Ok, I have finally gotten around to modifying my filters to use some of the new features. It definitely is having an impact on my processor from what I can see. I think I have uncovered a bug or bugs though in terms of how thresholds are calculated and how it affects processing and logging.
I have a SPAMTRAPS filter with a SKIPIFWEIGHT set and a line which got hit as follows:
SKIPIFWEIGHT 30 ALLRECIPS 15 CONTAINS [EMAIL PROTECTED]
I delete messages at a score of 30, however I found the following message (headers) in my holding account which scored a 29, but didn't get any scoring from hitting my SPAMTRAPS filter with the above address:
X-MailPure: ============================================================ X-MailPure: SPAMCOP: Listed in bl.spamcop.net X-MailPure: FIVETEN-SPAMSUPPORT: Listed in blackholes.five-ten-sg.com X-MailPure: MAILPOLICE-BULK: Listed in bulk.rhs.mailpolice.com X-MailPure: MAILPOLICE-PORN: Listed in porn.rhs.mailpolice.com X-MailPure: NOLEGITCONTENT: No legitimate content detected. X-MailPure: RECIPIENTS: <[EMAIL PROTECTED]> X-MailPure: ============================================================ X-MailPure: Spam Score: 29 X-MailPure: Scan Time: 17:38:53 on 12/02/2003 X-MailPure: Spool File: D147103b1007e35c8.SMD X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: mail117.alukud.com [67.30.133.117] X-MailPure: ============================================================ X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: ============================================================
It seems that the order of adding points is a bit off from what I was expecting. The message should have been processed by the SPAMTRAPS filter (I believe it was), and then another 15 points should have been added which would have pushed it to 44 points and my deletion level. I searched my logs for this message to verify the results and found that there was no entry for this message in my Declude JunkMail log. Yes, really, no entry at all :) I did verify that my custom WARN action was configured for my SPAMTRAPS test and the combination of the positive and negative weighted tests indicated in the headers do equal a score of 29.
Feel free to ask for a zip of the supporting files if you need them.
Thanks,
Matt
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
