 addresses, please don't bounce such messages.  It's called backscatter,
 and it is a very large problem, typically amounting to 1% to 2% of my
 total mail volume.  This is also common enough that you would also upset
 many customers.

 If you tweak your setup properly, you can tag blank subjects with a
 little weight and still not have issues with blocking legitimate E-mail
 while improving spam detection.

 Matt

 [EMAIL PROTECTED] wrote:

 Any previous talk on filtering for blank subject lines is 2 years old, so
 I'd like to present the question again, and/or make a new feature
request.

 Within our corp, we have several employees who enjoy send their mails
with
 no subject what-so-ever.  Wrist slaps have done nothing to correct this
 problem.  I'd like very much to bounce mails lacking subjects, informing
the
 sender that to complete the delivery, they must resend with a completed
 subject line.

 I've tried using both SUBJECTCHARS and CONTSPACES, but they don't seem to
 work as I'd like.

 Is there a specific test or filter I can use to detect blank subject
lines?

 TIA

 ---
 [This E-mail scanned for viruses by Declude Virus]

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.

 -- 
 =
 MailPure custom filters for Declude JunkMail Pro.
 http://www.mailpure.com/software/
 =

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter for blank subject lines

It's not about blocking spam, it's about forcing employees to be sensible
when it comes to electronic messages.  I myself get between 20 - 30 emails a
day from 1 employee that carry blank subjects.  Dare I say 700 a month from
one person?  Memos, personal requests, outside of ramming their head into a
file cabinet, I have tried it all.  Then you have remote users who I don't
have the pleasure of beating on daily.  You want to talk about a very large
problem... I'd love to have 1% or 2% of my messages with no subject line.
As it stands right now, this very second, 20% of my corporate inbox is
filled with messages that have blank subject lines.  That's a very large
problem.  You want to come here a sift through 100 random e-mails trying to
find something?

I am fully aware of problem with bouncing mail and forged headers.  But
using the test or filter intra-domain will have no adverse effects on yours,
or anyone's server... only mine.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Matt
Sent: Wednesday, January 05, 2005 2:35 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter for blank subject lines


Since a sizeable amount of blank subjects are spam and come from forged
addresses, please don't bounce such messages.  It's called backscatter,
and it is a very large problem, typically amounting to 1% to 2% of my
total mail volume.  This is also common enough that you would also upset
many customers.

If you tweak your setup properly, you can tag blank subjects with a
little weight and still not have issues with blocking legitimate E-mail
while improving spam detection.

Matt



[EMAIL PROTECTED] wrote:

Any previous talk on filtering for blank subject lines is 2 years old, so
I'd like to present the question again, and/or make a new feature request.

Within our corp, we have several employees who enjoy send their mails with
no subject what-so-ever.  Wrist slaps have done nothing to correct this
problem.  I'd like very much to bounce mails lacking subjects, informing
the
sender that to complete the delivery, they must resend with a completed
subject line.

I've tried using both SUBJECTCHARS and CONTSPACES, but they don't seem to
work as I'd like.

Is there a specific test or filter I can use to detect blank subject lines?

TIA


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.





--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Filter for blank subject lines





True. Just be careful, and understand that you can't apply such
actions to whitelisted E-mail.

Matt



Bill Landry wrote:

  My read is that he is only attempting to enforce the subject requirement on
his on users within his own domain.  So if he builds his rules
appropriately, either as a specific domain rule or a combo filter, he should
be able to apply the subject requirement to his own users/domain without
affecting or bouncing messages to anyone outside his userbase/domain.

Bill
- Original Message - 
From: "Matt" [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Wednesday, January 05, 2005 12:34 PM
Subject: Re: [Declude.JunkMail] Filter for blank subject lines


  
  
Since a sizeable amount of blank subjects are spam and come from forged
addresses, please don't bounce such messages.  It's called backscatter,
and it is a very large problem, typically amounting to 1% to 2% of my
total mail volume.  This is also common enough that you would also upset
many customers.

If you tweak your setup properly, you can tag blank subjects with a
little weight and still not have issues with blocking legitimate E-mail
while improving spam detection.

Matt



[EMAIL PROTECTED] wrote:



  Any previous talk on filtering for blank subject lines is 2 years old, so
I'd like to present the question again, and/or make a new feature
  

  
  request.
  
  

  Within our corp, we have several employees who enjoy send their mails
  

  
  with
  
  

  no subject what-so-ever.  Wrist slaps have done nothing to correct this
problem.  I'd like very much to bounce mails lacking subjects, informing
  

  
  the
  
  

  sender that to complete the delivery, they must resend with a completed
subject line.

I've tried using both SUBJECTCHARS and CONTSPACES, but they don't seem to
work as I'd like.

Is there a specific test or filter I can use to detect blank subject
  

  
  lines?
  
  

  TIA


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
  

  
  (http://www.declude.com)]
  
  

  ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




  

-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

---
[This E-mail was scanned for viruses by Declude Virus

  
  (http://www.declude.com)]
  
  
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  
  
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Filter for blank subject lines





I didn't read your original post carefully enough and misunderstood the
exact situation as a result. Sorry to have touched on your
frustration. I agree, no-subject people are annoying, especially when
they do so 20 times a day. Around here that's grounds for disciplinary
action :)

Matt



[EMAIL PROTECTED] wrote:

  It's not about blocking spam, it's about forcing employees to be sensible
when it comes to electronic messages.  I myself get between 20 - 30 emails a
day from 1 employee that carry blank subjects.  Dare I say 700 a month from
one person?  Memos, personal requests, outside of ramming their head into a
file cabinet, I have tried it all.  Then you have remote users who I don't
have the pleasure of beating on daily.  You want to talk about a very large
problem... I'd love to have 1% or 2% of my messages with no subject line.
As it stands right now, this very second, 20% of my corporate inbox is
filled with messages that have blank subject lines.  That's a very large
problem.  You want to come here a sift through 100 random e-mails trying to
find something?

I am fully aware of problem with bouncing mail and forged headers.  But
using the test or filter intra-domain will have no adverse effects on yours,
or anyone's server... only mine.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Matt
Sent: Wednesday, January 05, 2005 2:35 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter for blank subject lines


Since a sizeable amount of blank subjects are spam and come from forged
addresses, please don't bounce such messages.  It's called backscatter,
and it is a very large problem, typically amounting to 1% to 2% of my
total mail volume.  This is also common enough that you would also upset
many customers.

If you tweak your setup properly, you can tag blank subjects with a
little weight and still not have issues with blocking legitimate E-mail
while improving spam detection.

Matt



[EMAIL PROTECTED] wrote:

  
  
Any previous talk on filtering for blank subject lines is 2 years old, so
I'd like to present the question again, and/or make a new feature request.

Within our corp, we have several employees who enjoy send their mails with
no subject what-so-ever.  Wrist slaps have done nothing to correct this
problem.  I'd like very much to bounce mails lacking subjects, informing

  
  the
  
  
sender that to complete the delivery, they must resend with a completed
subject line.

I've tried using both SUBJECTCHARS and CONTSPACES, but they don't seem to
work as I'd like.

Is there a specific test or filter I can use to detect blank subject lines?

TIA


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus

  
  (http://www.declude.com)]
  
  
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





  
  
--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Filter for blank subject lines

2005-01-05 Thread S.J.Stanaitis





I've actually found that ramming their head into the cubicle wall works
better than a filing cabinet. They're rather resilient and don't take
too much damage, nor are they so hard that they'll actually knock out
the luser and make them forget why you were assaulting them.

I've got the same situation at my office with the blank subject lines
internally, I don't bother telling people what to do, I just find a way
to enforce it through software. If/when you get this figured out I am
very interested in seeing how it was pulled off. In the mean time I'll
tinker around on my server and see if I can get it to work.

Sam

[EMAIL PROTECTED] wrote:

  It's not about blocking spam, it's about forcing employees to be sensible
when it comes to electronic messages.  I myself get between 20 - 30 emails a
day from 1 employee that carry blank subjects.  Dare I say 700 a month from
one person?  Memos, personal requests, outside of ramming their head into a
file cabinet, I have tried it all.  Then you have remote users who I don't
have the pleasure of beating on daily.  You want to talk about a very large
problem... I'd love to have 1% or 2% of my messages with no subject line.
As it stands right now, this very second, 20% of my corporate inbox is
filled with messages that have blank subject lines.  That's a very large
problem.  You want to come here a sift through 100 random e-mails trying to
find something?

I am fully aware of problem with bouncing mail and forged headers.  But
using the test or filter intra-domain will have no adverse effects on yours,
or anyone's server... only mine.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Matt
Sent: Wednesday, January 05, 2005 2:35 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter for blank subject lines


Since a sizeable amount of blank subjects are spam and come from forged
addresses, please don't bounce such messages.  It's called backscatter,
and it is a very large problem, typically amounting to 1% to 2% of my
total mail volume.  This is also common enough that you would also upset
many customers.

If you tweak your setup properly, you can tag blank subjects with a
little weight and still not have issues with blocking legitimate E-mail
while improving spam detection.

Matt



[EMAIL PROTECTED] wrote:

  
  
Any previous talk on filtering for blank subject lines is 2 years old, so
I'd like to present the question again, and/or make a new feature request.

Within our corp, we have several employees who enjoy send their mails with
no subject what-so-ever.  Wrist slaps have done nothing to correct this
problem.  I'd like very much to bounce mails lacking subjects, informing

  
  the
  
  
sender that to complete the delivery, they must resend with a completed
subject line.

I've tried using both SUBJECTCHARS and CONTSPACES, but they don't seem to
work as I'd like.

Is there a specific test or filter I can use to detect blank subject lines?

TIA


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus

  
  (http://www.declude.com)]
  
  
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





  
  
--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  


-- 
S.J.Stanaitis
Network Administrator, Decorative Product Source
http://www.dpsource.com/

[EMAIL PROTECTED]
(877)-650-8054 x160

RE: [Declude.JunkMail] Filter for blank subject lines

I have pro and my filters work, yet ISBLANK, IS BLANK, IS, and IS , all pass
mail with blank subjects through.  White listing plays no part. Do you know
if that is supposed to work for sure?

Thanks.

Sorry for the vent earlier.  I got my ass chewed REAL good today because I
forget to do something.  Normally I'd catch it in my end of the day email
reviews... but this one had no subject, so I (accidentally?) overlooked it.
Had it carried even the vaguest of subject lines, I think it would have
caught my attention last night before I left for the day.

Anywho, I'm determined to get them to include subject lines one way or
another.  Ideally it'll be mandatory as forced by either DecludeJunkMail or
Imail.



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Scott Fisher
Sent: Wednesday, January 05, 2005 2:24 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter for blank subject lines


If you have Junkmail Pro, try this as a Filter:
SUBJECT 10ISBLANK

- Original Message -
From: [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Wednesday, January 05, 2005 2:25 PM
Subject: [Declude.JunkMail] Filter for blank subject lines


 Any previous talk on filtering for blank subject lines is 2 years old, so
 I'd like to present the question again, and/or make a new feature request.

 Within our corp, we have several employees who enjoy send their mails with
 no subject what-so-ever.  Wrist slaps have done nothing to correct this
 problem.  I'd like very much to bounce mails lacking subjects, informing
the
 sender that to complete the delivery, they must resend with a completed
 subject line.

 I've tried using both SUBJECTCHARS and CONTSPACES, but they don't seem to
 work as I'd like.

 Is there a specific test or filter I can use to detect blank subject
lines?

 TIA


 ---
 [This E-mail scanned for viruses by Declude Virus]

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter for blank subject lines

2005-01-05 Thread Kevin Bilbee




I have 
instructed users that send me messages with no subject, they are filtered into a 
folder and I go through them in my free time. They all know I have no free time. 
I get messages with subjects now.

A good 
computer/email usage policy can also enable you to terminate employees that do 
not follow it. Get management involved and let them know how much of yor time is 
wasted looking for messages with no subject lines.

If you 
are using outlook install LookOut to index your mesages for keyword 
searching.

Kevin 
Bilbee

  -Original Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]On Behalf Of 
  S.J.StanaitisSent: Wednesday, January 05, 2005 1:37 
  PMTo: Declude.JunkMail@declude.comSubject: Re: 
  [Declude.JunkMail] Filter for blank subject linesI've 
  actually found that ramming their head into the cubicle wall works better than 
  a filing cabinet. They're rather resilient and don't take too much 
  damage, nor are they so hard that they'll actually knock out the luser and 
  make them forget why you were assaulting them.I've got the same 
  situation at my office with the blank subject lines internally, I don't bother 
  telling people what to do, I just find a way to enforce it through 
  software. If/when you get this figured out I am very interested in 
  seeing how it was pulled off. In the mean time I'll tinker around on my 
  server and see if I can get it to work.Sam[EMAIL PROTECTED] wrote: 
  It's not about blocking spam, it's about forcing employees to be sensible
when it comes to electronic messages.  I myself get between 20 - 30 emails a
day from 1 employee that carry blank subjects.  Dare I say 700 a month from
one person?  Memos, personal requests, outside of ramming their head into a
file cabinet, I have tried it all.  Then you have remote users who I don't
have the pleasure of beating on daily.  You want to talk about a very large
problem... I'd love to have 1% or 2% of my messages with no subject line.
As it stands right now, this very second, 20% of my corporate inbox is
filled with messages that have blank subject lines.  That's a very large
problem.  You want to come here a sift through 100 random e-mails trying to
find something?

I am fully aware of problem with bouncing mail and forged headers.  But
using the test or filter intra-domain will have no adverse effects on yours,
or anyone's server... only mine.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Matt
Sent: Wednesday, January 05, 2005 2:35 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter for blank subject lines


Since a sizeable amount of blank subjects are spam and come from forged
addresses, please don't bounce such messages.  It's called backscatter,
and it is a very large problem, typically amounting to 1% to 2% of my
total mail volume.  This is also common enough that you would also upset
many customers.

If you tweak your setup properly, you can tag blank subjects with a
little weight and still not have issues with blocking legitimate E-mail
while improving spam detection.

Matt



[EMAIL PROTECTED] wrote:

  
Any previous talk on filtering for blank subject lines is 2 years old, so
I'd like to present the question again, and/or make a new feature request.

Within our corp, we have several employees who enjoy send their mails with
no subject what-so-ever.  Wrist slaps have done nothing to correct this
problem.  I'd like very much to bounce mails lacking subjects, informing
the
  
sender that to complete the delivery, they must resend with a completed
subject line.

I've tried using both SUBJECTCHARS and CONTSPACES, but they don't seem to
work as I'd like.

Is there a specific test or filter I can use to detect blank subject lines?

TIA


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
  
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send

Re: [Declude.JunkMail] Filter for blank subject lines





No problem at all. I'm guilty of much worse, besides, I responded
inappropriately.

I seem to recall the ISBLANK option not working with SUBJECT. Could be
wrong though, but a test of this would seem definitive. Make sure
there are no tabs or spaces following ISBLANK, unlike other filters,
this is just three columns.

If it is confirmed not to work and you know VBScript, this could be
done in a few lines of code and worked into Declude as an external test
like so:
1) Split on double line break
2) Check first array position (using InStr) for CRLFSubject:
CRLF
3) If a match is found, return an exit code (using WScript.Quit) of 10,
otherwise an exit code of 0.

See the HELOISREVDNS filter on my site for an example of a simple
script and configuration that can be used in Declude as an external
test.

 http://www.mailpure.com/software/decludefilters/beta/

Matt



[EMAIL PROTECTED] wrote:

  I have pro and my filters work, yet ISBLANK, IS BLANK, IS, and IS , all pass
mail with blank subjects through.  White listing plays no part. Do you know
if that is supposed to work for sure?

Thanks.

Sorry for the vent earlier.  I got my ass chewed REAL good today because I
forget to do something.  Normally I'd catch it in my "end of the day" email
reviews... but this one had no subject, so I (accidentally?) overlooked it.
Had it carried even the vaguest of subject lines, I think it would have
caught my attention last night before I left for the day.

Anywho, I'm determined to get them to include subject lines one way or
another.  Ideally it'll be mandatory as forced by either DecludeJunkMail or
Imail.



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Scott Fisher
Sent: Wednesday, January 05, 2005 2:24 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter for blank subject lines


If you have Junkmail Pro, try this as a Filter:
SUBJECT 10ISBLANK

- Original Message -
From: [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Wednesday, January 05, 2005 2:25 PM
Subject: [Declude.JunkMail] Filter for blank subject lines


  
  
Any previous talk on filtering for blank subject lines is 2 years old, so
I'd like to present the question again, and/or make a new feature request.

Within our corp, we have several employees who enjoy send their mails with
no subject what-so-ever.  Wrist slaps have done nothing to correct this
problem.  I'd like very much to bounce mails lacking subjects, informing

  
  the
  
  
sender that to complete the delivery, they must resend with a completed
subject line.

I've tried using both SUBJECTCHARS and CONTSPACES, but they don't seem to
work as I'd like.

Is there a specific test or filter I can use to detect blank subject

  
  lines?
  
  
TIA


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus

  
  (http://www.declude.com)]
  
  
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  
  
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

RE: [Declude.JunkMail] Filter for blank subject lines

2005-01-05 Thread R. Scott Perry


I have pro and my filters work, yet ISBLANK, IS BLANK, IS, and IS , all pass
mail with blank subjects through.  White listing plays no part. Do you know
if that is supposed to work for sure?
Are you creating a filter test for it?  The SUBJECT 10 ISBLANK line 
should work with the latest version of Declude JunkMail Pro, if it appears 
in a filter file.  It won't work on a line in the global.cfg file, however 
(or else Declude JunkMail won't know the weight or actions to use).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter for blank subject lines

Ok... This is what I have

In global.cfg:
SUBJECTFILTER   filter  C:\IMail\Declude\subjectfilter.txt  x
5   0

In $default$.cfg for this domain:
SUBJECTFILTER   WARN

In C:\IMail\Declude\subjectfilter.txt:

SUBJECT 10 ISBLANK

By doing this, sending mail from a remote domain, the mail passes through
never running against this filter.

If I change the filter to:
SUBJECT 10 CONTAINS RTRT

and send a mail from the remote domain with RTRT as the subject, the mail is
ran against the filter, and the headers show that it has failed the test.

I even tried tabbing the filter so it reads: SUBJECT10  ISBLANK and
it still doesn't pick anything up.

Any Ideas?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, January 05, 2005 5:45 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Filter for blank subject lines


I have pro and my filters work, yet ISBLANK, IS BLANK, IS, and IS , all 
pass mail with blank subjects through.  White listing plays no part. Do 
you know if that is supposed to work for sure?

Are you creating a filter test for it?  The SUBJECT 10 ISBLANK line should
work with the latest version of Declude JunkMail Pro, if it appears in a
filter file.  It won't work on a line in the global.cfg file, however (or
else Declude JunkMail won't know the weight or actions to use).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.



This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Filter for blank subject lines





Is there a line return after your filter line? Declude needs a line
return following every line (kind of a PITA).

If so, I would assume that it doesn't work (bug). I recall it not
working for me, but I haven't bothered to confirm that.

Matt



[EMAIL PROTECTED] wrote:

  Ok... This is what I have

In global.cfg:
SUBJECTFILTER	filter		C:\IMail\Declude\subjectfilter.txt	x
5	0

In $default$.cfg for this domain:
SUBJECTFILTER	WARN

In C:\IMail\Declude\subjectfilter.txt:

SUBJECT 10 ISBLANK

By doing this, sending mail from a remote domain, the mail passes through
never running against this filter.

If I change the filter to:
SUBJECT 10 CONTAINS RTRT

and send a mail from the remote domain with RTRT as the subject, the mail is
ran against the filter, and the headers show that it has failed the test.

I even tried tabbing the filter so it reads: SUBJECT	10	ISBLANK and
it still doesn't pick anything up.

Any Ideas?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Wednesday, January 05, 2005 5:45 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Filter for blank subject lines


  
  
I have pro and my filters work, yet ISBLANK, IS BLANK, IS, and IS , all 
pass mail with blank subjects through.  White listing plays no part. Do 
you know if that is supposed to work for sure?

  
  
Are you creating a filter test for it?  The "SUBJECT 10 ISBLANK" line should
work with the latest version of Declude JunkMail Pro, if it appears in a
filter file.  It won't work on a line in the global.cfg file, however (or
else Declude JunkMail won't know the weight or actions to use).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.



This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

RE: [Declude.JunkMail] Filter for blank subject lines




didn't seem to make a difference. mail still passed 
through unaffected.


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of 
MattSent: Wednesday, January 05, 2005 8:12 PMTo: 
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Filter 
for blank subject lines
Is there a line return after your filter line? Declude needs a 
line return following every line (kind of a PITA).If so, I would assume 
that it doesn't work (bug). I recall it not working for me, but I haven't 
bothered to confirm that.Matt[EMAIL PROTECTED] wrote: 
Ok... This is what I have

In global.cfg:
SUBJECTFILTER	filter		C:\IMail\Declude\subjectfilter.txt	x
5	0

In $default$.cfg for this domain:
SUBJECTFILTER	WARN

In C:\IMail\Declude\subjectfilter.txt:

SUBJECT 10 ISBLANK

By doing this, sending mail from a remote domain, the mail passes through
never running against this filter.

If I change the filter to:
SUBJECT 10 CONTAINS RTRT

and send a mail from the remote domain with RTRT as the subject, the mail is
ran against the filter, and the headers show that it has failed the test.

I even tried tabbing the filter so it reads: SUBJECT	10	ISBLANK and
it still doesn't pick anything up.

Any Ideas?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Wednesday, January 05, 2005 5:45 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Filter for blank subject lines


  
  I have pro and my filters work, yet ISBLANK, IS BLANK, IS, and IS , all 
pass mail with blank subjects through.  White listing plays no part. Do 
you know if that is supposed to work for sure?

Are you creating a filter test for it?  The "SUBJECT 10 ISBLANK" line should
work with the latest version of Declude JunkMail Pro, if it appears in a
filter file.  It won't work on a line in the global.cfg file, however (or
else Declude JunkMail won't know the weight or actions to use).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.



This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

RE: [Declude.JunkMail] Filter for blank subject lines