Correct format. It should show up at high level logs. Scott Fisher Director of IT Farm Progress Companies
>>> [EMAIL PROTECTED] 06/17/04 05:12PM >>> I seen this post below and wanted to implement the "TESTSFAILED" to exit out of one of my body filters based on if another test was already triggered. Is the below line correct (assuming REVERSEDNSFILTER is one of my filters that occurs before the filter I put the below line in)? TESTSFAILED END CONTAINS REVERSEDNSFILTER [2] When that line is matched does it show in the logs? Darrell ----------------------------------------------------- Check out http://www.invariantsystems.com for utilities for Declude and Imail. Scott Fisher writes: > I haven't found any easy way to tell. The information is in the logs at high level. > > But I can chime in that SKIPIFWEIGHT bypasses about 80% of my e-mail that is > obviously spam. TESTSFAILED ENDS for "friendly domains/revdns" drop off about 8% of > e-mail that is most likely not spam, leaving about 12% of the e-mail that I run body > filters on. > > > > Scott Fisher > Director of IT > Farm Progress Companies > >>>> [EMAIL PROTECTED] 06/17/04 12:03PM >>> > Matt- > > My body filters only catch about 4% of messages, but I don't know how often > they are run. Is htere a convenient way to tell? > > -d > > ----- Original Message ----- > From: "Matt" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Thursday, June 17, 2004 12:40 PM > Subject: Re: [Declude.JunkMail] Declude and attachments > > >> Scott, >> >> I've got a lot more BODY filters than Dave has, though I don't feel that >> they are excessive. I probably have about 1,500 BODY searches, but with >> SKIPIFWEIGHT they only run about 25% of the time. >> >> If Dave is using Declude Virus, I would also look there for the issue. >> Anything besides F-Prot and ClamAV in daemon mode will chug a server on >> a large attachment and it will use up far more processing than Declude >> JunkMail, but it will keep the Declude instance alive for longer. On >> about 65,000 messages a day currently, we generally see from 2 to 10 >> Declude processes running at one time with both F-Prot and AVG enabled >> (much less with just F-Prot). Disabling AVG results in our average >> processor utilization dropping by 1/3 to 1/2 on heavy load hours. >> >> Matt >> >> >> >> R. Scott Perry wrote: >> >> > >> >> One instance of Declude, then two, then three, all in the 25%+ range. > As >> >> soon as it dropped to two Decludes, Queue Manager came right in at >> >> 30-40%, >> >> then the cycles dropped as QueueManager dropped down. >> > >> > >> > It does sound like it is the large files that are causing the problem. >> > >> > One option would be to temporarily disable the BODY filter with the >> > 200 lines in it, to see if that prevents the problem with the high CPU >> > usage in Declude JunkMail. That could indeed be causing the problem. >> > >> > The other would be to use the debug mode ("LOGLEVEL DEBUG" in the >> > \IMail\Declude\global.cfg file) and waiting for one of these files to >> > be sent. We can look at the debug log file entries to get a better >> > idea of where the high CPU usage is occurring. >> > >> > -Scott >> > --- >> > Declude JunkMail: The advanced anti-spam solution for IMail >> > mailservers since 2000. >> > Declude Virus: Ultra reliable virus detection and the leader in >> > mailserver vulnerability detection. >> > Find out what you've been missing: Ask for a free 30-day evaluation. >> > >> > --- >> > [This E-mail was scanned for viruses by Declude Virus >> > (http://www.declude.com)] >> > >> > --- >> > This E-mail came from the Declude.JunkMail mailing list. To >> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> > type "unsubscribe Declude.JunkMail". The archives can be found >> > at http://www.mail-archive.com. >> > >> > >> >> -- >> ===================================================== >> MailPure custom filters for Declude JunkMail Pro. >> http://www.mailpure.com/software/ >> ===================================================== >> >> >> --- >> [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
