Hi
Around two months ago we installed a new server operating system and the latest
Declude release having the old log levels (we use them for diagnostics and user
based quarantine reports and management)
Declude 4.6.35 Diagnostics
Compilation Platform: IMail
JunkMail ON
EVA ON
(on the previous server we was on a much older version, that worked fine and
reliable for us)
At the first view all seems running fine but in this two months we had a dozen
of spam complaints from our end users. Looking at the message arrived to their
inbox we can see it at the frontend Alligate gateway logs. The message was
accepted and passed to the Imail/Declude spam filter level. From there it was
send immediately back to the Alligate queue but was completely ignored by
Declude. Not one single header added, not one single logfile line.
As said a dozen of complaints but hard to say how often this happens.
Yesterday we had a little phishing campaign. All with the same subject line and
mailfrom address. 1244 of them was detected and quarantined at Declude level
with 500-700% of our hold weight. So no problem.
But looking at Alligate level on this day for this messages there was 1296
accepted and passed to Declude.
So we had 52 messages (4%) slipping through without being checked against any
tests
This is strange because all other messages was parsed, processed and clearly
classified as Spam.
As yesterday's campaign was on a Holiday+Sunday it happened on a very low
server load. So this could not be the cause of the slip throughs...
Any ideas?
Markus
