Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
Hi, Bill- I've been trying to use the latest download and I can't figure out what's wrong. I provide complete paths to the log file and global.cfg. The program lists the tests that are available, then issues a few 0's. After a while it gives me a blank report. LOGLEVEL is set to MID Any suggestions? -Dave - Original Message - From: Bill [EMAIL PROTECTED] To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, April 14, 2004 12:43 PM Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I have been using this program for months with no problem but you guys managed to break it in a matter of hours. :) I guess that I should have called it a BETA release! Anyway, that's what I call it now (v1.4B). I have fixed the problems that you have pointed out to me and have added the following: 1) The output file (wamlog.txt) goes in the same folder as the log file. 2) There is a progress counter so you know it is working. If you find any more problems PLEASE let me know. Thanks, Bill The new version is as of 11:40 am CDT 4/14/04. www.wamusa.com/wamtools Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count % Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH9072799325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL4954465273 BLITZEDALL3350259913 BASE642252129561 MAILFROM1684128411 COMMENTS1328120561 MYFILTERFAIL1159017230 WAMO 5850 6090 MYFILTERPASS 512012390 SORBS-MISC 5040 9230 SORBS-SMTP 445011320 OBFUSCATION 3600 4570 ORDB 3160 6540 SORBS-WEB 3160 5140 SORBS-ZOMBIE 2800 2800 SPFPASS 2080 2340 BONDEDSENDER 620 620 @LINKED 100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count 120934 175163 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
I simply copied a current DEC.log file into the directory I create for WAMLOG and ran Wamlog dec0416.log And it produced a file wamlog.txt in the same directory Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Friday, April 16, 2004 5:31 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report Hi, Bill- I've been trying to use the latest download and I can't figure out what's wrong. I provide complete paths to the log file and global.cfg. The program lists the tests that are available, then issues a few 0's. After a while it gives me a blank report. LOGLEVEL is set to MID Any suggestions? -Dave - Original Message - From: Bill [EMAIL PROTECTED] To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, April 14, 2004 12:43 PM Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I have been using this program for months with no problem but you guys managed to break it in a matter of hours. :) I guess that I should have called it a BETA release! Anyway, that's what I call it now (v1.4B). I have fixed the problems that you have pointed out to me and have added the following: 1) The output file (wamlog.txt) goes in the same folder as the log file. 2) There is a progress counter so you know it is working. If you find any more problems PLEASE let me know. Thanks, Bill The new version is as of 11:40 am CDT 4/14/04. www.wamusa.com/wamtools Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count % Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH9072799325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL4954465273 BLITZEDALL3350259913 BASE642252129561 MAILFROM1684128411 COMMENTS1328120561 MYFILTERFAIL1159017230 WAMO 5850 6090 MYFILTERPASS 512012390 SORBS-MISC 5040 9230 SORBS-SMTP 445011320 OBFUSCATION 3600 4570 ORDB 3160 6540 SORBS-WEB 3160 5140 SORBS-ZOMBIE 2800 2800 SPFPASS 2080 2340 BONDEDSENDER 620 620 @LINKED 100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count 120934 175163 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses
Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
I tried that first on my laptop, then gave up and tried to run it on the server with the same results. The wamlog.txt file is empty. -d - Original Message - From: Goran Jovanovic [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 5:39 PM Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I simply copied a current DEC.log file into the directory I create for WAMLOG and ran Wamlog dec0416.log And it produced a file wamlog.txt in the same directory Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Friday, April 16, 2004 5:31 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report Hi, Bill- I've been trying to use the latest download and I can't figure out what's wrong. I provide complete paths to the log file and global.cfg. The program lists the tests that are available, then issues a few 0's. After a while it gives me a blank report. LOGLEVEL is set to MID Any suggestions? -Dave - Original Message - From: Bill [EMAIL PROTECTED] To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, April 14, 2004 12:43 PM Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I have been using this program for months with no problem but you guys managed to break it in a matter of hours. :) I guess that I should have called it a BETA release! Anyway, that's what I call it now (v1.4B). I have fixed the problems that you have pointed out to me and have added the following: 1) The output file (wamlog.txt) goes in the same folder as the log file. 2) There is a progress counter so you know it is working. If you find any more problems PLEASE let me know. Thanks, Bill The new version is as of 11:40 am CDT 4/14/04. www.wamusa.com/wamtools Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count % Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH9072799325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL4954465273 BLITZEDALL3350259913 BASE642252129561 MAILFROM1684128411 COMMENTS1328120561 MYFILTERFAIL1159017230 WAMO 5850 6090 MYFILTERPASS 512012390 SORBS-MISC 5040 9230 SORBS-SMTP 445011320 OBFUSCATION 3600 4570 ORDB 3160 6540 SORBS-WEB 3160 5140 SORBS-ZOMBIE 2800 2800 SPFPASS 2080 2340 BONDEDSENDER 620 620 @LINKED 100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count 120934 175163 --- [This E-mail
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
This works for me: wamlog dec0416.log c:\imail\declude\global.cfg Modify the parameters to suite your environment, of course. Andrew 8) -Original Message- From: Dave Doherty [mailto:[EMAIL PROTECTED] Sent: Friday, April 16, 2004 8:54 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I tried that first on my laptop, then gave up and tried to run it on the server with the same results. The wamlog.txt file is empty. -d - Original Message - From: Goran Jovanovic [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 5:39 PM Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I simply copied a current DEC.log file into the directory I create for WAMLOG and ran Wamlog dec0416.log And it produced a file wamlog.txt in the same directory Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Friday, April 16, 2004 5:31 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report Hi, Bill- I've been trying to use the latest download and I can't figure out what's wrong. I provide complete paths to the log file and global.cfg. The program lists the tests that are available, then issues a few 0's. After a while it gives me a blank report. LOGLEVEL is set to MID Any suggestions? -Dave - Original Message - From: Bill [EMAIL PROTECTED] To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, April 14, 2004 12:43 PM Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I have been using this program for months with no problem but you guys managed to break it in a matter of hours. :) I guess that I should have called it a BETA release! Anyway, that's what I call it now (v1.4B). I have fixed the problems that you have pointed out to me and have added the following: 1) The output file (wamlog.txt) goes in the same folder as the log file. 2) There is a progress counter so you know it is working. If you find any more problems PLEASE let me know. Thanks, Bill The new version is as of 11:40 am CDT 4/14/04. www.wamusa.com/wamtools Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count % Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH9072799325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL4954465273 BLITZEDALL3350259913 BASE642252129561 MAILFROM1684128411 COMMENTS1328120561 MYFILTERFAIL1159017230 WAMO 5850 6090 MYFILTERPASS 512012390 SORBS-MISC 5040 9230 SORBS-SMTP 445011320 OBFUSCATION 3600 4570 ORDB 3160 6540 SORBS-WEB 3160 5140 SORBS-ZOMBIE 2800
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
DOH! That's what I get for hurrying to get something out before quitting time. Dan Horne, CCNA Web Services Administrator TAIS Web Wilcox World Travel Tours [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. SPAM-FREE 1.0(2476) -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Tuesday, April 13, 2004 5:40 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report - Original Message - From: Dan Horne [EMAIL PROTECTED] I have attached my Global.cfg. The logfile that it was parsing was only 14 megs. Any ideas? Do I need to change something for it to work? I tried WAMLOG with the debug option, but it did the same thing. You should really consider doing some editing/masking of your config file settings before sending it to a public list. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
That is because end users apply programs how they WANT, now how the writer intended hehe... Nice program, thank you for your time investing to help us as well. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Sent: Wednesday, April 14, 2004 12:43 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I have been using this program for months with no problem but you guys managed to break it in a matter of hours. :) I guess that I should have called it a BETA release! Anyway, that's what I call it now (v1.4B). I have fixed the problems that you have pointed out to me and have added the following: 1) The output file (wamlog.txt) goes in the same folder as the log file. 2) There is a progress counter so you know it is working. If you find any more problems PLEASE let me know. Thanks, Bill The new version is as of 11:40 am CDT 4/14/04. www.wamusa.com/wamtools Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count %Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH90727 99325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL49544 65273 BLITZEDALL33502 59913 BASE6422521 29561 MAILFROM16841 28411 COMMENTS13281 20561 MYFILTERFAIL11590 17230 WAMO 58506090 MYFILTERPASS 5120 12390 SORBS-MISC 50409230 SORBS-SMTP 4450 11320 OBFUSCATION 36004570 ORDB 31606540 SORBS-WEB 31605140 SORBS-ZOMBIE 28002800 SPFPASS 20802340 BONDEDSENDER 620 620 @LINKED 100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count 120934 175163 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
Hi Bill, Haven't tried this new version, but recently tried the old one and it is very useful. Thanks. Question for you: It looks like it counts whitelisted email in the total percentages. Is this so? Might be useful to add a line showing what percentage is whitelisted, or just exclude whitelisted email, to more accurately portray usefulness of various tests. Darin. - Original Message - From: Bill [EMAIL PROTECTED] To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, April 14, 2004 12:43 PM Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I have been using this program for months with no problem but you guys managed to break it in a matter of hours. :) I guess that I should have called it a BETA release! Anyway, that's what I call it now (v1.4B). I have fixed the problems that you have pointed out to me and have added the following: 1) The output file (wamlog.txt) goes in the same folder as the log file. 2) There is a progress counter so you know it is working. If you find any more problems PLEASE let me know. Thanks, Bill The new version is as of 11:40 am CDT 4/14/04. www.wamusa.com/wamtools Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count % Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH9072799325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL4954465273 BLITZEDALL3350259913 BASE642252129561 MAILFROM1684128411 COMMENTS1328120561 MYFILTERFAIL1159017230 WAMO 5850 6090 MYFILTERPASS 512012390 SORBS-MISC 5040 9230 SORBS-SMTP 445011320 OBFUSCATION 3600 4570 ORDB 3160 6540 SORBS-WEB 3160 5140 SORBS-ZOMBIE 2800 2800 SPFPASS 2080 2340 BONDEDSENDER 620 620 @LINKED 100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count 120934 175163 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
Smokin' Bill! That's very fast. I certainly found a few surprises at 0 hits for a normal day. Some low priority suggestions: - Change fail wording in the header to trigger or hit or something. - Ignore Declude directives, e.g. LOOSENSPAMHEADERS, HOPHIGH, CONSOLE, PREWHITELIST ... Thanks for the new tool. Andrew 8) -Original Message- From: Bill [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 14, 2004 9:43 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I have been using this program for months with no problem but you guys managed to break it in a matter of hours. :) I guess that I should have called it a BETA release! Anyway, that's what I call it now (v1.4B). I have fixed the problems that you have pointed out to me and have added the following: 1) The output file (wamlog.txt) goes in the same folder as the log file. 2) There is a progress counter so you know it is working. If you find any more problems PLEASE let me know. Thanks, Bill The new version is as of 11:40 am CDT 4/14/04. www.wamusa.com/wamtools Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count %Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH90727 99325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL49544 65273 BLITZEDALL33502 59913 BASE6422521 29561 MAILFROM16841 28411 COMMENTS13281 20561 MYFILTERFAIL11590 17230 WAMO 58506090 MYFILTERPASS 5120 12390 SORBS-MISC 50409230 SORBS-SMTP 4450 11320 OBFUSCATION 36004570 ORDB 31606540 SORBS-WEB 31605140 SORBS-ZOMBIE 28002800 SPFPASS 20802340 BONDEDSENDER 620 620 @LINKED 100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count 120934 175163 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
I have been using this program for months with no problem but you guys managed to break it in a matter of hours. :) I guess that I should have called it a BETA release! Anyway, that's what I call it now (v1.4B). I have fixed the problems that you have pointed out to me and have added the following: 1) The output file (wamlog.txt) goes in the same folder as the log file. 2) There is a progress counter so you know it is working. If you find any more problems PLEASE let me know. Thanks, Bill The new version is as of 11:40 am CDT 4/14/04. www.wamusa.com/wamtools Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count %Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH90727 99325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL49544 65273 BLITZEDALL33502 59913 BASE6422521 29561 MAILFROM16841 28411 COMMENTS13281 20561 MYFILTERFAIL11590 17230 WAMO 58506090 MYFILTERPASS 5120 12390 SORBS-MISC 50409230 SORBS-SMTP 4450 11320 OBFUSCATION 36004570 ORDB 31606540 SORBS-WEB 31605140 SORBS-ZOMBIE 28002800 SPFPASS 20802340 BONDEDSENDER 620 620 @LINKED 100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count 120934 175163 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
Some low priority suggestions: - Change fail wording in the header to trigger or hit or something. - Ignore Declude directives, e.g. LOOSENSPAMHEADERS, HOPHIGH, CONSOLE, PREWHITELIST ... Thanks for the suggestions. I did try to ignore Declude directives but I went by the manual. These are the directives that I am ignoring: WHITELIST LOGFILE LOGLEVEL CODE HOP XINHEADER XOUTHEADER XSENDER XSPOOLNAME HIDETESTS IPBYPASS DNS AUTOWHITELIST WHITELISTFILE If anyone can provide me with a complete list, I will make the modification. Thanks, Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. Wow. Very fast! Could you explain this numbers? Message Recipient Test Name Fail Count %Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 What does mean the separation between Message and Recipient Fail Count? Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
a message to: [EMAIL PROTECTED] would add one to message count an one to recipient count for each test failed A message to: [EMAIL PROTECTED] user2.domain.com would add one to message count an two to recipient count for each test failed. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Tuesday, April 13, 2004 2:54 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. Wow. Very fast! Could you explain this numbers? Message Recipient Test Name Fail Count %Fail Count % WEIGHT10116362 96 169684 96 SNIFFER2114790 94 167322 95 WEIGHT15112700 93 165299 94 WEIGHT20108443 89 159758 91 What does mean the separation between Message and Recipient Fail Count? Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
Nice little utility Bill. Thanks a bunch. Adrian Bill wrote: Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count %Fail Count % WEIGHT10116362 96 169684 96 SNIFFER2114790 94 167322 95 WEIGHT15112700 93 165299 94 WEIGHT20108443 89 159758 91 WEIGHTDEL108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH 90727 99325 DSN 84847 137557 SORBS-HTTP 65845 124597 SORBS-SOCKS 65085 126977 SPFFAIL 49544 65273 BLITZEDALL 33502 59913 BASE64 22521 29561 MAILFROM 16841 28411 COMMENTS 13281 20561 MYFILTERFAIL 11590 17230 WAMO 58506090 MYFILTERPASS 5120 12390 SORBS-MISC 50409230 SORBS-SMTP 4450 11320 OBFUSCATION 36004570 ORDB 31606540 SORBS-WEB 31605140 SORBS-ZOMBIE 28002800 SPFPASS 20802340 BONDEDSENDER620 620 @LINKED100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count120934 175163 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Paul Fuhrmeister Sent: Monday, April 12, 2004 5:11 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Scott, what do you use to generate this report Thanks Scott, While I have your attention, what do you use to generate this report from your log files? Each month, we go through our spamtraps (E-mail addresses designed to collect spam), to find out which spam tests were most effective at catching spam. snip WEIGHT1099.48% WEIGHT2095.45% NOLEGITCONTENT 95.43% SNIFFER 94.06% SPAMCHK 93.20% IPNOTINMX 90.76% SPAMCOP 79.83% CMDSPACE77.37% snip [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
I dl'ed it and tried to analyze a file with it and I get an application exception. It looks like it is listing out all my tests prior to counting them (just numbers incrementing from 1 to * followed by testnames). It gets to number 55 and drops out every time. Here is the output it gives before it quits: --BEGIN OUTPUT- Y:\logs\spamlogswamlog dec0412.log 0 IPNOTINMX 1 NOLEGITCONTENT 2 IP-BLACKLIST 3 FILTER-MAILFROM 4 FILTER-SPAM-HTML 5 FILTER-BODY-GIBBERISH 6 FILTER-HEADER 7 SPAMCHK 8 IMAILHEADERS 9 SNIFFER 10 WEIGHT50 11 REVDNS 12 WORD-MASKING 13 FILTER-BODY-ANTIGIBBERISH 14 SPAMHEADERS 15 Y!DIRECTED 16 NOABUSE 17 NOPOSTMASTER 18 BADHEADERS 19 FREEEMAILS 20 ANTI-Y!DIRECTED 21 SPAMDOMAINS 22 HELOBOGUS 23 WEIGHT30S 24 WEIGHT30R 25 FILTER-SUBJECT 26 IPLINKED 27 LONGSUBJ 28 SUBJECTSPACES 29 FILTER-SUBJECT-GIBBERISH 30 SNIFFERSCAM 31 SNIFFERPORN 32 NONENGLISH 33 MYWHITELIST 34 [EMAIL PROTECTED] 35 KILLSENDER 36 DSN 37 ROUTING 38 FILTER-SUBJECT-ANTIGIBBERISH 39 BASE64 40 FILTER-REVDNS-BLACKLIST 41 MAILFROM 42 FILTER-HEADER-BLACKLIST 43 FILTER-REVDNS 44 COMMENTS 45 SNIFFERGREY 46 MAILINGLISTS 47 MYBLACKLIST 48 WEIGHT20R 49 OBFUSCATION 50 FILTER-HEADER-REMOTEIP 51 WEIGHT16-19S 52 WEIGHT16-19C 53 @LINKED 54 BONDEDSENDER 55 ADHEADERS -END OUTPUT- I notice that the last test is ADHEADERS which is not in our config, and may be a misspelling of BADHEADERS which is listed as number 18. I have attached my Global.cfg. The logfile that it was parsing was only 14 megs. Any ideas? Do I need to change something for it to work? I tried WAMLOG with the debug option, but it did the same thing. Dan Horne, CCNA Web Services Administrator TAIS Web Wilcox World Travel Tours [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. SPAM-FREE 1.0(2476) -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Bill Sent: Tuesday, April 13, 2004 3:34 PM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count %Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH90727 99325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL49544 65273 BLITZEDALL33502 59913 BASE6422521 29561 MAILFROM16841 28411 COMMENTS13281 20561 MYFILTERFAIL11590 17230 WAMO 58506090 MYFILTERPASS 5120 12390 SORBS-MISC 5040923
Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
- Original Message - From: Dan Horne [EMAIL PROTECTED] I have attached my Global.cfg. The logfile that it was parsing was only 14 megs. Any ideas? Do I need to change something for it to work? I tried WAMLOG with the debug option, but it did the same thing. You should really consider doing some editing/masking of your config file settings before sending it to a public list. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count %Fail Count % WEIGHT10116362 96 169684 96 SNIFFER2114790 94 167322 95 WEIGHT15112700 93 165299 94 WEIGHT20108443 89 159758 91 WEIGHTDEL108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH 90727 99325 DSN 84847 137557 SORBS-HTTP 65845 124597 SORBS-SOCKS 65085 126977 SPFFAIL 49544 65273 BLITZEDALL 33502 59913 BASE64 22521 29561 MAILFROM 16841 28411 COMMENTS 13281 20561 MYFILTERFAIL 11590 17230 WAMO 58506090 MYFILTERPASS 5120 12390 SORBS-MISC 50409230 SORBS-SMTP 4450 11320 OBFUSCATION 36004570 ORDB 31606540 SORBS-WEB 31605140 SORBS-ZOMBIE 28002800 SPFPASS 20802340 BONDEDSENDER620 620 @LINKED100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count120934 175163 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Paul Fuhrmeister Sent: Monday, April 12, 2004 5:11 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Scott, what do you use to generate this report Thanks Scott, While I have your attention, what do you use to generate this report from your log files? Each month, we go through our spamtraps (E-mail addresses designed to collect spam), to find out which spam tests were most effective at catching spam. snip WEIGHT1099.48% WEIGHT2095.45% NOLEGITCONTENT 95.43% SNIFFER 94.06% SPAMCHK 93.20% IPNOTINMX 90.76% SPAMCOP 79.83% CMDSPACE77.37% snip [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
