RE: [Declude.JunkMail] Reporting of Tests Failed Incomplete?
Hi Dave, Thanks - I don't want to upset your development schedule (naturally, I can cope with things as they are) - just wanted to make sure it's on someone else list . Best Regards, Andy From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Monday, May 03, 2010 1:19 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Reporting of Tests Failed Incomplete? I will check with engineering. If this is an easy change I will get it in an interim soon, also with the "nonzero" for SNF as we discussed in an earlier thread. From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy Schmidt Sent: Monday, May 03, 2010 1:10 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Reporting of Tests Failed Incomplete? Hi Dave, I agree with you that the total weight of 9 is correct (I had already "piecemealed" that arithmetic together in my msg). >> As Commtouch Zerohour was implemented differently that regular tests (because it runs as part of the AV code) it is not listed in this log line. Agreed it should be << Good - because, if your programmer was able to add "ZeroHour" to the "Tests Failed" line, and also to the "SMTP Headers" variable, in the various sections of the program flow - then I'd say it was merely an oversight that it was omitted from the ONE log line that "should be the complete list of tests used in calculating the score", as you already confirmed. >> I believe this is the list of "non-zero" tests you are looking for with the exception of Commtouch ZEROHOUR. << Right - so all we need is to get the missing ZEROHOUR included, so that it truly IS a list of non-zero tests. Thanks for checking into this. Best Regards, Andy From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Monday, May 03, 2010 12:10 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Reporting of Tests Failed Incomplete? The Tests failed (Triggered) showing tests that ARE triggered. In this case: Tests failed [weight=9]: SPFPASS=IGNORE[-2] CONTENT=IGNORE[7] ZEROHOUR=WEIGHT[6] Total: 11 As nIPNOTINMX:-2 is NOT triggered it cannot be in the same list of emails that ARE triggered, providing the -2 to the final equation we have a correct Total of. Total: 9 As Commtouch Zerohour was implemented differently that regular tests (because it runs as part of the AV code) it is not listed in this log line. Agreed it should be, but this line should be the complete list of tests used in calculating the score. I believe this is the list of "non-zero" tests you are looking for with the exception of Commtouch ZEROHOUR. q4d2f8f571d69.smd nIPNOTINMX:-2 SPFPASS:-2 CONTENT:7 . Total weight = 9. nIPNOTINMX:-2 SPFPASS:-2 CONTENT:7 Total: 3 ZEROHOUR=6 Total: 9 David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax <mailto:dbar...@declude.com> dbar...@declude.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Reporting of Tests Failed Incomplete?
I will check with engineering. If this is an easy change I will get it in an interim soon, also with the "nonzero" for SNF as we discussed in an earlier thread. From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy Schmidt Sent: Monday, May 03, 2010 1:10 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Reporting of Tests Failed Incomplete? Hi Dave, I agree with you that the total weight of 9 is correct (I had already "piecemealed" that arithmetic together in my msg). >> As Commtouch Zerohour was implemented differently that regular tests (because it runs as part of the AV code) it is not listed in this log line. Agreed it should be << Good - because, if your programmer was able to add "ZeroHour" to the "Tests Failed" line, and also to the "SMTP Headers" variable, in the various sections of the program flow - then I'd say it was merely an oversight that it was omitted from the ONE log line that "should be the complete list of tests used in calculating the score", as you already confirmed. >> I believe this is the list of "non-zero" tests you are looking for with the exception of Commtouch ZEROHOUR. << Right - so all we need is to get the missing ZEROHOUR included, so that it truly IS a list of non-zero tests. Thanks for checking into this. Best Regards, Andy From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Monday, May 03, 2010 12:10 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Reporting of Tests Failed Incomplete? The Tests failed (Triggered) showing tests that ARE triggered. In this case: Tests failed [weight=9]: SPFPASS=IGNORE[-2] CONTENT=IGNORE[7] ZEROHOUR=WEIGHT[6] Total: 11 As nIPNOTINMX:-2 is NOT triggered it cannot be in the same list of emails that ARE triggered, providing the -2 to the final equation we have a correct Total of. Total: 9 As Commtouch Zerohour was implemented differently that regular tests (because it runs as part of the AV code) it is not listed in this log line. Agreed it should be, but this line should be the complete list of tests used in calculating the score. I believe this is the list of "non-zero" tests you are looking for with the exception of Commtouch ZEROHOUR. q4d2f8f571d69.smd nIPNOTINMX:-2 SPFPASS:-2 CONTENT:7 . Total weight = 9. nIPNOTINMX:-2 SPFPASS:-2 CONTENT:7 Total: 3 ZEROHOUR=6 Total: 9 David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax <mailto:dbar...@declude.com> dbar...@declude.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Reporting of Tests Failed Incomplete?
Hi Dave, I agree with you that the total weight of 9 is correct (I had already "piecemealed" that arithmetic together in my msg). >> As Commtouch Zerohour was implemented differently that regular tests (because it runs as part of the AV code) it is not listed in this log line. Agreed it should be << Good - because, if your programmer was able to add "ZeroHour" to the "Tests Failed" line, and also to the "SMTP Headers" variable, in the various sections of the program flow - then I'd say it was merely an oversight that it was omitted from the ONE log line that "should be the complete list of tests used in calculating the score", as you already confirmed. >> I believe this is the list of "non-zero" tests you are looking for with the exception of Commtouch ZEROHOUR. << Right - so all we need is to get the missing ZEROHOUR included, so that it truly IS a list of non-zero tests. Thanks for checking into this. Best Regards, Andy From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Monday, May 03, 2010 12:10 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Reporting of Tests Failed Incomplete? The Tests failed (Triggered) showing tests that ARE triggered. In this case: Tests failed [weight=9]: SPFPASS=IGNORE[-2] CONTENT=IGNORE[7] ZEROHOUR=WEIGHT[6] Total: 11 As nIPNOTINMX:-2 is NOT triggered it cannot be in the same list of emails that ARE triggered, providing the -2 to the final equation we have a correct Total of. Total: 9 As Commtouch Zerohour was implemented differently that regular tests (because it runs as part of the AV code) it is not listed in this log line. Agreed it should be, but this line should be the complete list of tests used in calculating the score. I believe this is the list of "non-zero" tests you are looking for with the exception of Commtouch ZEROHOUR. q4d2f8f571d69.smd nIPNOTINMX:-2 SPFPASS:-2 CONTENT:7 . Total weight = 9. nIPNOTINMX:-2 SPFPASS:-2 CONTENT:7 Total: 3 ZEROHOUR=6 Total: 9 David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax <mailto:dbar...@declude.com> dbar...@declude.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Reporting of Tests Failed Incomplete?
The Tests failed (Triggered) showing tests that ARE triggered. In this case: Tests failed [weight=9]: SPFPASS=IGNORE[-2] CONTENT=IGNORE[7] ZEROHOUR=WEIGHT[6] Total: 11 As nIPNOTINMX:-2 is NOT triggered it cannot be in the same list of emails that ARE triggered, providing the -2 to the final equation we have a correct Total of. Total: 9 As Commtouch Zerohour was implemented differently that regular tests (because it runs as part of the AV code) it is not listed in this log line. Agreed it should be, but this line should be the complete list of tests used in calculating the score. I believe this is the list of "non-zero" tests you are looking for with the exception of Commtouch ZEROHOUR. q4d2f8f571d69.smd nIPNOTINMX:-2 SPFPASS:-2 CONTENT:7 . Total weight = 9. nIPNOTINMX:-2 SPFPASS:-2 CONTENT:7 Total: 3 ZEROHOUR=6 Total: 9 David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax <mailto:dbar...@declude.com> dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy Schmidt Sent: Monday, May 03, 2010 11:43 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Reporting of Tests Failed Incomplete? Hi Dave, I do have SOME tests suppressed from the SMTP headers: HIDETESTS CATCHALLMAILS IPNOTINMX NOLEGITCONTENT WEIGHTKILL2 WEIGHT8 WEIGHT10 WEIGHTHDR WEIGHTFOOTER NJABL AHBL SORBS SENDERDB WEIGHTGATEWAY So the SMTP header looks correct - and the weight of 9 is accurate: X-Declude-RefID: str=0001.0A020203.4BDEB008.02BD,ss=3,sh,fgs=0 X-Declude: Version 4.10.48; Code 0xe from www.mailglobal.net [64.27.0.60] X-Declude: Triggered [9] SPFPASS, SNIFFER-GENERAL, ZEROHOUR [6] X-IMail-ThreadID: 4d2f8f571d69 However, in the log file, there is not ONE line that actually adds up to the total weight of 9 (in this case: [Content] 7 + [ZeroHour] 6 = 13; minus [IpNotInmx] 2 minus [SPFpass] 2 = [total] 9 One log line misses the "ZeroHour" test, the other misses the IpNotInMx. I think ONE of these two lines should be implemented in a way so that it lists everything that is "non-zero" so that a user can easily see HOW the total weight was derived - otherwise, what's the point of logging any tests. q4d2f8f571d69.smd nIPNOTINMX:-2 SPFPASS:-2 CONTENT:7 . Total weight = 9. q4d2f8f571d69.smd NOT bypassing whitelisting of E-mail with weight >=19 (9) and at least 1 recipients (1). q4d2f8f571d69.smd NOT bypassing whitelisting of E-mail with weight >=14 (9) and at least 4 recipients (1). q4d2f8f571d69.smd NOT bypassing whitelisting of E-mail with weight >=12 (9) and at least 6 recipients (1). q4d2f8f571d69.smd Did not find [ smartcouponsa...@tillcrashing.com ] in [ andy_schm...@hm-software.com ] address book q4d2f8f571d69.smd Finish Address Book WhiteList q4d2f8f571d69.smd Tests failed [weight=9]: NOLEGITCONTENT=IGNORE[0] SPFPASS=IGNORE[-2] SNIFFER-GENERAL=IGNORE[0] CONTENT=IGNORE[7] WEIGHT8=SUBJECT[8] ZEROHOUR=WEIGHT[6] q4d2f8f571d69.smd L1 Message OK q4d2f8f571d69.smd Subject: May 2010 local coupon deals. q4d2f8f571d69.smd From: smartcouponsa...@tillcrashing.com To: andy_schm...@hm-software.com IP: 64.27.0.60 ID: q4d2f8f571d69.smd Action(s) taken for [andy_schm...@hm-software.com] = IGNORE SUBJECT [LAST ACTION=SUBJECT] q4d2f8f571d69.smd Cumulative action(s) on this email = IGNORE SUBJECT [LAST ACTION=SUBJECT] Best Regards, Andy --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Reporting of Tests Failed Incomplete?
Hi Dave, I do have SOME tests suppressed from the SMTP headers: HIDETESTS CATCHALLMAILS IPNOTINMX NOLEGITCONTENT WEIGHTKILL2 WEIGHT8 WEIGHT10 WEIGHTHDR WEIGHTFOOTER NJABL AHBL SORBS SENDERDB WEIGHTGATEWAY So the SMTP header looks correct - and the weight of 9 is accurate: X-Declude-RefID: str=0001.0A020203.4BDEB008.02BD,ss=3,sh,fgs=0 X-Declude: Version 4.10.48; Code 0xe from www.mailglobal.net [64.27.0.60] X-Declude: Triggered [9] SPFPASS, SNIFFER-GENERAL, ZEROHOUR [6] X-IMail-ThreadID: 4d2f8f571d69 However, in the log file, there is not ONE line that actually adds up to the total weight of 9 (in this case: [Content] 7 + [ZeroHour] 6 = 13; minus [IpNotInmx] 2 minus [SPFpass] 2 = [total] 9 One log line misses the "ZeroHour" test, the other misses the IpNotInMx. I think ONE of these two lines should be implemented in a way so that it lists everything that is "non-zero" so that a user can easily see HOW the total weight was derived - otherwise, what's the point of logging any tests. q4d2f8f571d69.smd nIPNOTINMX:-2 SPFPASS:-2 CONTENT:7 . Total weight = 9. q4d2f8f571d69.smd NOT bypassing whitelisting of E-mail with weight >=19 (9) and at least 1 recipients (1). q4d2f8f571d69.smd NOT bypassing whitelisting of E-mail with weight >=14 (9) and at least 4 recipients (1). q4d2f8f571d69.smd NOT bypassing whitelisting of E-mail with weight >=12 (9) and at least 6 recipients (1). q4d2f8f571d69.smd Did not find [ smartcouponsa...@tillcrashing.com ] in [ andy_schm...@hm-software.com ] address book q4d2f8f571d69.smd Finish Address Book WhiteList q4d2f8f571d69.smd Tests failed [weight=9]: NOLEGITCONTENT=IGNORE[0] SPFPASS=IGNORE[-2] SNIFFER-GENERAL=IGNORE[0] CONTENT=IGNORE[7] WEIGHT8=SUBJECT[8] ZEROHOUR=WEIGHT[6] q4d2f8f571d69.smd L1 Message OK q4d2f8f571d69.smd Subject: May 2010 local coupon deals. q4d2f8f571d69.smd From: smartcouponsa...@tillcrashing.com To: andy_schm...@hm-software.com IP: 64.27.0.60 ID: q4d2f8f571d69.smd Action(s) taken for [andy_schm...@hm-software.com] = IGNORE SUBJECT [LAST ACTION=SUBJECT] q4d2f8f571d69.smd Cumulative action(s) on this email = IGNORE SUBJECT [LAST ACTION=SUBJECT] Best Regards, Andy --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
