FYI, from Steve Linford of spamhaus:
http://groups-beta.google.com/group/news.admin.net-abuse.email/msg/2d050ab220faf931
http://www.spamhaus.org/zen/
Bill
David Sullivan wrote the following on 11/15/2006 12:58 PM -0800:
> Does anyone have the proper setup in Declude to query
> sbl-xbl.spamhaus.
There are a few e-mail encryption services out
there (e.g, see Sigaba & Zix, among others). We provide an
encrypted e-mail service for our healthcare customers that encrypts messages,
not only in transport, but while stored in their mailboxes, as well. We
also provide a TLS/SSL gateway ser
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill
Landry
Sent: Wednesday, August 09, 2006 2:42 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] 4.3.7 & 3.1.1 Released
David, how does one go about finding and downloading v3
David, how does one go about finding and downloading v3.1.1 for Declude? I
don't see it available for download on my download page at the Declude web
site.
Bill
- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To: ;
Sent: Friday, August 04, 2006 5:48 AM
Subject: [Declud
run, please do heed Steve's request atthe end of
this message about scripting the downloads for the new scam.ndb,at least
for now...Thanks,Bill- Original Message -From:
"Steve Basford" <[EMAIL PROTECTED]>To:
"Bill Landry" <[EMAIL PROTECTED]>Sent:
ge -
From: "Steve Basford" <[EMAIL PROTECTED]>
To: "Bill Landry" <[EMAIL PROTECTED]>
Sent: Monday, August 07, 2006 12:51 PM
Subject: Re: scam database
Hi Bill,
Just to let you know I've done a big update to the scam database,
which isn't publicily know
ge -
From: "Steve Basford" <[EMAIL PROTECTED]>
To: "Bill Landry" <[EMAIL PROTECTED]>
Sent: Monday, August 07, 2006 12:51 PM
Subject: Re: scam database
Hi Bill,
Just to let you know I've done a big update to the scam database,
which isn't publicily know
ssage -
From: "Sanford Whiteman" <[EMAIL PROTECTED]>
To: "Bill Landry"
Sent: Wednesday, July 19, 2006 3:13 PM
Subject: Re[6]: [Declude.JunkMail] Declude 4.3 - Commtouch trial ?
Razor has always been "free", even during that very short timeframe
of l
David, it looks like Declude needs to update its SPF record as posts from
the list are failing both:
SPF_HELO_SOFTFAIL
SPF_SOFTFAIL
DNSStuff is showing "softfail" for your mail delivery host IP address, as
well:
http://www.dnsstuff.com/tools/spf.ch?server=declude.com&ip=63.246.31.248
Bill
I thought this was due to a glitch in the transition from IMail to
SmarterMail at Declude.
Bill
- Original Message -
From: "Sanford Whiteman" <[EMAIL PROTECTED]>
To: "David Barker"
Sent: Wednesday, July 19, 2006 1:49 PM
Subject: Re[6]: [Declude.JunkMail] Declude 4.3 - Commtouch trial
ff and their capabilities
than I do, so I'll admit that I could be wrong...
Bill
- Original Message -
From: "Sanford Whiteman" <[EMAIL PROTECTED]>
To: "Bill Landry"
Sent: Wednesday, July 19, 2006 1:47 PM
Subject: Re[4]: [Declude.JunkMail] Declude 4.3 - Commto
different then Declude
looking at building in support to these various spam checksum services -
send the query in the correct format, and properly interpret the returned
response.
Bill
- Original Message -
From: "Sanford Whiteman" <[EMAIL PROTECTED]>
To: "Bill La
resort to
pricey and convoluted options like CommTouch. Had Declude queried its
customer base before getting in bed with CommTouch, they might have come up
with some better/cheaper/more acceptable solutions...
Bill
- Original Message -
From: "Bill Landry" <[EMAIL
Sound like Cloudmark (http://www.cloudmark.com/) and their free Razor
service (http://razor.sourceforge.net/), which I have already been using
successfully for a few years now.
Bill
- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, July 19, 2006 9:33
Thanks Nick, I forgot to mention that on the list a few weeks ago when this
change was made. Here is a simple download script I use on my Fedora
servers that I run via an hourly cron job. It checks to see if there are
any changes to the file and only downloads if there are changes:
==
50 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] image spam
Thanks Bill. I have been using the SARE stock rules but the
others I was unaware of - as well as the update script!
-Nick
Bill Landry wrote:
> You might also want to look at using the SARE rules at
> http:/
You might also want to look at using the SARE rules at
http://www.rulesemporium.com/rules.htm, particularly the SARE Stock rules
(70_sare_stocks.cf). Also, a couple of Fred's rule sets at
http://www.rulesemporium.com/other-rules.htm (88_FVGT_rawbody.cf &
99_FVGT_meta.cf) can be quite helpful,
We have been seeing these for several weeks now, and SA's bayes
implementation handles it quite well. This from the Matt Kettler on the SA
list:
==
How well bayes poison works depends a lot on your "bayes" implementation.
Some
"bayes" implementations are fairly susceptible to this. (
Gary, you should upgrade to 3.0.6, which has been out for about a week now,
as 3.0.5.26 had serious problems with handling certain kinds of mime
encapsulate messages. We actually had to roll back to 3.0.5.23 after
reporting the issues with 3.0.5.26 to Declude. Version 3.0.6 fixed this
issue.
ks (and Ebay) Phising Filters
Aaarrgg.
Good catch Bill.
- Original Message -
From: "Bill Landry" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, February 21, 2006 12:03 PM
Subject: Re: [Declude.JunkMail] Banks (and Ebay) Phising Filters
- Original Message -
From: "S
- Original Message -
From: "Scott Fisher" <[EMAIL PROTECTED]>
You do need the Pro version to run more than one scanner.
It's the best thing about Virus Pro...
Also nice if you get a set of bad definitions or a scanner stops working,
the other scanners will cover.
With PRESCAN ON, Mca
Didn't get any notification here either.
Bill
- Original Message -
From: "Matt" <[EMAIL PROTECTED]>
To:
Sent: Friday, February 10, 2006 11:03 AM
Subject: Re: [Declude.JunkMail] Changes @ Declude
Barry,
I didn't get the E-mail that you mentioned.
I'm also wondering about what the t
I notice on the Declude web site that Declude 4.0.8 is available for
download. I don't recall seeing any announcement of a new version, so
what's new or changed in the 4.0 version?
Bill
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the D
I wouldn't recommend removing the /PACKED switch. Here are the switches I
have been using on both of our IMail/Declude/F-Prot servers for the past
couple of years without issue:
C:\Progra~1\FSI\F-Prot\fpcmd.exe -AI -ARCHIVE=5 -DUMB -NOBOOT -NOBREAK -NOMEM
-PACKED -SAFEREMOVE -SERVER -SILENT -
Don't know if you would want to use them, even if
they were available, as the writer was high on life and drunk with enthusiasm
most of the time while concocting them... ;-)
Bill
- Original Message -
From:
Evans Martin
To: Declude.JunkMail@declude.com
Sent: Frid
e bed and who is supplying the
bedding?
John T
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Bill Landry
Sent: Tuesday, January 24, 2006 5:29 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Eart
I think you've got it backwards, SBC acquired AT&T but is keeping the AT&T
name.
Bill
- Original Message -
From: "John T (Lists)" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, January 24, 2006 4:23 PM
Subject: RE: [Declude.JunkMail] Earthlink/prodigy
And since AT&T now owns SBC, aren't we get
We are running Declude Version 3.0.5.23 with JunkMail and Virus Pro on two
dual-proc servers and are not seeing this. I often see the CPU at zero when
no mail is being processes.
Bill
- Original Message -
From: "David Sullivan" <[EMAIL PROTECTED]>
To: "Matt"
Sent: Friday, January 13
You can. Simply add a line to your hosts file on your current mail server
like:
ip.of.gate.waycomcast.com
Then all mail destine for comcast.com will get sent directly to the gateway
server and all other mail will still get delivered as usual.
Bill
- Original Message -
From: "Da
I doubt that the problems experienced by the
Declude licensing server had anything to do with your DNS tests failing. I
have been running version 3.0.5.22 since it was released and experienced no
problems over the weekend, including DNS based tests.
Bill
- Original Message -
What version of decludeproc are your running?
decludeproc -v
Sounds like an old issue that has been resolved in more recent releases.
Bill
- Original Message -
From: "Harry Vanderzand" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, December 13, 2005 9:30 AM
Subject: [Declude.JunkMail] Dec
Yes, 8.2 needs to be patched, as well. See:
http://www.ipswitch.com/support/imail/releases/imail_professional/im822.asp
Bill
- Original Message -
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, December 07, 2005 5:54 AM
Subject: Re: [Declude.JunkMail] Bug
It's not necessary to stop/start any IMail services, since IMail calls
declude.exe (not decludeproc.exe), and all declude.exe does is move the
queue files from the spool directory to the proc directory. Decludeproc
checks the proc directory at whatever time interval you have set in you
declude
Take a look at SpamAssassin or the SA plug-in for Declude.
Bill
- Original Message -
From: "Dave Beckstrom" <[EMAIL PROTECTED]>
To:
Sent: Friday, November 11, 2005 8:56 AM
Subject: RE: [Declude.JunkMail] Cryptic URL in source
David,
Could I suggest that you consider adding somethin
Mike, you cannot simply execute the Decludeproc30xxx.exe file to do the
decludeproc upgrade, you need to stop the decludeproc service, delete the
old decludeproc.exe file, then rename the Decludeproc30xxx.exe to
decludeproc.exe and then restart the service.
Bill
- Original Message -
F
Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Bill Landry
Sent: Tuesday, November 01, 2005 12:53 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] V3.05.14 issue
David, I made the suggested change to my declude.cfg and within 3 minutes
the orphaned .vir directories started showing
KCLEANUPON for 3.0.5.14
David B
www.declude.com
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry
Sent: Tuesday, November 01, 2005 1:18 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] V3.05.14 issue
I sent info to Declude su
I sent info to Declude support yesterday about this, but have not received a
response yet. I also had to revert back to V3.0.5.12 yesterday because of
this issue.
Bill
- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, November 01, 2005 10:09 AM
Subject
I've tested the upgrade to Declude 3.0.5.9 on a test server and noted a
couple of minor issues. First, "Decludeproc -v" shows:
Declude Version 3.0.5.9
However, "decludeproc -diag" shows:
Invalid command line parameter:
-install Install Declude
-diagPrint diagnostics
Ditto, since we run dual-proc IMail servers, as well. What are the current
declude.cfg entries and recommended settings. Are all of the documented
issues now resolved?
Bill
- Original Message -
From: "Matt" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, October 19, 2005 12:24 PM
Subject:
- Original Message -
From: "John T (Lists)" <[EMAIL PROTECTED]>
I am looking for a way to edit a text file through command line for use in
batch files, generally doing search and replace.
If any one has suggestions, please let me know.
Sed works well for this type of function:
sed "
Why would you want to do this and send the message through SA again if it's
already running on your gateway?
Bill
- Original Message -
From: "Travis Sullivan" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, September 20, 2005 11:24 AM
Subject: Re: [Declude.JunkMail] declude / spamassassin
T
- Original Message -
From:
Matt
To: Declude.JunkMail@declude.com
Sent: Thursday, August 04, 2005 3:18
PM
Subject: Re: [Declude.JunkMail] Spam
box
One other note to add to this.ORF plugs-into MS SMTP. I
have unfortunately found that MS SMTP doesn't appear
- Original Message -
From:
Goran
Jovanovic
To: Declude.JunkMail@declude.com
Sent: Thursday, August 04, 2005 2:10
PM
Subject: RE: [Declude.JunkMail] Spam
box
I have a question
about these boxes that go in front of Declude, be they IMGATE or ORF or
- Original Message -
From:
Goran
Jovanovic
To: Declude.JunkMail@declude.com
Sent: Thursday, August 04, 2005 2:10
PM
Subject: RE: [Declude.JunkMail] Spam
box
I have a question
about these boxes that go in front of Declude, be they IMGATE or ORF or
- Original Message -
From: "Chuck Cahill" <[EMAIL PROTECTED]>
The destination client is a Financial Organization who handles our
electronic billing. They are complaining that the X-Mailer: header is
causing a routing issue with their automation software and want us to
remove it.
Chu
- Original Message -
From: "Adam Hobach" <[EMAIL PROTECTED]>
> Hello,
>
> Does anyone have a way to automatically delete emails that have MX/mail
> records that point to 127.0.0.1? The email is currently in a loop on our
> mail server then eventually fails. The link below is an example do
- Original Message -
From: "Michael L. Hardrick" <[EMAIL PROTECTED]>
Ipswitch IMail Server Multiple Unspecified Vulnerabilities
http://www.securityfocus.com/bid/13727?ref=rss
Though they don't report it, I'm assuming that 8.15 with HF2 is not
vulnerable either, since the HF2 patches
- Original Message -
From: "Spaminator" <[EMAIL PROTECTED]>
Bill, thanks-- this helps a lot.
The imail statistics test was one I wanted to capture with declude,
but mostly I'm looking for the phrase and URL tests (which we've
spent years tweaking extensively). So, this is good news (a
- Original Message -
From: "NIck Hayer" <[EMAIL PROTECTED]>
Bill Landry wrote:
Actually, some IMail spam tests run before being passed to Declude and
some after. The JunkMail archives will contain the gory details.
Bill
correct William - but the headers are after.
- Original Message -
From: "NIck Hayer" <[EMAIL PROTECTED]>
I do not think this will work. The imail headers are added after declude
sees the email
Actually, some IMail spam tests run before being passed to Declude and some
after. The JunkMail archives will contain the gory details
I see three instances of "Using [im.decludekey.us]" every time
I run the "declude -diag" command on my two IMail/Declude servers. I use
the following setting in my declude.cfg files:
DNS xxx.xxx.xxx.xxx
because I don't use the same DNS setting
for Declude as I have configure in IMail.
Here's another one:
http://mailscanner.prolocation.net/german.cf
Bill
- Original Message -
From: "Markus Gufler" <[EMAIL PROTECTED]>
To:
Sent: Sunday, May 15, 2005 9:07 AM
Subject: RE: [Declude.JunkMail] German political spam
The direct link for spamassassins filter file is
http://www.f
- Original Message -
From: "Joey Proulx" <[EMAIL PROTECTED]>
Can someone please explain to me why, if an email is flagged as spam by
Sniffer, I shouldn't just delete it outright? Are there instances where
Sniffer is wrong? Or is this the way you all use it already?
Reason I ask is th
- Original Message -
From: "Evans Martin" <[EMAIL PROTECTED]>
> I wish to move my Declude log file out of the Imail\Spool directory and to
a
> directory called \Program Files\SyslogD\Logs. However, when I set LOGFILE
> to c:\Program Files\SyslogD\Logs\dec.log, I get a log file in the
All this and more is available via SpamAssassin. You may want to look at
Sandy's SA plug-in to Declude, or possibly look at setting up SA on a
Linux/Postfix/Amavisd-New/Sniffer gateway.
Bill
- Original Message -
From: "Darin Cox" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, February 01, 2005
Yep, Declude really dropped the ball with their lack of URIBL support in
their latest release.
Bill
- Original Message -
From: "Andy Schmidt" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, February 01, 2005 11:24 AM
Subject: [Declude.JunkMail] Imail 8.2 Beta
Don't know if everyone saw that.
L
- Original Message -
From: <[EMAIL PROTECTED]>
> Is any one seeing Google and or Earthlink failing the subjectchars test on
> blank subject lines or even if there is a subject typed in ?
>
> Any one know of a reason for this.
This was a know bug that I think has been fixed with the lates
- Original Message -
From: "Matt" <[EMAIL PROTECTED]>
> My fault for mixing up names in this case. I was thinking about the
> combined URIBL zone and not your version of the checker. The issue that
> I was really intending to speak to was the combined zone
> (multi.surbl.org) that some
- Original Message -
From: "Jonathan" <[EMAIL PROTECTED]>
> I was just playing with this today - I'm not sure I'd put much faith in
> surbl.org. The first two messages I saw it tag in my own inbox, were
> very legitimate. In fact, one of them was from Wells Fargo (*really*
> from Wells F
My read is that he is only attempting to enforce the subject requirement on
his on users within his own domain. So if he builds his rules
appropriately, either as a specific domain rule or a combo filter, he should
be able to apply the subject requirement to his own users/domain without
affecting
I agree with your comments, Matt. The other thing that has frustrated me is
the fact that a bug will be fixed in an interim release and no mention of it
will be made on the list until someone else complains about the problem on
the list. Then there would come a response, "oh, that was fixed two m
- Original Message -
From: "Dave Doherty" <[EMAIL PROTECTED]>
> I set it to zero weight temporarily. I also sent an email direct to Scott
> and Barry.
Why run the test at all if you're going to set the weight to zero anyway -
just comment out the test until it's fixed.
I can see this ca
- Original Message -
From: "Dave Doherty" <[EMAIL PROTECTED]>
> I had a couple of false positives this morning caused in part by
SPAMHEADERS
> apparently objecting to 2005 as an invalid year. When I checked my normal
> mail, everything I checked failed SPAMHEADERS.
>
> Using Declude 1.79i
Scott, is Declude no longer supporting web-o-trust? The site is no longer
available on the Declude web site (http://www.declude.com/web-o-trust.txt),
however, you are still listed at http://www.web-o-trust.org/everybody.txt.
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://
Nice to know that Declude is listening to our requests.
Thanks Ralph!
Bill
- Original Message -
From: Ralph Krausse
To: [EMAIL PROTECTED]
Sent: Tuesday, December 21, 2004 10:57 AM
Subject: Declude 2.0b Install
Hello
Bill,
I wanted to let
you know that I was monitoring th
- Original Message -
From: "Richard Lanard" <[EMAIL PROTECTED]>
> I've been thinking about the Sniffer, but i had a few questions:
> Do i have to have Pro to run it, i.e. external tests?
>
> and How effective is it against Phishing?
>or would it be better to add Mcafee and
t; helo 99.7% spam 2612/52891 emails
>
> combo of the above 98.2% spam 3556/52891 emails
>
>
>
> When I rhsbl the dynamic I would get too many false positives.
>
> I never got a hit off the fraud list so I stopped using it.
>
>
>
> - Original Message
- Original Message -
From: "Scott Fisher" <[EMAIL PROTECTED]>
> You can also use their rev dns list:
> MAILPOLICE-REVDNS dnsbl %REVDNS%.dynamic.rhs.mailpolice.com 127.0.0.2 50
0
Hmmm, do you actually catch anything with this test? And why would you go
through the trouble of setting it
- Original Message -
From: "Glen Harvy" <[EMAIL PROTECTED]>
> Hi,
>
> Is anyone using mailpolice and if so what details are required in the
> global.cfg file?
See http://rhs.mailpolice.com/usage.php. Here is an example of how to setup
the MailPolice Block list as an RHSBL type test in t
- Original Message -
From: "William Stillwell" <[EMAIL PROTECTED]>
> Umm, Wouldn't the 0 9 setting put a Positive weight on a good clean email?
>
> shouldn't it be like
>
> SNIFFER external nonzero "c:\sniffer\win32\licenseid.exe authcode" 7 -7
>
> which would put a Positive 7 on a nonze
Folks, apparently the PH and JP lists were never setup as
separate SURBL zones, so I would recommend not querying those lists as you will
never get a response from them until Declude JunkMail supports bitmasked
responses.
Bill
- Original Message -
From:
Markus Gufler
joining?>>
Thanks, man.>> Darin.>>> - Original
Message - > From: "Bill Landry" <[EMAIL PROTECTED]>> To:
<[EMAIL PROTECTED]>>
Sent: Tuesday, November 23, 2004 5:04 AM> Subject: Re:
[Declude.JunkMail] SURBL as RHSBL>&g
- Original Message -
From: Scott Fisher
> I don't believe the Jon Wein and the Phish are testable on their own. I
> haven't received an hits on jp.surbl.org.
Yep, that does appear to be the case for the JP list - it was the last list
added to SURBL, and since it was added after the creat
BL as
RHSBL
Hi Bill,You seem to always be one of the first to share
new blacklists. Where doyou find this info? Is there another
list that would be worth joining?Thanks,
man.Darin.- Original Message - From: "Bill
Landry" <[EMAIL PROTECTED]>To: <[EMAIL PRO
SURBL_PH rhsbl ph.surbl.org127.0.0.2 1 0
SURBL_SC rhsbl sc.surbl.org127.0.0.2 1 0
SURBL_WS rhsbl ws.surbl.org127.0.0.2 1 0
Which will require six different queries if you want to use all SURBL lists.
Bill
- Original Message -
From: Bill Landry
To: [EMAIL PROTECTED]
Sent
Markus, if you want to test against all of the SURBLs, since
it's only a single query to the multi zone, use:
SURBL_AB rhsbl multi.surbl.org127.0.0.32 1 0SURBL_JP rhsbl multi.surbl.org127.0.0.64 1 0SURBL_OB rhsbl multi.surbl.org127.0.0.16 1 0SURBL_PH rhsbl multi.surbl.org1
Hmmm, that could possibly render some decent results if spammers use the
same domain in the "MAIL FROM:" address in the SMTP envelope as they us in
the URI listed in the body of the message. How are the results stacking up
against your other RHSBL tests?
Bill
- Original Message -
From: "
- Original Message -
From: "Serge" <[EMAIL PROTECTED]>
> what i am trying is to copy these messages to a mailbox for further review
> to help me understand and fine tune my weighing, with the message still
> going to the final recipient.
First, the "TESTSFAILED" location parameter is sup
- Original Message -
From: "Serge" <[EMAIL PROTECTED]>
> i set the following filter to collect spam messages that are not caught by
> sniffer
> not working
> does the testfailed work on weight test ?
> If not, how to change the filter to do what I need ?
>
> TESTFAILED END CONTAINS SNIFFE
- Original Message -
From: "Scott Fisher" <[EMAIL PROTECTED]>
> Habeas by itself was useless. A trivial amount of spammers using it.
> I turned Habeas-HIL off... Too few responses to be useful. Twice in the
last
> year they were false positiving on AOL, so when I was using it, their
weigh
- Original Message -
From: "Jeff Kratka" <[EMAIL PROTECTED]>
> Has anyone had better luck with habeas lately. I turned things off since
the
> spammers jumped on.
Don't use the Declude JunkMail habeas whitelist feature:
WHITELIST HABEAS
nor
HABEAS habeas x x -3 0
the water
- Original Message -
From: "Nick" <[EMAIL PROTECTED]>
> How do you handle if a particular rhsbl returns multiple return codes
> like 127.0.0 2; 127.0.0 4, etc and you want to pick which one to use -
> is it:
> urirhsbl URIBL_EX multiple.example.com. A 127.0.0.4
> or
> urirhssub URIBL_EX
I should have clarified, the example I give below is for SA 3.0.1, since
they changed the action from "header" to the more appropriate "body" setting
between SA 3.0.0 & 3.0.1. So, you have it correct if you are using anything
before 3.0.1.
Bill
- Original Message -
- Original Message -
From: "Nick" <[EMAIL PROTECTED]>
> A little SpamAssassin help please -
>
> > It does, but it can also be used with Declude as an RHSBL now:
> > MAILPOLICE-FRAUDfraud.rhs.mailpolice.com 127.0.0.230
>
> to see if I have this correct for SA 3x
>
> In my lo
It does, but it can also be used with Declude as an RHSBL now:
MAILPOLICE-FRAUDfraud.rhs.mailpolice.com 127.0.0.230
Bill
- Original Message -
From: "Scott Fisher" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, November 08, 2004 12:54 PM
Subject: Re: [Declude.Junk
are, so I pull them
over
> to a temp folder on my desktop with RoboCopy from the Microsoft Windows
> Server Resource Kit. So I've got two scripts that parse the date and pull
> down the correct decMMDD.log (or sysMMDD.txt) for today, and another for
> yesterday. They're called Today an
- Original Message -
From: "Serge" <[EMAIL PROTECTED]>
> Sorry, i may not expressed myself
>
> I need to
> grep %variable% ...
>
> Where the variable takes all the values generated by the first grep:
> grep "MAIL FROM:[EMAIL PROTECTED]" D:\log1104.txt | gawk "{print $5}" |
uniq
>
> Should
- Original Message -
From: "Serge" <[EMAIL PROTECTED]>
> Sorry, i may not expressed myself
>
> I need to
> grep %variable% ...
>
> Where the variable takes all the values generated by the first grep:
> grep "MAIL FROM:[EMAIL PROTECTED]" D:\log1104.txt | gawk "{print $5}" |
uniq
>
> Should
- Original Message -
From: "Serge" <[EMAIL PROTECTED]>
> Here is a line that will give me all sessions from a user:
>
> grep "MAIL FROM:[EMAIL PROTECTED]" D:\log1104.txt | gawk "{print $5}" |
uniq
> > test.txt
>
> Now how do I use a pipe or a batch file to get all the lines for all thes
- Original Message -
From: "Scott Fisher" <[EMAIL PROTECTED]>
> I constantly use this batch file to find in the Declude logs.
> I change the V_logday to the day of the log to search
> and the V_find to the term to find. (It's usual a specific mail id
(Q7172144401ba4a6b or such) and I'll g
- Original Message -
From: "Colbeck, Andrew" <[EMAIL PROTECTED]>
> On various domains I administer, a single point of failure mailhost has
been
> good enough, but I'm shortly going to add a second host on a second
network
> for redundancy.
>
> Now, I understand *how* to do that, but what
- Original Message -
From: "DLAnalyzer Support" <[EMAIL PROTECTED]>
> Those are both great tools. My only complaint with BareTail is I get a
lot
> of flicker under TS. However, their older wintail has no flicker...
Try the grep and tail tools included with the GNU Win32 UNIX utilities
- Original Message -
From: "Mark E. Smith" <[EMAIL PROTECTED]>
> The problem right now is loading a 350mb (let alone 1.6GB) file with
> notepad. :)
Why would you want to open any log in notepad - use grep instead, it is
lightning fast at parsing large log files.
Bill
---
[This E-mail w
- Original Message -
From: "Michael Graveen" <[EMAIL PROTECTED]>
> Scott,
> What does the line "Invalid WHITELIST type: AUTH"?
> I thought WHITELIST AUTH allowed me to white list my users that
authenticate.
You're correct, that's what it does. But like Scott said, you have to be
running
- Original Message -
From: "Colbeck, Andrew" <[EMAIL PROTECTED]>
> John, why are you worried about viruses being held in your spam folder?
If
> they're held, they're effectively quarantined and the user isn't bothered
by
> it, just as they're not bothered by the spam in that folder.
>
> P
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
> >SURBL has a list of TLD's that they use in creating their list. IMO,
this
> >should be quite easy to provide, and if you don't intend to just say the
> >word and someone here will I'm sure gladly offer up their own.
>
> I
- Original Message -
From: "Mark E. Smith" <[EMAIL PROTECTED]>
> Is there a way to have a filter run for only one domain you're hosting?
> I'm running Junkmail Pro
Sure, create a subdirectory under the Declude directory with the domain name
(e.g., example.com) and place a $default$.junkm
Please excuse the wrong terminology usage, I meant the TLDs are "extracted"
not "whitelisted".
Bill
- Original Message -
From: "Bill Landry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, October 29, 2004 3:20 PM
Subject: Re: [Declude
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
> >Scott, is support for URIBLs even on the JunkMail development schedule?
>
> It's something that we looked into. But there was some sort of major
issue
> supporting it, which I believe had to do with third-level domains (s
1 - 100 of 789 matches
Mail list logo
