date:20080208

RE: [Declude.JunkMail] How can I filter this...?

2008-02-08 Thread Chuck Schick

David:

Thanks.  I will try that.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, February 08, 2008 5:18 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

Try these couple of lines in a Filter.


HEADERS 5   PCRE
(?im:From:.*(?i:v.{0,2}[|li1í!].{0,2}[a@/\\].{0,2}[gq].{0,2}r.{0,2}[a@/\\]).
*@)
HEADERS 5   PCRE(?im:From:.*
(?i:(v{1,}i{1,}a{1,}g{1,}r{1,}a{1,}).*@))

Let us know how it works.

David B


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Friday, February 08, 2008 7:11 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

That may be but since I have a client that is seeing about 20 of these a day
all spelled the same he thinks I should be able to block it.

I want to know how to filter on the From line.  

I never asked how many ways to spell the word.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Friday, February 08, 2008 4:15 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] How can I filter this...?

There are 1,300,925,111,156,286,160,896 ways to spell Viagra (see the update
at the bottom).

http://cockeyed.com/lessons/viagra/viagra.html

Going after the word is not the way to target the spam.

Matt



Chuck Schick wrote:
> Here is the From line.
>
>  From: "viagra" <[EMAIL PROTECTED]>
>
> The X-declude Sender line is:
>
> X-Declude-Sender: [EMAIL PROTECTED] [190.172.162.107]
>
> Sorry, I was not clearer.
>
> We are getting tons of these with varying spellings of the viagra and 
> the email address is always different.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> David Barker
> Sent: Friday, February 08, 2008 1:56 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> How so, can you show the X-Declude-Sender line that it did not work on ?
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> Chuck Schick
> Sent: Friday, February 08, 2008 3:50 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> David:
>
> The first one does not work.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> David Barker
> Sent: Wednesday, February 06, 2008 12:25 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> Chuck you have several options:
>
>
> MAILFROM  5   STARTSWITH  Viagra
> MAILFROM  5   CONTAINSViagra
> MAILFROM  5   PCRE (?i:.*viagra.*@)
>
>
> David Barker
> VP Operations Declude
> Your Email security is our business
> 978.499.2933 x 7007 office
> 978.988.1311 fax
> [EMAIL PROTECTED]
>
>  
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> Chuck Schick
> Sent: Wednesday, February 06, 2008 2:17 PM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] How can I filter this...?
>
> Spam email is sent and the from line is
>
> "vigara" <[EMAIL PROTECTED]>
>
> Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender 
> name of "vigara".  Seems like it should be simple but it is eluding me.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>   



---
This E-mail came from

RE: [Declude.JunkMail] How can I filter this...?

2008-02-08 Thread David Barker

Try these couple of lines in a Filter.


HEADERS 5   PCRE
(?im:From:.*(?i:v.{0,2}[|li1í!].{0,2}[a@/\\].{0,2}[gq].{0,2}r.{0,2}[a@/\\]).
*@)
HEADERS 5   PCRE(?im:From:.*
(?i:(v{1,}i{1,}a{1,}g{1,}r{1,}a{1,}).*@))

Let us know how it works.

David B


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Friday, February 08, 2008 7:11 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

That may be but since I have a client that is seeing about 20 of these a day
all spelled the same he thinks I should be able to block it.

I want to know how to filter on the From line.  

I never asked how many ways to spell the word.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Friday, February 08, 2008 4:15 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] How can I filter this...?

There are 1,300,925,111,156,286,160,896 ways to spell Viagra (see the update
at the bottom).

http://cockeyed.com/lessons/viagra/viagra.html

Going after the word is not the way to target the spam.

Matt



Chuck Schick wrote:
> Here is the From line.
>
>  From: "viagra" <[EMAIL PROTECTED]>
>
> The X-declude Sender line is:
>
> X-Declude-Sender: [EMAIL PROTECTED] [190.172.162.107]
>
> Sorry, I was not clearer.
>
> We are getting tons of these with varying spellings of the viagra and 
> the email address is always different.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> David Barker
> Sent: Friday, February 08, 2008 1:56 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> How so, can you show the X-Declude-Sender line that it did not work on ?
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> Chuck Schick
> Sent: Friday, February 08, 2008 3:50 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> David:
>
> The first one does not work.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> David Barker
> Sent: Wednesday, February 06, 2008 12:25 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> Chuck you have several options:
>
>
> MAILFROM  5   STARTSWITH  Viagra
> MAILFROM  5   CONTAINSViagra
> MAILFROM  5   PCRE (?i:.*viagra.*@)
>
>
> David Barker
> VP Operations Declude
> Your Email security is our business
> 978.499.2933 x 7007 office
> 978.988.1311 fax
> [EMAIL PROTECTED]
>
>  
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> Chuck Schick
> Sent: Wednesday, February 06, 2008 2:17 PM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] How can I filter this...?
>
> Spam email is sent and the from line is
>
> "vigara" <[EMAIL PROTECTED]>
>
> Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender 
> name of "vigara".  Seems like it should be simple but it is eluding me.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>   



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type

RE: [Declude.JunkMail] How can I filter this...?

2008-02-08 Thread David Barker

Yes you are correct. Sorry that I did not mention that the real MAILFROM
line is from the envelope and not the D file From: which can easily be
forged this is why the MAILFROM always checks the Declude-Sender Line:

Chuck had asked to match Viagra if he had asked Viagra and variations then I
would have given a different response. In which case:

MAILFROM5   PCRE
(?i:.*(?i:v.{0,2}[|li1í!].{0,2}[a@/\\].{0,2}[gq].{0,2}r.{0,2}[a@/\\]).*@)

Agreed Matt, it will not catch every variation but it will catch quite a
few.

The disadvantage of using this in the MAILFROM is that email addresses do
have invalid words and names that may match the expression.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck,
Andrew
Sent: Friday, February 08, 2008 5:06 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

(another country heard from)

David... Chuck... the MAILFROM is going to filter based on the
server-side conversation (i.e. for IMail users, it will be the value
from the Q*.smd file, not any text in the D*.smd file).

The example that Chuck gave is going to be the From: line in the message
header, which is not the same.

Also, "vigara" is not equal to "viagra" so Dave's first example PCRE
filter doesn't match the text that Chuck supplied.

So that would be two reasons why it didn't work.


Andrew.



> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of David Barker
> Sent: Friday, February 08, 2008 1:40 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
> 
> 
> This is what Chuck requested.
> 
> "Now the declude sender is [EMAIL PROTECTED] but I want to filter 
> the sender name
> of "vigara". " 
> 
> If you show me what you trying to do in the headers perhaps I 
> can help ?
> 
> David B
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of John
> Shacklett
> Sent: Friday, February 08, 2008 4:36 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
> 
> Isn't the mailfrom in this case [EMAIL PROTECTED] and not the 
> vigara part? Chuck
> is looking for a way to filter based on the "name" attached 
> to the address
> and not the specific address proper, isn't that right Chuck? 
> 
> I'm butting in here because I'm trying to capture something 
> similar using
> the same logic, and using a "headers" specification in the 
> filter is too
> broad for what I'm trying to do.
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of David
> Barker
> Sent: Friday, 08 February 2008 3:56 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
> 
> How so, can you show the X-Declude-Sender line that it did 
> not work on ?
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of Chuck
> Schick
> Sent: Friday, February 08, 2008 3:50 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
> 
> David:
> 
> The first one does not work.
> 
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com 
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of David
> Barker
> Sent: Wednesday, February 06, 2008 12:25 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
> 
> Chuck you have several options:
> 
> 
> MAILFROM  5   STARTSWITH  Viagra
> MAILFROM  5   CONTAINSViagra
> MAILFROM  5   PCRE (?i:.*viagra.*@)
> 
> 
> David Barker
> VP Operations Declude
> Your Email security is our business
> 978.499.2933 x 7007 office
> 978.988.1311 fax
> [EMAIL PROTECTED]
> 
>  
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of Chuck
> Schick
> Sent: Wednesday, February 06, 2008 2:17 PM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] How can I filter this...?
> 
> Spam email is sent and the from line is
> 
> "vigara" <[EMAIL PROTECTED]>
> 
> Now the declude sender is [EMAIL PROTECTED] but I want to filter 
> the sender name
> of "vigara".  Seems like it should be simple but it is eluding me.
> 
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
>

RE: [Declude.JunkMail] How can I filter this...?

2008-02-08 Thread Chuck Schick

That may be but since I have a client that is seeing about 20 of these a day
all spelled the same he thinks I should be able to block it.

I want to know how to filter on the From line.  

I never asked how many ways to spell the word.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Friday, February 08, 2008 4:15 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] How can I filter this...?

There are 1,300,925,111,156,286,160,896 ways to spell Viagra (see the update
at the bottom).

http://cockeyed.com/lessons/viagra/viagra.html

Going after the word is not the way to target the spam.

Matt



Chuck Schick wrote:
> Here is the From line.
>
>  From: "viagra" <[EMAIL PROTECTED]>
>
> The X-declude Sender line is:
>
> X-Declude-Sender: [EMAIL PROTECTED] [190.172.162.107]
>
> Sorry, I was not clearer.
>
> We are getting tons of these with varying spellings of the viagra and 
> the email address is always different.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> David Barker
> Sent: Friday, February 08, 2008 1:56 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> How so, can you show the X-Declude-Sender line that it did not work on ?
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> Chuck Schick
> Sent: Friday, February 08, 2008 3:50 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> David:
>
> The first one does not work.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> David Barker
> Sent: Wednesday, February 06, 2008 12:25 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
>
> Chuck you have several options:
>
>
> MAILFROM  5   STARTSWITH  Viagra
> MAILFROM  5   CONTAINSViagra
> MAILFROM  5   PCRE (?i:.*viagra.*@)
>
>
> David Barker
> VP Operations Declude
> Your Email security is our business
> 978.499.2933 x 7007 office
> 978.988.1311 fax
> [EMAIL PROTECTED]
>
>  
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> Chuck Schick
> Sent: Wednesday, February 06, 2008 2:17 PM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] How can I filter this...?
>
> Spam email is sent and the from line is
>
> "vigara" <[EMAIL PROTECTED]>
>
> Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender 
> name of "vigara".  Seems like it should be simple but it is eluding me.
>
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>   



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] How can I filter this...?

2008-02-08 Thread Matt

There are 1,300,925,111,156,286,160,896 ways to spell Viagra (see the 
update at the bottom).


   http://cockeyed.com/lessons/viagra/viagra.html

Going after the word is not the way to target the spam.

Matt



Chuck Schick wrote:

Here is the From line.

 From: "viagra" <[EMAIL PROTECTED]>

The X-declude Sender line is:

X-Declude-Sender: [EMAIL PROTECTED] [190.172.162.107]

Sorry, I was not clearer.

We are getting tons of these with varying spellings of the viagra and the
email address is always different.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, February 08, 2008 1:56 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

How so, can you show the X-Declude-Sender line that it did not work on ?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Friday, February 08, 2008 3:50 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

David:

The first one does not work.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com 


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, February 06, 2008 12:25 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

Chuck you have several options:


MAILFROM5   STARTSWITH  Viagra
MAILFROM5   CONTAINSViagra
MAILFROM5   PCRE (?i:.*viagra.*@)


David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]

 
-Original Message-

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Wednesday, February 06, 2008 2:17 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] How can I filter this...?

Spam email is sent and the from line is

"vigara" <[EMAIL PROTECTED]>

Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender name
of "vigara".  Seems like it should be simple but it is eluding me.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] How can I filter this...?

2008-02-08 Thread Chuck Schick

Here is the From line.

 From: "viagra" <[EMAIL PROTECTED]>

The X-declude Sender line is:

X-Declude-Sender: [EMAIL PROTECTED] [190.172.162.107]

Sorry, I was not clearer.

We are getting tons of these with varying spellings of the viagra and the
email address is always different.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, February 08, 2008 1:56 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

How so, can you show the X-Declude-Sender line that it did not work on ?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Friday, February 08, 2008 3:50 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

David:

The first one does not work.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, February 06, 2008 12:25 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

Chuck you have several options:


MAILFROM5   STARTSWITH  Viagra
MAILFROM5   CONTAINSViagra
MAILFROM5   PCRE (?i:.*viagra.*@)


David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]

 
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Wednesday, February 06, 2008 2:17 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] How can I filter this...?

Spam email is sent and the from line is

"vigara" <[EMAIL PROTECTED]>

Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender name
of "vigara".  Seems like it should be simple but it is eluding me.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] How can I filter this...?

2008-02-08 Thread Colbeck, Andrew

(another country heard from)

David... Chuck... the MAILFROM is going to filter based on the
server-side conversation (i.e. for IMail users, it will be the value
from the Q*.smd file, not any text in the D*.smd file).

The example that Chuck gave is going to be the From: line in the message
header, which is not the same.

Also, "vigara" is not equal to "viagra" so Dave's first example PCRE
filter doesn't match the text that Chuck supplied.

So that would be two reasons why it didn't work.


Andrew.



> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of David Barker
> Sent: Friday, February 08, 2008 1:40 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
> 
> 
> This is what Chuck requested.
> 
> "Now the declude sender is [EMAIL PROTECTED] but I want to filter 
> the sender name
> of "vigara". " 
> 
> If you show me what you trying to do in the headers perhaps I 
> can help ?
> 
> David B
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of John
> Shacklett
> Sent: Friday, February 08, 2008 4:36 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
> 
> Isn't the mailfrom in this case [EMAIL PROTECTED] and not the 
> vigara part? Chuck
> is looking for a way to filter based on the "name" attached 
> to the address
> and not the specific address proper, isn't that right Chuck? 
> 
> I'm butting in here because I'm trying to capture something 
> similar using
> the same logic, and using a "headers" specification in the 
> filter is too
> broad for what I'm trying to do.
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of David
> Barker
> Sent: Friday, 08 February 2008 3:56 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
> 
> How so, can you show the X-Declude-Sender line that it did 
> not work on ?
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of Chuck
> Schick
> Sent: Friday, February 08, 2008 3:50 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
> 
> David:
> 
> The first one does not work.
> 
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com 
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of David
> Barker
> Sent: Wednesday, February 06, 2008 12:25 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] How can I filter this...?
> 
> Chuck you have several options:
> 
> 
> MAILFROM  5   STARTSWITH  Viagra
> MAILFROM  5   CONTAINSViagra
> MAILFROM  5   PCRE (?i:.*viagra.*@)
> 
> 
> David Barker
> VP Operations Declude
> Your Email security is our business
> 978.499.2933 x 7007 office
> 978.988.1311 fax
> [EMAIL PROTECTED]
> 
>  
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of Chuck
> Schick
> Sent: Wednesday, February 06, 2008 2:17 PM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] How can I filter this...?
> 
> Spam email is sent and the from line is
> 
> "vigara" <[EMAIL PROTECTED]>
> 
> Now the declude sender is [EMAIL PROTECTED] but I want to filter 
> the sender name
> of "vigara".  Seems like it should be simple but it is eluding me.
> 
> Chuck Schick
> Warp 8, Inc.
> (303)-421-5140
> www.warp8.com
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 
> 


---
This E-mail ca

RE: [Declude.JunkMail] How can I filter this...?

2008-02-08 Thread David Barker

This is what Chuck requested.

"Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender 
name
of "vigara". " 

If you show me what you trying to do in the headers perhaps I can help ?

David B

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John
Shacklett
Sent: Friday, February 08, 2008 4:36 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

Isn't the mailfrom in this case [EMAIL PROTECTED] and not the vigara part? Chuck
is looking for a way to filter based on the "name" attached to the address
and not the specific address proper, isn't that right Chuck? 

I'm butting in here because I'm trying to capture something similar using
the same logic, and using a "headers" specification in the filter is too
broad for what I'm trying to do.

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, 08 February 2008 3:56 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

How so, can you show the X-Declude-Sender line that it did not work on ?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Friday, February 08, 2008 3:50 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

David:

The first one does not work.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, February 06, 2008 12:25 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

Chuck you have several options:


MAILFROM5   STARTSWITH  Viagra
MAILFROM5   CONTAINSViagra
MAILFROM5   PCRE (?i:.*viagra.*@)


David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]

 
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Wednesday, February 06, 2008 2:17 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] How can I filter this...?

Spam email is sent and the from line is

"vigara" <[EMAIL PROTECTED]>

Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender name
of "vigara".  Seems like it should be simple but it is eluding me.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] How can I filter this...?

2008-02-08 Thread John Shacklett

Isn't the mailfrom in this case [EMAIL PROTECTED] and not the vigara part? Chuck
is looking for a way to filter based on the "name" attached to the address
and not the specific address proper, isn't that right Chuck? 

I'm butting in here because I'm trying to capture something similar using
the same logic, and using a "headers" specification in the filter is too
broad for what I'm trying to do.

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, 08 February 2008 3:56 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

How so, can you show the X-Declude-Sender line that it did not work on ?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Friday, February 08, 2008 3:50 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

David:

The first one does not work.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, February 06, 2008 12:25 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

Chuck you have several options:


MAILFROM5   STARTSWITH  Viagra
MAILFROM5   CONTAINSViagra
MAILFROM5   PCRE (?i:.*viagra.*@)


David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]

 
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Wednesday, February 06, 2008 2:17 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] How can I filter this...?

Spam email is sent and the from line is

"vigara" <[EMAIL PROTECTED]>

Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender name
of "vigara".  Seems like it should be simple but it is eluding me.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] How can I filter this...?

2008-02-08 Thread David Barker

How so, can you show the X-Declude-Sender line that it did not work on ?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Friday, February 08, 2008 3:50 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

David:

The first one does not work.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, February 06, 2008 12:25 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

Chuck you have several options:


MAILFROM5   STARTSWITH  Viagra
MAILFROM5   CONTAINSViagra
MAILFROM5   PCRE (?i:.*viagra.*@)


David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]

 
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Wednesday, February 06, 2008 2:17 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] How can I filter this...?

Spam email is sent and the from line is

"vigara" <[EMAIL PROTECTED]>

Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender name
of "vigara".  Seems like it should be simple but it is eluding me.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] How can I filter this...?

2008-02-08 Thread Chuck Schick

David:

The first one does not work.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, February 06, 2008 12:25 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?

Chuck you have several options:


MAILFROM5   STARTSWITH  Viagra
MAILFROM5   CONTAINSViagra
MAILFROM5   PCRE (?i:.*viagra.*@)


David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]

 
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Wednesday, February 06, 2008 2:17 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] How can I filter this...?

Spam email is sent and the from line is

"vigara" <[EMAIL PROTECTED]>

Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender name
of "vigara".  Seems like it should be simple but it is eluding me.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] counting mail

2008-02-08 Thread Bonno Bloksma

Hi Darrell,

I know about DLAnalyzer but that does to much for me. :-) I just want a few 
simple numbers.

I've also tried it with 
---
grep "Cumulative action(s) on this email" %1 > CumAction.txt
grep -c "LAST ACTION=DELETE" CumAction.Txt >> LastDel.Txt
grep -v -c "LAST ACTION=DELETE" CumAction.Txt >> LastNonDel.Txt
---

But that also produces different numbers.
Of course in this case I understand why, as 1 mail can go to lot's of users. We 
sometimes send mails to 1500+ recipients. That's why I was counting all the 
individual action lines


Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer



tio hogeschool hospitality en toerisme 
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED]  / www.tio.nl 
  - Original Message - 
  From: Darrell ([EMAIL PROTECTED]) 
  To: declude.junkmail@declude.com 
  Sent: Friday, February 08, 2008 4:17 PM
  Subject: Re: [Declude.JunkMail] counting mail


  Bonno,

  With emails that have multiple recipients its not uncommon to see last 
  actions multiple times for the same message.  This will skew your results.

  Your better off using a tool like DLAnalyzer to analyze your logs as it 
  takes all of this into account.  Plus it can be scheduled to run 
  automatically and email you the results.

  Darrell
  --
  Check out http://www.invariantsystems.com for utilities for Declude, 
  Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
  SURBL/URI integration, MRTG Integration, and Log Parsers.




  Bonno Bloksma wrote:
  > Hi,
  >  
  > I've got IMail reporting on so I get an e-mail every day telling me how 
  > many rdeliverd en ldeliverd.
  > I also have my Declude logfiles with action lines for each recipient of 
  > a mail.
  > A lot of mail is within our mailserver as students and staff communicate 
  > between each other.
  >  
  > On a given day, let's take feb 1st, I have:
  > IMail LocalDeliver 8837 and RemoteDeliver 1240
  > Couting from the Declude log using:
  > CountAction.cmd decl0201.txt
  > ---
  > grep "Action(s) taken for" %1 > Action.txt
  > grep -c "LAST ACTION=DELETE" Action.Txt >> LastDel.Txt
  > grep -v -c "LAST ACTION=DELETE" Action.Txt >> LastNonDel.Txt
  > exit
  > ---
  > I get 23758 for LastDel and 4123 for LastNonDel
  >  
  > I cannot find any match in those numbers, nothing even close.
  > I would have expected the LastNonDel to be the total of Local and/or 
  > Remote delivered.
  > What am I missing?
  >  
  >  
  >  
  >  
  > 
  > Met vriendelijke groet,
  > Bonno Bloksma
  > hoofd systeembeheer
  > 
  > tio hogeschool hospitality en toerisme
  > begijnenhof 8-12 / 5611 el eindhoven
  > t 040 296 28 28 / f 040 237 35 20
  > [EMAIL PROTECTED]   / www.tio.nl 
  > 
  > 
  > ---
  > This E-mail came from the Declude.JunkMail mailing list. To
  > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  > type "unsubscribe Declude.JunkMail". The archives can be found
  > at http://www.mail-archive.com.

  -- 



  ---
  This E-mail came from the Declude.JunkMail mailing list.  To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.JunkMail".  The archives can be found
  at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] ComCast delivery failure?

2008-02-08 Thread Don Schreiner

 

Anyone having problems sending to ComCast? We have a customer and in past
week unable to get mail forwarded to their ComCast address. No changes on
our end, not in any Spam DB.s, DNS report checks out for their domain, etc.
Log snippet below of error. Any help appreciated.

 

20080208 093247 127.0.0.1   SMTP (67320b10193c) >MAIL
FROM:<[EMAIL PROTECTED]>

20080208 093248 127.0.0.1   SMTP (67690b10f043) 452 4.1.0 ...
temporary failure

20080208 093248 127.0.0.1   SMTP (67690b10f043) SMTP_DELIV_FAILED

20080208 093248 127.0.0.1   SMTP (67690b10f043) >QUIT

20080208 093248 127.0.0.1   SMTP (67690b10f043) 221 2.0.0
IMTA05.westchester.pa.mail.comcast.net comcast closing connection.

 

Don Schreiner

CompBiz, Inc.

407-322-8654



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] counting mail

2008-02-08 Thread Darrell ([EMAIL PROTECTED])


Bonno,

With emails that have multiple recipients its not uncommon to see last 
actions multiple times for the same message.  This will skew your results.


Your better off using a tool like DLAnalyzer to analyze your logs as it 
takes all of this into account.  Plus it can be scheduled to run 
automatically and email you the results.


Darrell
--
Check out http://www.invariantsystems.com for utilities for Declude, 
Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
SURBL/URI integration, MRTG Integration, and Log Parsers.





Bonno Bloksma wrote:

Hi,
 
I've got IMail reporting on so I get an e-mail every day telling me how 
many rdeliverd en ldeliverd.
I also have my Declude logfiles with action lines for each recipient of 
a mail.
A lot of mail is within our mailserver as students and staff communicate 
between each other.
 
On a given day, let's take feb 1st, I have:

IMail LocalDeliver 8837 and RemoteDeliver 1240
Couting from the Declude log using:
CountAction.cmd decl0201.txt
---
grep "Action(s) taken for" %1 > Action.txt
grep -c "LAST ACTION=DELETE" Action.Txt >> LastDel.Txt
grep -v -c "LAST ACTION=DELETE" Action.Txt >> LastNonDel.Txt
exit
---
I get 23758 for LastDel and 4123 for LastNonDel
 
I cannot find any match in those numbers, nothing even close.
I would have expected the LastNonDel to be the total of Local and/or 
Remote delivered.

What am I missing?
 
 
 
 


Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer

tio hogeschool hospitality en toerisme
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED]   / www.tio.nl 



---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.


--



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] counting mail

2008-02-08 Thread Bonno Bloksma

Hi,

I've got IMail reporting on so I get an e-mail every day telling me how many 
rdeliverd en ldeliverd.
I also have my Declude logfiles with action lines for each recipient of a mail.
A lot of mail is within our mailserver as students and staff communicate 
between each other.

On a given day, let's take feb 1st, I have:
IMail LocalDeliver 8837 and RemoteDeliver 1240
Couting from the Declude log using:
CountAction.cmd decl0201.txt
---
grep "Action(s) taken for" %1 > Action.txt
grep -c "LAST ACTION=DELETE" Action.Txt >> LastDel.Txt
grep -v -c "LAST ACTION=DELETE" Action.Txt >> LastNonDel.Txt
exit
---
I get 23758 for LastDel and 4123 for LastNonDel

I cannot find any match in those numbers, nothing even close. 
I would have expected the LastNonDel to be the total of Local and/or Remote 
delivered.
What am I missing?






Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer



tio hogeschool hospitality en toerisme 
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED]  / www.tio.nl 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] How can I filter this...?

RE: [Declude.JunkMail] How can I filter this...?

RE: [Declude.JunkMail] How can I filter this...?

RE: [Declude.JunkMail] How can I filter this...?

Re: [Declude.JunkMail] How can I filter this...?

RE: [Declude.JunkMail] How can I filter this...?

RE: [Declude.JunkMail] How can I filter this...?

RE: [Declude.JunkMail] How can I filter this...?

RE: [Declude.JunkMail] How can I filter this...?

RE: [Declude.JunkMail] How can I filter this...?

RE: [Declude.JunkMail] How can I filter this...?

Re: [Declude.JunkMail] counting mail

[Declude.JunkMail] ComCast delivery failure?

Re: [Declude.JunkMail] counting mail

[Declude.JunkMail] counting mail

15 matches

Site Navigation

Mail list logo

Footer information