If Declude could confirm the order of how/which tests are run, it would be nice to know.
As far as reading our "combo" filter of failed tests (%TESTSFAILED%), we can read/code that from our "combo" filter file (same file that declude is reading) and do our own tests failed combo (since Declude isn't doing this at the point our external program is called; as per our order in the Config file). But, we still need to know the country chain; of which is not passed to our external program... %COUNTRYCHAIN% passes a NULL value. Without knowing the country chain, this program will not work. Upon looking at our CONFIG file for Declude, we do not use any COUNTRY or COUNTRIES test (in the past I believe we did). Do you know if this needs to be in the default config file or is it internal to Declude? Thanks Scott for the thread. Erik -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Saturday, September 17, 2005 2:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I believe the order is: IP4R & RHSBL, Declude Internal, spamdomains, Extermal, Fromfile, IPFile, Filter Within the filters type the filters are run in the order listed in the global.cfg ----- Original Message ----- From: "Erik" <[EMAIL PROTECTED]> To: <Declude.JunkMail@declude.com> Sent: Saturday, September 17, 2005 2:05 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter >From our testing of our new external program, you are right. The >external program is being called before our combo filter is being triggered. And the %COUNTRYCHAIN% variable is blank. So this variable is probably being created after Declude is done processing all tests. Now, using %COUNTRY% or %COUNTRIES% returns [UNKNOWN VAR]. It would be nice if an external can be called AFTER all other tests; ordering by how it is in the config file. There is nothing in the manual about %COUNTRYCHAIN% or COUNTRY or COUNTRIES. The only mention of this is in the release notes posted; which was added in version 1.62 in November 2002. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 3:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. ----- Original Message ----- From: "Erik" <[EMAIL PROTECTED]> To: <Declude.JunkMail@declude.com> Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell ------------------------------------------------------------------------ Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: > I think this would do it in two filters: > filter 1: > SKIPIFWEIGHT 100 > TESTSFAILED END NOTCONTAINS MN-COMBO > COUNTRIES 100 NOTCONTAINS US > > filter 2: > SKIPIFWEIGHT 100 > TESTSFAILED END NOTCONTAINS MN-COMBO > TESTSFAILED END CONTAINS filter1 > COUNTRIES END STARTSWITH US > COUNTRIES 100 CONTAINS US > > I'd be careful. Lots of US subsidaries are owned by a foreign company > and have their mail server overseas. Also watch out for these special > country codes: (which can belong to valid > servers): > # > # Special Codes > # > *1 Multi-Regional > *2 Europe > *3 North America > *4 Central/South America > *5 Pacific Rim > *A ARIN Unlisted (North America/South Africa) > *B Public Data Network > *E RIPE Unlisted (Europe, North Africa, Middle East) > *I Private IP > *L Loopback > *M Multicast > *P APNIC Unlisted (Asia Pacific) > *R IANA Reserved > *U Unknown > > > ----- Original Message ----- From: "Erik" <[EMAIL PROTECTED]> > To: <Declude.JunkMail@declude.com> > Sent: Friday, September 16, 2005 12:45 PM > Subject: [Declude.JunkMail] Help in creating a Filter > > >> Could someone help me in creating a filter? >> >> I need something to this effect. Can this be done in one filter? >> >> >> >> If WEIGHT = 100 or Higher then END >> >> If TESTFAILED CONTAINS "MN-COMBO" Then >> If CountryChain NOTCONTAINS "UNITED STATES" Then >> Then DELETE (triggers the filter - return 100 as weight) >> End If >> >> If CountryChain CONTAINS "UNITED STATES->destination" Then >> 'Email is probably good (return zero) >> Else >> DELETE (triggers the filter - return 100 as weight) >> End If >> >> End If >> >> Thanks! >> Erik >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type >> "unsubscribe Declude.JunkMail". The archives can be found at >> http://www.mail-archive.com. >> >> > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
