1.       Makes sure that SNF is OFF in the \Diags.txt

2.       These are my suggested values (please note that you path if 
copy/paste) also NONZERO weight can be 20 or 25.  Also if you want to break out 
the NONZERO codes that is fine too.



SNIFFER                               external              NONZERO           
"C:\Smartermail\Declude\SNF\SNFClient.exe"                 20          0

SNIFFER-CAUTION          external               020                        
"C:\Smartermail\Declude\SNF\SNFClient.exe"                 -10          0

SNIFFER-TRUNCATE        external              040                         
"C:\Smartermail\Declude\SNF\SNFClient.exe"                 10          0

David Barker
Mail’s Best Friend

Email     : david.bar...@mailsbestfriend.com
Web      : www.mailsbestfriend.com <http://www.mailsbestfriend.com/>
Office    : 703.988.3605 x7015
Mobile  : 978.518.6461

cid:image001.png@01CE2B2E.8B3E9EF0









From: Pete McNeil [mailto:madscient...@microneil.com]
Sent: Wednesday, April 17, 2013 1:25 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] No one at Declude?



On 2013-04-17 13:06, Katie La Salle-Lowery wrote:

X-MessageSniffer-Scan-Result: 20

X-MessageSniffer-Rules:

                20-0-0--1-f

By the way:

We have seen a LOT of this lately.

For some reason there appear to be many Declude configurations out there that 
do not account for the truncate result code from SNF.

I highly recommend that if you are using Declude, and especially if you have 
seen an increase in spam leakage, you should check your configuration and make 
sure that you weight result code 20 higher than other nonzero Message Sniffer 
result codes.

On most systems that use SNF + Declude, not counting for the truncate result 
code can result in leaking more than 10% of spam/malware that would have been 
caught.

Best,

_M




--
Pete McNeil, President
MicroNeil Research Corporation
www.microneil.com
703.779.4909 x7010
twitter/codedweller




--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

<<image001.png>>

Reply via email to