Here a third one - this one is even more drastic. Total weight is 22 - but it does NOT trigger WEIGHT10! I'll hold off sending any more samples - unless you need more:
OSRELAY:6 SPAMCOP:7 SPAMROUTING:4 REVDNS:5 . Total weight = 22 but only TWO "Msg Failed" logs - which add up to "9" - so WEIGHT10 is NOT triggered! Msg failed SPAMROUTING (This E-mail was routed in a poor manner consistent with spam [20000103].). Msg failed REVDNS (This E-mail was sent from a mail server [No Reverse DNS] with no reverse DNS entry.). Here the complete DEBUG LOG: 12/09/2001 15:59:20 CFG: Setting LOG_OK level to NONE 12/09/2001 15:59:20 CFG: Set hop to 0 and hophigh to 0. 12/09/2001 15:59:20 Console turned OFF 12/09/2001 15:59:20 CFG: Setting XINHEADER to X-Declude-Note: Processed by Declude %VERSION%; remote host %REVDNS%. 12/09/2001 15:59:20 CFG: Setting XOUTHEADER to X-Note: Report any abuse to [EMAIL PROTECTED] 12/09/2001 15:59:20 CFG: Bypassing IP 63.107.174.32. 12/09/2001 15:59:20 CFG: Setting XSENDER to ON 12/09/2001 15:59:20 CFG: Setting XSPOOLNAME to ON 12/09/2001 15:59:20 CFG: Whitelisting ANYWHERE [EMAIL PROTECTED] 12/09/2001 15:59:20 CFG: Whitelisting IP 63.107.174.. 12/09/2001 15:59:20 CFG: Whitelisting FROM hm-software.com. 12/09/2001 15:59:20 CFG: Whitelisting IP 128.192.1.101. 12/09/2001 15:59:20 CFG: Whitelisting IP 130.160.4.249. 12/09/2001 15:59:20 CFG: Whitelisting IP 199.232.158.102. 12/09/2001 15:59:20 CFG: Whitelisting FROM nytimes.com. 12/09/2001 15:59:20 CFG: Whitelisting IP 148.100.1.2. 12/09/2001 15:59:20 CFG: Whitelisting IP 64.65.65.2. 12/09/2001 15:59:20 CFG: Whitelisting FROM lists.cnn.com. 12/09/2001 15:59:20 CFG: Whitelisting FROM timeinc.com. 12/09/2001 15:59:20 CFG: Whitelisting FROM uni.de. 12/09/2001 15:59:20 CFG: Whitelisting IP 206.242.213.5. 12/09/2001 15:59:20 CFG: Whitelisting FROM stellenmarkt.de. 12/09/2001 15:59:20 Declude v1.29a 12/09/2001 15:59:20 Setting HOLD directory to: D:\IMAIL\spool\spam. 12/09/2001 15:59:20 Qd0a7170 Setting DNS server to IMail's 63.107.174.65. 12/09/2001 15:59:20 Qd0a7170 Declude JunkMail Standard Version Registered 12/09/2001 15:59:20 Qd0a7170 Start 12/09/2001 15:59:20 Qd0a7170 Locking D:\IMAIL\spool\Qd0a7170.SMD. 12/09/2001 15:59:20 Qd0a7170 D:\IMAIL\spool\Qd0a7170.SMD locked. 12/09/2001 15:59:20 Qd0a7170 Getting message envelope 12/09/2001 15:59:20 Qd0a7170 Starting locality check 12/09/2001 15:59:20 Qd0a7170 CL Opening HKEY_LOCAL_MACHINE\software\Ipswitch\IMail\Domains 12/09/2001 15:59:20 Qd0a7170 [EMAIL PROTECTED] [0] is local domain2 12/09/2001 15:59:20 Qd0a7170 Done getting message envelope 12/09/2001 15:59:20 Qd0a7170 Getting headers 12/09/2001 15:59:20 Qd0a7170 Mid-headers 12/09/2001 15:59:20 Qd0a7170 Done getting headers 12/09/2001 15:59:20 Qd0a7170 Done getting envelope and headers 12/09/2001 15:59:22 Qd0a7170 Ver=20 verflag=0 12/09/2001 15:59:22 Qd0a7170 About to run spam tests 12/09/2001 15:59:22 Qd0a7170 Going through datafile 12/09/2001 15:59:22 Qd0a7170 194.78.209.251] by hm-software.com with ESMTP (SMTPD32-7.04) id A0A77240170; Sun, 09 Dec 2001 15:59:19 -0500 12/09/2001 15:59:22 Qd0a7170 SPAMROUTING processing IPb 194.78.209.251] . 12/09/2001 15:59:22 Qd0a7170 Handling Received: header 12/09/2001 15:59:22 Qd0a7170 Setting remote IP address to 194.78.209.251 12/09/2001 15:59:22 Qd0a7170 251.209.78.194.in-addr.arpa 12/09/2001 15:59:22 Qd0a7170 Not found. 12/09/2001 15:59:22 Qd0a7170 Hop 0: Checking IP Address 194.78.209.251. 12/09/2001 15:59:22 Qd0a7170 251.209.78.194.bl.spamcop.net IS listed in OSRELAY. 12/09/2001 15:59:22 Qd0a7170 251.209.78.194.relays.osirusoft.com IS listed in ORDB. 12/09/2001 15:59:22 Qd0a7170 251.209.78.194.relays.ordb.org IS listed in SPAMCOP. 12/09/2001 15:59:22 Qd0a7170 251.209.78.194.bl.spamcop.net IS listed in SPAMCOPHDR. 12/09/2001 15:59:32 Qd0a7170 209.14.215.117]) by etuantnt4001.antwerpen.elsevier.be with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.1960.3) id YL9LR6W4; Sun, 9 Dec 2001 21:57:52 +0100 12/09/2001 15:59:32 Qd0a7170 SPAMROUTING processing IPa 209.14.215.117]). 12/09/2001 15:59:32 Qd0a7170 Handling Received: header 12/09/2001 15:59:32 Qd0a7170 Skipping received line (hop 1) 12/09/2001 15:59:32 Qd0a7170 Last line of headers: Content-Transfer-Encoding: quo 12/09/2001 15:59:32 Qd0a7170 TEST: 10 heur=0.003430 t[]domain=10 12/09/2001 15:59:32 Qd0a7170 TEST: 9 heur=0.003430 t[]domain=9 12/09/2001 15:59:32 Qd0a7170 TEST: 8 heur=0.003430 t[]domain=8 12/09/2001 15:59:32 Qd0a7170 TEST: 9 heur=0.003430 t[]domain= 12/09/2001 15:59:32 Qd0a7170 OSRELAY:6 SPAMCOP:7 SPAMROUTING:4 REVDNS:5 . Total weight = 22 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 3 [EMAIL PROTECTED] 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 2 63.107.174. 12/09/2001 15:59:32 Qd0a7170 IP 194.78.209.251 not in whitelist (63.107.174.) 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 1 hm-software.com 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 2 128.192.1.101 12/09/2001 15:59:32 Qd0a7170 IP 194.78.209.251 not in whitelist (128.192.1.101) 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 2 130.160.4.249 12/09/2001 15:59:32 Qd0a7170 IP 194.78.209.251 not in whitelist (130.160.4.249) 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 2 199.232.158.102 12/09/2001 15:59:32 Qd0a7170 IP 194.78.209.251 not in whitelist (199.232.158.102) 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 1 nytimes.com 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 2 148.100.1.2 12/09/2001 15:59:32 Qd0a7170 IP 194.78.209.251 not in whitelist (148.100.1.2) 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 2 64.65.65.2 12/09/2001 15:59:32 Qd0a7170 IP 194.78.209.251 not in whitelist (64.65.65.2) 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 1 lists.cnn.com 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 1 timeinc.com 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 1 uni.de 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 2 206.242.213.5 12/09/2001 15:59:32 Qd0a7170 IP 194.78.209.251 not in whitelist (206.242.213.5) 12/09/2001 15:59:32 Qd0a7170 Testing whitelist 1 stellenmarkt.de 12/09/2001 15:59:32 Qd0a7170 Looping... 12/09/2001 15:59:32 Qd0a7170 S<[EMAIL PROTECTED]> 12/09/2001 15:59:32 Qd0a7170 Looking up MX/A record for excite.com at 63.107.174.65. 12/09/2001 15:59:32 Qd0a7170 Done with MX/A record 12/09/2001 15:59:32 Qd0a7170 Opening HKEY_LOCAL_MACHINE\software\Ipswitch\IMail\Domains 12/09/2001 15:59:32 Qd0a7170 Domain name = gameware.com, User name = rgos. 12/09/2001 15:59:32 Qd0a7170 Using CFG file D:\IMAIL\Declude\$default$.junkmail. 12/09/2001 15:59:32 Qd0a7170 ...X.........XXX....XX....XX 12/09/2001 15:59:32 Qd0a7170 Test #3 [OSRELAY weight=6] triggered; action = 0 12/09/2001 15:59:32 Qd0a7170 Test #13 [ORDB weight=0] triggered; action = 0 12/09/2001 15:59:32 Qd0a7170 Test #14 [SPAMCOP weight=7] triggered; action = 0 12/09/2001 15:59:32 Qd0a7170 Test #15 [SPAMCOPHDR weight=0] triggered; action = 0 12/09/2001 15:59:32 Qd0a7170 Test #20 [SPAMROUTING weight=4] triggered; action = 4 12/09/2001 15:59:32 Qd0a7170 Msg failed SPAMROUTING (This E-mail was routed in a poor manner consistent with spam [20000103].). 12/09/2001 15:59:32 Qd0a7170 Test #21 [REVDNS weight=5] triggered; action = 4 12/09/2001 15:59:32 Qd0a7170 Msg failed REVDNS (This E-mail was sent from a mail server [No Reverse DNS] with no reverse DNS entry.). 12/09/2001 15:59:32 Qd0a7170 Test #26 [WEIGHT10 weight=10] triggered; action = 0 12/09/2001 15:59:32 Qd0a7170 Test #27 [WEIGHT8 weight=8] triggered; action = 0 12/09/2001 15:59:32 Qd0a7170 X-Declude-Note: Processed by Declude 1.29a; remote host [No Reverse DNS] 12/09/2001 15:59:32 Qd0a7170 AlterMessage 12/09/2001 15:59:32 Qd0a7170 Subject: FEED BIRDS NOT SQUIRRELS!! 12/09/2001 15:59:32 Qd0a7170 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 12/09/2001 15:59:32 Qd0a7170 Looping... 12/09/2001 15:59:32 Qd0a7170 Done Looping 12/09/2001 15:59:32 Qd0a7170 Final action=0. 12/09/2001 15:59:32 Qd0a7170 D:\IMAIL\spool\Qd0a7170.SMD 12/09/2001 15:59:32 Qd0a7170 Unlocked D:\IMAIL\spool\Qd0a7170.SMD. 12/09/2001 15:59:32 Qd0a7170 Passing to SMTP3: D:\IMAIL\SMTP32.EXE "D:\IMAIL\spool\Qd0a7170.SMD". 12/09/2001 15:59:32 Qd0a7170 Total Time: 1781ms -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Saturday, December 08, 2001 01:52 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude v1.29 beta - Arbitrary Logging, and Weighting IS broken! Importance: Low >sorry, but something IS wrong with the log and the weighting. No matter how >you twist and turn <G>. Fortunately, with 1.29 it finally is apparent, even >to the naked eye: OK -- I've gone through the issues and reports with 1.29, and it looks like there is only one outstanding issue (albeit a complex one): Something isn't working properly, that can cause failed tests not to get reported in the log, and also prevent the actions from running. If there are other issues that I've overlooked, please do let me know. I want to make sure that all the issues get addressed, but it looks like this is the only one left. If that's correct, would it be possible to turn on the debugging in Declude JunkMail (LOGLEVEL DEBUG) long enough to let one of these issues reproduce itself? I think that would be the optimal way to continue, as it seems that this is happening often enough that it wouldn't take too long to get one of these to reproduce. With the debug logs, it will be a lot easier to track down the problem, and nail it once and for all. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
