RE: [Declude.JunkMail] Weight and Action Question
Yep, a configuration of WEIGHT10 DELETE and a WEIGHT20 HOLD would indeed delete a message with a weight of 21. Something you mentioned earlier prompts me to point out another thing; the veterans in the list generally regard HOLD messages not as something they have to check out several times a day to manually sort, but rather as a convenient way to not bug the intended recipient while we are still able to retrieve and deliver the mail for that recipient in case of a false positive. The net result is that we're more likely to err by holding a message than to err by deleting it! For reviewing messages, SpamReview is very popular; I stopped using it a long time ago, though, due to the high volume I get (I delete very little). Also, the \imail\spool\spam folder will of course grow in time, so you'll want a handy utility that you can schedule to delete messages there that are older than whatever time you choose. See the Declude website, Tools page for links to these and other tools. Andrew 8) -Original Message- From: Goran Jovanovic [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 20, 2004 8:28 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Weight and Action Question Think of it this way -- if you used the HOLD action for E-mail with a weight of 5 or higher, and the DELETE action for E-mail with a weight of 10 or higher, which action would you want taken on an E-mail with a weight of 25? In your description I would want the DELETE taken. I was thinking of the whole thing is a different light. Specific test gets action taken first then aggregate tests like WEIGHT20 get taken in highest to lowest weight order. Then other things... To paraphrase you JunkMail looks through all the actions of all the tests that have been tripped starting with the most severe (strict) DELETE and working down the list. So if you did it wrong and setup WEIGHT10 DELETE and WEIGHT20 HOLD then all e-mail with a weight of 10 or higher would be deleted and none would be held. Right? OK you would have to be mostly asleep to set it up this way... Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
To paraphrase you JunkMail looks through all the actions of all the tests that have been tripped starting with the most severe (strict) DELETE and working down the list. That's another way of looking at it. In this case, if there is a conflict with an action that has already been taken, the one that has already been taken will have priority. So if you did it wrong and setup WEIGHT10 DELETE and WEIGHT20 HOLD then all e-mail with a weight of 10 or higher would be deleted and none would be held. Right? OK you would have to be mostly asleep to set it up this way... Correct. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight and Action Question
If you are trying out a new test and are not sure what it is going to do you set the WEIGHT of that test to 0 and then monitor it. One way would be to use a HOLD action on that test. My question is if the WEIGHT was not set to 0 but say 10 and the action is HOLD will the e-mail be held regardless of the total weight? Not necessarily (since there may be tests with negative weights). For example, by default, if an E-mail does not fail the NOLEGITCONTENT/IPNOTINMX tests, it will start with a weight below 0. Therefore, if an E-mail failed just the new test, the E-mail would not have a weight of 10 or higher. If that is true then why does it matter what the weight is set to? Because some people may, for example, use WEIGHT10 HOLD and WEIGHT20 DELETE. In this case, an E-mail that would have otherwise had a weight of 12 (and therefore held) would now have a weight of 22 (and be deleted). So in this case, the test would be live and running and doing its thing. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
Well, you might also have a WHITELIST action, or a WEIGHT action for a high value that does a DELETE. I guess what is important is to find out the precedence of the ACTION keywords. So if a WEIGHT10 is set with a DELETE action and the test that you are testing has a WEIGHT of 1 and the total score of the message is 25 then I would hope that regardless of the final weight the HOLD action on a specific test would take precedence. Instead, I would recommend using a weight of 1. A weight of zero, even if the test is triggered and an action taken, will make the test NOT show up in the list of tests triggered in your declude log file on the total weight= line (at LOGLEVEL MID, anyway). This makes sense and is a good point Thanx Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
I guess what is important is to find out the precedence of the ACTION keywords. In the case of multiple actions, Declude JunkMail will try to use both. But in combinations where they cannot logically be combined (such as HOLD and DELETE -- doing one means that you can't do the other), Declude JunkMail will use the stricter action (in the HOLD/DELETE case, DELETE is stricter). The actions are listed in the manual in the order of precedence (the ones towards the bottom are the stricter ones). So if a WEIGHT10 is set with a DELETE action and the test that you are testing has a WEIGHT of 1 and the total score of the message is 25 then I would hope that regardless of the final weight the HOLD action on a specific test would take precedence. No. If the total weight of the E-mail is 25, and you want to delete E-mail with a weight of 10 or higher, the E-mail will be deleted. Think of it this way -- if you used the HOLD action for E-mail with a weight of 5 or higher, and the DELETE action for E-mail with a weight of 10 or higher, which action would you want taken on an E-mail with a weight of 25? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
Think of it this way -- if you used the HOLD action for E-mail with a weight of 5 or higher, and the DELETE action for E-mail with a weight of 10 or higher, which action would you want taken on an E-mail with a weight of 25? In your description I would want the DELETE taken. I was thinking of the whole thing is a different light. Specific test gets action taken first then aggregate tests like WEIGHT20 get taken in highest to lowest weight order. Then other things... To paraphrase you JunkMail looks through all the actions of all the tests that have been tripped starting with the most severe (strict) DELETE and working down the list. So if you did it wrong and setup WEIGHT10 DELETE and WEIGHT20 HOLD then all e-mail with a weight of 10 or higher would be deleted and none would be held. Right? OK you would have to be mostly asleep to set it up this way... Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
