Today's log (following resetting PF_Use, SF_Use and Features_Use to 0 on Sunday):
SpamContent 84 LocalDeliver 2971 RemoteDeliver 22491 What would I find 84 of in the/which log to match against these? Any ideas what registry keys I might check? Heck, here they are: Global: REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Ipswitch\IMail\Global] "SpoolDir"="C:\\IMail\\spool" "TopDir"="C:\\IMail" "HostName"="mail.visioncomm.net" "DefHost"="localhost" "GateHost"="localhost" "ScanInstalled"=dword:00000000 "EnableScan"=dword:00000000 "ScanPort"=dword:00001e61 "ScanRepair"=dword:00000000 "PassFileByName"=dword:00000000 "Alert"=dword:00000000 "AlertRecip"=dword:00000000 "FailureAction"=dword:00000002 "ScanIp"="" "RedirAddress"="[EMAIL PROTECTED]" "AlertAddress"="[EMAIL PROTECTED]" "LogHost"="127.0.0.1" "CfgDir"="C:\\IMail\\cfg" "SendName"="C:\\IMail\\sac.exe" "UsersDir"="C:\\IMail\\users" "MultiFlag"=dword:00000001 "InstOptions"=dword:00000001 "Version"="8.15" "InstDate"="20040507-0719" "NameServer"="172.27.0.102 172.27.0.17" "TimeZone"="EST" "STARTSMTP"=dword:00000001 "KILLSMTP"=dword:00000001 "ASLoggingVerbose"=dword:00000000 "ASLoggingType"=dword:00000000 "OpenLDAPInstall"="C:\\IMail\\OpenLDAP" "OpenLDAPVersion"="2.1.22" "UserDatabase"=hex(2):43,3a,5c,49,4d,61,69,6c,5c,63,66,67,5c,55,73,65,72,73, 2e,\ 44,42,00 "AliasDatabase"=hex(2):43,3a,5c,49,4d,61,69,6c,5c,63,66,67,5c,41,6c,69,61,73 ,\ 65,73,2e,44,42,00 "AVType"=dword:00000000 "LastAVUpdate"="" "LastAVCheck"="" "AVDBPath"="plugins" "AVUpdate"="http://upgrade2.bitdefender.com/update7"; "CHOldSendName"="C:\\IMail\\smtp32.exe" IPd Host: REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Ipswitch\IMail\Domains\visioncomm.net] "Aliases"=dword:00000000 "EnableSSL"=dword:00000001 "ForceSSL"=dword:00000000 "IcalEnable"=dword:00000000 "SpellEnable"=dword:00000001 "SpellPort"=dword:000020c1 "NoOfSuggestions"=dword:00000004 "MaxTries"=dword:00000005 "MaxDisableDuration"=dword:00000384 "DelUserEntryDuration"=dword:00000e10 "NumTries"=dword:0000000e "TopDir"="C:\\IMail\\Visioncomm.net" "Flags"=dword:00000000 "NotifyAddress"="" "SubMailboxCreate"=dword:00000000 "NotifyPercent"=dword:00000000 "MaxOutboundSize"=dword:00000000 "VirusScan"=dword:00000001 "MaxSize"=dword:00000000 "MaxMsgs"=dword:00000000 "MaxRcv"=dword:00000000 "MaxUsers"=dword:00000000 "UserCount"=dword:0000001d "Address"="172.27.0.5" "MaxTimesSuspend"=dword:00000005 "ValidateFROM"=dword:00000000 "RevDNSAgent"=dword:00000000 "ValidateHELO"=dword:00000000 "BlkListAction"=dword:00000000 "BlkListCount"=dword:00000001 "SF_OnMatchAction"=dword:00000002 "SF_ForwardTo"="" "PF_OnMatchAction"=dword:00000002 "PF_ForwardTo"="" "CF_ForAuthUsers"=dword:00000000 "SF_NewWordProb"=dword:00000028 "SF_SpamEMailProb"=dword:0000005a "SF_NumberOfWordsToUse"=dword:0000000f "PF_Use"=dword:00000000 "SF_Use"=dword:00000000 "Features_Use"=dword:00000000 "Features_NestedTable"=dword:00000000 "Features_Hyperlink"=dword:00000000 "Features_ScriptTag"=dword:00000000 "Features_InvalidTag"=dword:00000000 "Features_ImageTag"=dword:00000000 "Features_DeceptiveURL"=dword:00000000 "Features_DeceptiveText"=dword:00000000 "Features_EmbeddedComment"=dword:00000000 "Features_MailtoHyperlink"=dword:00000000 "Features_NumberToFind"=dword:00000000 "Features_OnMatchAction"=dword:00000002 "Features_ForwardTo"="" "Features_ModifySubject"=dword:00000000 "Features_Subject"="X-IMail-SPAM-HTML-Features" "UrlDBL_Use"=dword:00000000 "UrlDBL_OnMatchAction"=dword:00000002 "UrlDBL_ForwardTo"="" "UrlDBL_ModifySubject"=dword:00000000 "UrlDBL_Subject"="X-IMail-SPAM-URL-DBL" "SF_ModifySubject"=dword:00000000 "SF_Subject"="X-IMail-SPAM-Statistical" "PF_Scan"=dword:00000002 "PF_Normalize"=dword:00000000 "PF_ModifySubject"=dword:00000000 "PF_Subject"="X-IMail-SPAM-Phrase" "Connection_ModifySubject"=dword:00000000 "Connection_Subject"="X-IMail-SPAM-Connection" "LDAP_BIND"="cn=root,o=visioncomm.net" "LDAP_PASS"="E3DDE4D5DABD" "LDAP_BASE"="o=visioncomm.net" "LDAP_USER_FOLDER"="ou=People" -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Sanford Whiteman Sent: Sunday, July 03, 2005 1:08 PM To: Dan Barker Subject: Re: [IMail Forum] IMail Daily Report for mail.visioncomm.net > Any ideas from where these numbers are coming, or why they just > started? They are almost certainly coming from actual lines in your logs, which means that the filters are probably firing, which in turn means that something is probably screwed up in your registry. Did this coincide with your fixing the multiple host aliases problem? --Sandy ------------------------------------ Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/relea se/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/downl oad/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/ release/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
