Re: [sniffer] Declude and Sniffer

2005-07-20 Thread System Administrator
on 7/20/05 11:06 AM, John Carter wrote: > I have seen and understand the various Core > Rule Group Result Codes, but am not sure how to separate those out for > evaluation. In your global.cfg add lines like the sniffer-scams line below test name - category ---

Re: [sniffer] Declude and Sniffer

2005-07-20 Thread System Administrator
on 7/20/05 9:44 AM, Jonathan Schoemann wrote: > Question: Do any of you tag subject lines based on Sniffer alone? My main > problem is that some of my users delete based on the tagged subject line. I weight each category in Sniffer differently. Some messages are deleted by Sniffer alone, some m

Re: [sniffer] why?

2004-12-21 Thread System Administrator
on 12/21/04 8:21 AM, Pete McNeil wrote: > The second possibility is that we've skipped the message for some > safety reason (trying to avoid false positives) though it seems > unlikely in this case. > > Once I see it I will be able to tell more. Would adding "direct to spam" in the subject make

[sniffer] why?

2004-12-21 Thread System Administrator
Pete, Our subscribers can forward spam they receive to our [EMAIL PROTECTED] address, which gets forwarded to you guys. Some spammers have been sending e-mail messages directly to the [EMAIL PROTECTED] address (cutting out the middle men I guess). One spammer, www. c a s i n o b a r .com, has sent

Re: [sniffer] My issues with the General category, looking forabettersolution

2004-12-17 Thread System Administrator
on 12/16/04 5:36 PM, Matt wrote: > The reason why you aren't seeing these is because you aren't weighting Sniffer > General at your subject tagging or hold weight, so it takes multiple hits for > the false positives to show up on your system. Wow, I didn't realize you knew so much about my system

Re: [sniffer] My issues with the General category, looking for abetter solution

2004-12-16 Thread System Administrator
on 12/15/04 11:41 PM, Matt wrote: > I've been having a lot of issues with false positives in the General category, > and I'm in search of a better way to handle such things after making little > progress without a large time commitment to the issue that this creates. Wow, I'm not seeing anything

Re: Re[6]: [sniffer] New Version 2-3.2 has been officiallyreleased.

2004-11-24 Thread System Administrator
on 11/24/04 12:19 PM, Colbeck, Andrew wrote: > p.s. More favourite acronyms: > > RGE (Resume Generating Event) > TLA (Three Letter Acronym) PEBKAC (problem exist between keyboard and chair) Greg This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription inst

Re: Re[2]: [sniffer] New Version 2-3.2 has been officiallyreleased.

2004-11-23 Thread System Administrator
on 11/23/04 12:22 PM, Landry William wrote: > No problems experienced here on either of our servers I installed it. No problems so far. Greg This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniff

Re: [sniffer] New Version 2-3.2 has been officially released.

2004-11-23 Thread System Administrator
on 11/23/04 6:08 AM, Bonno Bloksma wrote: > Just to let you know. We had a problem after updating to 2.3.2 this morning > where suddenly a lot of our internal mail got caught as spam by sniffer. Ive > allready sent a report to the support address. For whatever reason I could > net send to the fals

Re: [sniffer] Sniffer misses "NIGERIAN" type spams

2004-09-21 Thread System Administrator
on 9/19/04 11:08 AM, Pete McNeil wrote: > We have quite a few rules for these, however they are constantly > evolving. Up to now I've been very conservative with the rules that I > create for these types of messages because they deal directly with the > text and I want to avoid false positives. Th

Re: [sniffer] F-Prot and netsky

2004-02-24 Thread System Administrator
on 2/24/04 9:32 AM, Mike VandeBerg wrote: > I was wondering if anyone else is using F-prot for their virus engine in > declude, and what they now think about it. We use F-Prot and AVG on our mail servers. F-prot is usually very good but they were slow to stop a virus (can't remember which one) a