1. Makes sure that SNF is OFF in the \Diags.txt 2. These are my suggested values (please note that you path if copy/paste) also NONZERO weight can be 20 or 25. Also if you want to break out the NONZERO codes that is fine too.
SNIFFER external NONZERO "C:\Smartermail\Declude\SNF\SNFClient.exe" 20 0 SNIFFER-CAUTION external 020 "C:\Smartermail\Declude\SNF\SNFClient.exe" -10 0 SNIFFER-TRUNCATE external 040 "C:\Smartermail\Declude\SNF\SNFClient.exe" 10 0 David Barker Mail’s Best Friend Email : david.bar...@mailsbestfriend.com Web : www.mailsbestfriend.com <http://www.mailsbestfriend.com/> Office : 703.988.3605 x7015 Mobile : 978.518.6461 cid:image001.png@01CE2B2E.8B3E9EF0 From: Pete McNeil [mailto:madscient...@microneil.com] Sent: Wednesday, April 17, 2013 1:25 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] No one at Declude? On 2013-04-17 13:06, Katie La Salle-Lowery wrote: X-MessageSniffer-Scan-Result: 20 X-MessageSniffer-Rules: 20-0-0--1-f By the way: We have seen a LOT of this lately. For some reason there appear to be many Declude configurations out there that do not account for the truncate result code from SNF. I highly recommend that if you are using Declude, and especially if you have seen an increase in spam leakage, you should check your configuration and make sure that you weight result code 20 higher than other nonzero Message Sniffer result codes. On most systems that use SNF + Declude, not counting for the truncate result code can result in leaking more than 10% of spam/malware that would have been caught. Best, _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 twitter/codedweller --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
<<image001.png>>
