Mark
At 02:27 PM 1/28/2003, you wrote:
Mark, I will put together an information sheet together, as I have even changed it a bit since I wrote the one up before that Brian is using.
Give me a day or so.
John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
211 E. Imperial Hwy, Suite 106
Fullerton, CA 92835
562-694-4800, ext. 104
[EMAIL PROTECTED]
www.reliancesoft.com
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mark Seagroves
Sent: Tuesday, January 28, 2003 1:35 PM
To: [EMAIL PROTECTED]
Subject: RE: [NoXMail] filtering working intermittently?
John,
Are you referring to the Declude global.cfg settings? If so, I've never been clear on how these work. Any light you could shed on this would be appreciated (specifically the interaction between declude and noxmail).
Thanks.
Mark
At 12:26 PM 1/28/2003, you wrote:
Mark, I would recommend changing from using 2 weight tests to using a combination of weightrange and weight.
WEIGHTRANGE10-19 WEIGHTRANGE X X 10 19
WEIGHTRANGE20-29 WEIGHTRANGE X X 20 29
WEIGHT30 WEIGHT X X 30 0
Having Weight10 and Weight20 and so forth could cause action problems.
Not sure if this would cause this, just something I noticed.
John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA 92835
www.reliancesoft.com
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mark Seagroves
Sent: Tuesday, January 28, 2003 12:09 PM
To: [EMAIL PROTECTED]
Subject: [NoXMail] filtering working intermittently?
Brian,
Since last Thurs or so, noxmail seems to be allowing some adult & spam e-mails to go through. I received a couple of calls from users on Friday that they had received some porn e-mails. I double-checked all settings on Sat and finally stopped/restarted the IMail SMTP service. This seemed to fix the problem for the moment. However, yesterday I saw some more adult/spam messages slip through and I rebooted our e-mail server, again after checking everything first. That seemed to cause the filtering to work properly again. This morning, I thought I saw some more e-mails slip through but I sent myself a couple (one "adult" and one "spam") from an off-campus address and they were filtered correctly. I currently have all adult & spam e-mail sent to a spam account. This account is getting messages but some are apparently still slipping through. I just received a spam e-mail from e-bay. Below are the spam e-mail header and log snippet from noxmail. I can send you the .nox config file or other files if needed. I currently have ROUTEADULTSCORE and ROUTESPAMCORE set to 30 to the e-bay message should have been routed. The spam mailbox did catch this same e-mail to 7 other recipients (however, the total weight was 40 instead of 45).
Any suggestions?
Thanks.
Mark
NOXMAIL log snippet:
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD (OUT) [FAILED SPAM] Scores - Adult: 0 (Req: 18) Spam: 45 (Req: 18) ExitCode: 45 (Req: 20)
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG TO: <[EMAIL PROTECTED]>
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - ENV TO: <[EMAIL PROTECTED]>
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG FROM: <[EMAIL PROTECTED]>
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG SUBJECT: Don't spend a fortune, mseagroves!
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Excessive Routing: 3 penalty points added.
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Return address consistent with SPAM: 1 penalty points added.
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Subject contains variables: 5 penalty points added.
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Found 53 embedded image links: 14 penalty points added.
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg obfuscation: 12 penalty points added.
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Matched: (#Spam)MARKETING(2*2) (Spam){UNSUBSCRIBE&SUBJECT}(1*6)
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg processed in: 429ms - Msg Size: 19300 bytes
Mail Header:
To: [EMAIL PROTECTED]
Subject: [S] Don't spend a fortune, mseagroves!
From: "eBay" <[EMAIL PROTECTED]>
Date: Tue, 28 Jan 2003 11:29:04 -0800
Reply-To: "eBay" <[EMAIL PROTECTED]>
X-CYBERsitter-NoXMail: FAILED - Score Adult: 0 (Req: 18) Spam: 45 (Req: 18) Tot: 45 (Req: 20)
X-CYBERsitter-SpoolFile: Dda50019700ce4425.SMD
X-CYBERsitter-Sender: [EMAIL PROTECTED] [10.1.1.10]
X-RBL-Warning: HELOBOGUS: Domain CNCFWblue.cn.edu has no MX or A records.
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [4000020e].
X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the limit of 10.
X-RBL-Warning: WEIGHT20: Weight of 21 reaches or exceeds the limit of 20.
X-Declude-Sender: [EMAIL PROTECTED] [10.1.1.10]
X-Declude-Spoolname: Dda50019700ce4425.SMD
X-Note: This E-mail was scanned for spam.
X-Spam-Tests-Failed: HELOBOGUS, IPNOTINMX, SPAMHEADERS, WEIGHT10, WEIGHT20, CYBERSITTER
X-Note: This E-mail was sent from (Private IP) ([10.1.1.10]).
X-RCPT-TO: <[EMAIL PROTECTED]>
Mark Seagrovesvoice: (865) 471-3506
Dir, Campus Computingfax: (865) 471-3555
Asst Prof, Computer Sciencee-mail: [EMAIL PROTECTED]
Carson-Newman College
Mark Seagrovesvoice: (865) 471-3506
Dir, Campus Computingfax: (865) 471-3555
Asst Prof, Computer Sciencee-mail: [EMAIL PROTECTED]
Carson-Newman College
Mark Seagroves
Dir, Campus Computing
Asst Prof, Computer Science
Carson-Newman College
