subject:"RE\: \[Declude.JunkMail\] Test"

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-27 Thread Adolfo Justiniano

I didn't have the PREWHITELIST in my global.cfg so I added it setting it to
OFF but also didn't work.

Thanks anyway for the suggestion Matt.


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Sunday, October 28, 2007 12:33 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Test or filtering option for authenticated
messages

Check that you don't have PREWHITELIST ON turned on, or rather set it to 
OFF.  This will cause other tests to run whereas with it on, it will 
stop processing on many of the Global.cfg triggers for whitelisting.

If that doesn't work, then it is by design.

Matt



David Barker wrote:
> Adolfo,
>
> I have it on the to do list for engineering to see which version and if it
> indeed works correctly.
>
> David
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
> Justiniano
> Sent: Friday, October 26, 2007 3:28 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
> messages
>
> Any news about this David? I tried with the latest interim (4.3.64) with
the
> same result: any WHITELIST disables the CATCHALLMAILS test or any other
test
> and it's defined action.
>
> Best,
>
>
> Adolfo Justiniano
> Santa Cruz BBS
> e-mail: [EMAIL PROTECTED]
> http://www.scbbs.net 
>
>
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
> Barker
> Sent: Monday, October 15, 2007 9:53 AM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
> messages
>
> I thought we had added this I will check with our engineers and get back
to
> you.
>
> David
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
> Justiniano
> Sent: Saturday, October 13, 2007 1:04 AM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
> messages
>
> Hello David,
>
> Bad news, as soon as I enable the WHITELIST AUTH the COPYTO action is
> ignored.
>
> Best,
>
>
> Adolfo Justiniano
> Santa Cruz BBS
> e-mail: [EMAIL PROTECTED]
> http://www.scbbs.net 
>
>
>
> -Original Message-
> From: Adolfo Justiniano [mailto:[EMAIL PROTECTED] 
> Sent: Friday, October 12, 2007 7:27 PM
> To: 'declude.junkmail@declude.com'
> Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
> messages
>
> Hmmm nice tip David, I'm going to try it and I'll let you know if it
works.
>
> I'm using actually version 4.3.46
>
> Best,
>
>
> Adolfo Justiniano
> Santa Cruz BBS
> e-mail: [EMAIL PROTECTED]
> http://www.scbbs.net 
>
>
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
> Barker
> Sent: Friday, October 12, 2007 4:04 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
> messages
>
> To archive certain addresses you would use per-domain/per-user setting
where
> the .junkmail file or .sender file action is
>
> CATCHALLMAILS COPYTO [EMAIL PROTECTED]
>
> I think if you are running the latest version of Declude the CATCHALLMAILS
> is triggered regardless of the WHITELIST status.
>
> David
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
> Justiniano
> Sent: Friday, October 12, 2007 3:46 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
> messages
>
> I think that it wouldn't work.
>
> First because I just need to archive some addresses not all and second
> because probably the WHITELIST AUTH if triggered will also ignore any
action
> like the COPYTO.
>
> Am I wrong?
>
>
> Adolfo Justiniano
> Santa Cruz BBS
> e-mail: [EMAIL PROTECTED]
> http://www.scbbs.net 
>
>
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
> Barker
> Sent: Friday, October 12, 2007 3:10 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
> messages
>
> Have you tried using 
>
> CATCHALLMAILS catchallmails   x   x   0   0
>
> David
>
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
> Justiniano
> Sent: Friday, October

Re: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-27 Thread Matt

Check that you don't have PREWHITELIST ON turned on, or rather set it to 
OFF.  This will cause other tests to run whereas with it on, it will 
stop processing on many of the Global.cfg triggers for whitelisting.


If that doesn't work, then it is by design.

Matt



David Barker wrote:

Adolfo,

I have it on the to do list for engineering to see which version and if it
indeed works correctly.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 26, 2007 3:28 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Any news about this David? I tried with the latest interim (4.3.64) with the
same result: any WHITELIST disables the CATCHALLMAILS test or any other test
and it's defined action.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, October 15, 2007 9:53 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

I thought we had added this I will check with our engineers and get back to
you.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Saturday, October 13, 2007 1:04 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Hello David,

Bad news, as soon as I enable the WHITELIST AUTH the COPYTO action is
ignored.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: Adolfo Justiniano [mailto:[EMAIL PROTECTED] 
Sent: Friday, October 12, 2007 7:27 PM

To: 'declude.junkmail@declude.com'
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Hmmm nice tip David, I'm going to try it and I'll let you know if it works.

I'm using actually version 4.3.46

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 4:04 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

To archive certain addresses you would use per-domain/per-user setting where
the .junkmail file or .sender file action is

CATCHALLMAILS COPYTO [EMAIL PROTECTED]

I think if you are running the latest version of Declude the CATCHALLMAILS
is triggered regardless of the WHITELIST status.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 3:46 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

I think that it wouldn't work.

First because I just need to archive some addresses not all and second
because probably the WHITELIST AUTH if triggered will also ignore any action
like the COPYTO.

Am I wrong?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 3:10 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Have you tried using 


CATCHALLMAILS   catchallmails   x   x   0   0

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Thank you David for the suggestion, but it doesn't work in my case.

I'll explain what I'm doing: instead of using IMail's copyall function for
archival, which BTW is very resource intensive, I use Declude's COPYTO
action using a filter that triggers only the accounts that I want to archive
their incoming and outgoing mail, so I can't use the WHITELIST AUTH because
if I do the COPYTO action is ignored. The BYPASSWHITELIST test will do the
same, ignoring the COPYTO action for those messages that are below the
weight or number of recipients and I need to archive all the messages of
those users that are in the filter.

As I'm not using the WHITELIST AUTH I need to counterbalance some weight for
those users that are authenticated, thus why I need a test or a filtering
option.

Thank you for considering adding it, I'm certain that it could be of some
use to others as well and a good weapon to be added to Declude's great
arsenal.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-26 Thread David Barker

Adolfo,

I have it on the to do list for engineering to see which version and if it
indeed works correctly.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 26, 2007 3:28 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Any news about this David? I tried with the latest interim (4.3.64) with the
same result: any WHITELIST disables the CATCHALLMAILS test or any other test
and it's defined action.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, October 15, 2007 9:53 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

I thought we had added this I will check with our engineers and get back to
you.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Saturday, October 13, 2007 1:04 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Hello David,

Bad news, as soon as I enable the WHITELIST AUTH the COPYTO action is
ignored.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: Adolfo Justiniano [mailto:[EMAIL PROTECTED] 
Sent: Friday, October 12, 2007 7:27 PM
To: 'declude.junkmail@declude.com'
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Hmmm nice tip David, I'm going to try it and I'll let you know if it works.

I'm using actually version 4.3.46

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 4:04 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

To archive certain addresses you would use per-domain/per-user setting where
the .junkmail file or .sender file action is

CATCHALLMAILS COPYTO [EMAIL PROTECTED]

I think if you are running the latest version of Declude the CATCHALLMAILS
is triggered regardless of the WHITELIST status.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 3:46 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

I think that it wouldn't work.

First because I just need to archive some addresses not all and second
because probably the WHITELIST AUTH if triggered will also ignore any action
like the COPYTO.

Am I wrong?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 3:10 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Have you tried using 

CATCHALLMAILS   catchallmails   x   x   0   0

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Thank you David for the suggestion, but it doesn't work in my case.

I'll explain what I'm doing: instead of using IMail's copyall function for
archival, which BTW is very resource intensive, I use Declude's COPYTO
action using a filter that triggers only the accounts that I want to archive
their incoming and outgoing mail, so I can't use the WHITELIST AUTH because
if I do the COPYTO action is ignored. The BYPASSWHITELIST test will do the
same, ignoring the COPYTO action for those messages that are below the
weight or number of recipients and I need to archive all the messages of
those users that are in the filter.

As I'm not using the WHITELIST AUTH I need to counterbalance some weight for
those users that are authenticated, thus why I need a test or a filtering
option.

Thank you for considering adding it, I'm certain that it could be of some
use to others as well and a good weapon to be added to Declude's great
arsenal.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 10:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
mes

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-26 Thread Adolfo Justiniano

Any news about this David? I tried with the latest interim (4.3.64) with the
same result: any WHITELIST disables the CATCHALLMAILS test or any other test
and it's defined action.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, October 15, 2007 9:53 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

I thought we had added this I will check with our engineers and get back to
you.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Saturday, October 13, 2007 1:04 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Hello David,

Bad news, as soon as I enable the WHITELIST AUTH the COPYTO action is
ignored.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: Adolfo Justiniano [mailto:[EMAIL PROTECTED] 
Sent: Friday, October 12, 2007 7:27 PM
To: 'declude.junkmail@declude.com'
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Hmmm nice tip David, I'm going to try it and I'll let you know if it works.

I'm using actually version 4.3.46

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 4:04 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

To archive certain addresses you would use per-domain/per-user setting where
the .junkmail file or .sender file action is

CATCHALLMAILS COPYTO [EMAIL PROTECTED]

I think if you are running the latest version of Declude the CATCHALLMAILS
is triggered regardless of the WHITELIST status.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 3:46 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

I think that it wouldn't work.

First because I just need to archive some addresses not all and second
because probably the WHITELIST AUTH if triggered will also ignore any action
like the COPYTO.

Am I wrong?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 3:10 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Have you tried using 

CATCHALLMAILS   catchallmails   x   x   0   0

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Thank you David for the suggestion, but it doesn't work in my case.

I'll explain what I'm doing: instead of using IMail's copyall function for
archival, which BTW is very resource intensive, I use Declude's COPYTO
action using a filter that triggers only the accounts that I want to archive
their incoming and outgoing mail, so I can't use the WHITELIST AUTH because
if I do the COPYTO action is ignored. The BYPASSWHITELIST test will do the
same, ignoring the COPYTO action for those messages that are below the
weight or number of recipients and I need to archive all the messages of
those users that are in the filter.

As I'm not using the WHITELIST AUTH I need to counterbalance some weight for
those users that are authenticated, thus why I need a test or a filtering
option.

Thank you for considering adding it, I'm certain that it could be of some
use to others as well and a good weapon to be added to Declude's great
arsenal.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 10:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

As an FYI this test can be useful if you are concerned that not all users
should be whitelisted when authenticated.

BYPASSWHITELIST 

This optional test instructs Declude to bypass any whitelisting for E-mails
with at least a specific number of recipients and at least a specific
weight.
For example, you could define a test with the following line in the
global.cfg file: BYPAS

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-15 Thread David Barker

I thought we had added this I will check with our engineers and get back to
you.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Saturday, October 13, 2007 1:04 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Hello David,

Bad news, as soon as I enable the WHITELIST AUTH the COPYTO action is
ignored.

Best,

Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 

-Original Message-
From: Adolfo Justiniano [mailto:[EMAIL PROTECTED] 
Sent: Friday, October 12, 2007 7:27 PM
To: 'declude.junkmail@declude.com'
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Hmmm nice tip David, I'm going to try it and I'll let you know if it works.

I'm using actually version 4.3.46

Best,

Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 4:04 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

To archive certain addresses you would use per-domain/per-user setting where
the .junkmail file or .sender file action is

CATCHALLMAILS COPYTO [EMAIL PROTECTED]

I think if you are running the latest version of Declude the CATCHALLMAILS
is triggered regardless of the WHITELIST status.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 3:46 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

I think that it wouldn't work.

First because I just need to archive some addresses not all and second
because probably the WHITELIST AUTH if triggered will also ignore any action
like the COPYTO.

Am I wrong?

Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 3:10 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Have you tried using 

CATCHALLMAILS   catchallmails   x   x   0   0

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Thank you David for the suggestion, but it doesn't work in my case.

I'll explain what I'm doing: instead of using IMail's copyall function for
archival, which BTW is very resource intensive, I use Declude's COPYTO
action using a filter that triggers only the accounts that I want to archive
their incoming and outgoing mail, so I can't use the WHITELIST AUTH because
if I do the COPYTO action is ignored. The BYPASSWHITELIST test will do the
same, ignoring the COPYTO action for those messages that are below the
weight or number of recipients and I need to archive all the messages of
those users that are in the filter.

As I'm not using the WHITELIST AUTH I need to counterbalance some weight for
those users that are authenticated, thus why I need a test or a filtering
option.

Thank you for considering adding it, I'm certain that it could be of some
use to others as well and a good weapon to be added to Declude's great
arsenal.

Best,

Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 10:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

As an FYI this test can be useful if you are concerned that not all users
should be whitelisted when authenticated.

BYPASSWHITELIST 

This optional test instructs Declude to bypass any whitelisting for E-mails
with at least a specific number of recipients and at least a specific
weight.
For example, you could define a test with the following line in the
global.cfg file: BYPASSWHITELIST bypasswhitelist 60 5 0 0. The 60 refers to
the weight the E-mail must reach, and the 5 refers to the minimum number of
recipients. In this case, it would attempt to bypass the whitelisting for
E-mail with 5 or more recipients and a weight of 60 or higher.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:24 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test or filtering option for authenticated
messages

Q

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-12 Thread Adolfo Justiniano

Hello David,

Bad news, as soon as I enable the WHITELIST AUTH the COPYTO action is
ignored.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: Adolfo Justiniano [mailto:[EMAIL PROTECTED] 
Sent: Friday, October 12, 2007 7:27 PM
To: 'declude.junkmail@declude.com'
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Hmmm nice tip David, I'm going to try it and I'll let you know if it works.

I'm using actually version 4.3.46

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 4:04 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

To archive certain addresses you would use per-domain/per-user setting where
the .junkmail file or .sender file action is

CATCHALLMAILS COPYTO [EMAIL PROTECTED]

I think if you are running the latest version of Declude the CATCHALLMAILS
is triggered regardless of the WHITELIST status.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 3:46 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

I think that it wouldn't work.

First because I just need to archive some addresses not all and second
because probably the WHITELIST AUTH if triggered will also ignore any action
like the COPYTO.

Am I wrong?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 3:10 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Have you tried using 

CATCHALLMAILS   catchallmails   x   x   0   0

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Thank you David for the suggestion, but it doesn't work in my case.

I'll explain what I'm doing: instead of using IMail's copyall function for
archival, which BTW is very resource intensive, I use Declude's COPYTO
action using a filter that triggers only the accounts that I want to archive
their incoming and outgoing mail, so I can't use the WHITELIST AUTH because
if I do the COPYTO action is ignored. The BYPASSWHITELIST test will do the
same, ignoring the COPYTO action for those messages that are below the
weight or number of recipients and I need to archive all the messages of
those users that are in the filter.

As I'm not using the WHITELIST AUTH I need to counterbalance some weight for
those users that are authenticated, thus why I need a test or a filtering
option.

Thank you for considering adding it, I'm certain that it could be of some
use to others as well and a good weapon to be added to Declude's great
arsenal.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 10:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

As an FYI this test can be useful if you are concerned that not all users
should be whitelisted when authenticated.

BYPASSWHITELIST 

This optional test instructs Declude to bypass any whitelisting for E-mails
with at least a specific number of recipients and at least a specific
weight.
For example, you could define a test with the following line in the
global.cfg file: BYPASSWHITELIST bypasswhitelist 60 5 0 0. The 60 refers to
the weight the E-mail must reach, and the 5 refers to the minimum number of
recipients. In this case, it would attempt to bypass the whitelisting for
E-mail with 5 or more recipients and a weight of 60 or higher.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:24 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test or filtering option for authenticated
messages

Question: Is there any Declude JunkMail test or a filtering option to use in
case the sender was authenticated? I couldn't find it in the manual or the
release notes. If not, could someone at Declude please add it to the
wishlist.

I'd like to use it either one to counterbalance some weight instead of
WHITELIST AUTH which whitelists t

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-12 Thread Adolfo Justiniano

Hello John,

> Please explain. The Imail copyall function simply adds the copyall
> configured email address to the envelope of the email as it is received.

Well this was long time a ago when I tried to use IMail's copyall function,
probably around IMail's version 7.x or 8.x, the first thing that I noticed
was that the CPU usage in the machine went up in like a 2% on the average, I
don't know if it was caused by the extra delivery process, processing rules,
etc. With Declude´s COPYTO action there is no increase in the CPU usage,
probably because it just makes a copy of a few addresses.

Besides that, I noticed that when the copyall function was active, IMail
stopped including the X-RCPT-TO: header line that several of our customers
use to identify the final addressee. We catch several addresses in just one
mailbox that they later download through POP3 because their servers are not
always online. BTW we are not using the catchall (nobody) alias, our mail
gateway (IMGate) has the list of all the valid addresses. I don't know if
the problem is still happening with version 9.x, as I haven't tried recently
because Declude is handling this process well. We could include the line
with Declude, like X-RCPT-TO: %ALLRECIPS% but that would create a security
breach because it would reveal all the recipients even the BCC.

And third in some cases that I didn't investigate very well, the copyall
address which was included in the envelope, was been revealed when there
were some bounces like mailbox full, user rules, etc. creating another
security breach. Because of this, the address which BTW wasn't easy to guess
(mix of letters & numbers), started to receive spam addressed directly to
itself.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



---
[This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus system]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-12 Thread Adolfo Justiniano

Hmmm nice tip David, I'm going to try it and I'll let you know if it works.

I'm using actually version 4.3.46

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 4:04 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

To archive certain addresses you would use per-domain/per-user setting where
the .junkmail file or .sender file action is

CATCHALLMAILS COPYTO [EMAIL PROTECTED]

I think if you are running the latest version of Declude the CATCHALLMAILS
is triggered regardless of the WHITELIST status.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 3:46 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

I think that it wouldn't work.

First because I just need to archive some addresses not all and second
because probably the WHITELIST AUTH if triggered will also ignore any action
like the COPYTO.

Am I wrong?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 3:10 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Have you tried using 

CATCHALLMAILS   catchallmails   x   x   0   0

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Thank you David for the suggestion, but it doesn't work in my case.

I'll explain what I'm doing: instead of using IMail's copyall function for
archival, which BTW is very resource intensive, I use Declude's COPYTO
action using a filter that triggers only the accounts that I want to archive
their incoming and outgoing mail, so I can't use the WHITELIST AUTH because
if I do the COPYTO action is ignored. The BYPASSWHITELIST test will do the
same, ignoring the COPYTO action for those messages that are below the
weight or number of recipients and I need to archive all the messages of
those users that are in the filter.

As I'm not using the WHITELIST AUTH I need to counterbalance some weight for
those users that are authenticated, thus why I need a test or a filtering
option.

Thank you for considering adding it, I'm certain that it could be of some
use to others as well and a good weapon to be added to Declude's great
arsenal.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 10:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

As an FYI this test can be useful if you are concerned that not all users
should be whitelisted when authenticated.

BYPASSWHITELIST 

This optional test instructs Declude to bypass any whitelisting for E-mails
with at least a specific number of recipients and at least a specific
weight.
For example, you could define a test with the following line in the
global.cfg file: BYPASSWHITELIST bypasswhitelist 60 5 0 0. The 60 refers to
the weight the E-mail must reach, and the 5 refers to the minimum number of
recipients. In this case, it would attempt to bypass the whitelisting for
E-mail with 5 or more recipients and a weight of 60 or higher.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:24 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test or filtering option for authenticated
messages

Question: Is there any Declude JunkMail test or a filtering option to use in
case the sender was authenticated? I couldn't find it in the manual or the
release notes. If not, could someone at Declude please add it to the
wishlist.

I'd like to use it either one to counterbalance some weight instead of
WHITELIST AUTH which whitelists the message for authenticated senders from
all tests.

If a test something like:

AUTHAUTHx   x   -10 0

As a filtering option like:

AUTHEND IS  TRUE

Or

AUTH-10 IS  TRUE

Maybe others would find them useful, what do you think?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 







---
[This E-mail w

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-12 Thread John T (lists)

> I'll explain what I'm doing: instead of using IMail's copyall function for
> archival, which BTW is very resource intensive, I use Declude's COPYTO

Please explain. The Imail copyall function simply adds the copyall
configured email address to the envelope of the email as it is received. As
such, when the email is then processed by the Queue Manager service, it is
simple another recipient. Then, the rules.ima file processing is extremely
quick since it is a flat text file that is read and then what ever action is
taken. In other words, there is now work to do, it is simple an added email
address to the recipient list.

The copyall function is used by hundreds of admins on Imail servers without
any effect on resources.

John T




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-12 Thread David Barker

To archive certain addresses you would use per-domain/per-user setting where
the .junkmail file or .sender file action is

CATCHALLMAILS COPYTO [EMAIL PROTECTED]

I think if you are running the latest version of Declude the CATCHALLMAILS
is triggered regardless of the WHITELIST status.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 3:46 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

I think that it wouldn't work.

First because I just need to archive some addresses not all and second
because probably the WHITELIST AUTH if triggered will also ignore any action
like the COPYTO.

Am I wrong?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 3:10 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Have you tried using 

CATCHALLMAILS   catchallmails   x   x   0   0

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Thank you David for the suggestion, but it doesn't work in my case.

I'll explain what I'm doing: instead of using IMail's copyall function for
archival, which BTW is very resource intensive, I use Declude's COPYTO
action using a filter that triggers only the accounts that I want to archive
their incoming and outgoing mail, so I can't use the WHITELIST AUTH because
if I do the COPYTO action is ignored. The BYPASSWHITELIST test will do the
same, ignoring the COPYTO action for those messages that are below the
weight or number of recipients and I need to archive all the messages of
those users that are in the filter.

As I'm not using the WHITELIST AUTH I need to counterbalance some weight for
those users that are authenticated, thus why I need a test or a filtering
option.

Thank you for considering adding it, I'm certain that it could be of some
use to others as well and a good weapon to be added to Declude's great
arsenal.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 10:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

As an FYI this test can be useful if you are concerned that not all users
should be whitelisted when authenticated.

BYPASSWHITELIST 

This optional test instructs Declude to bypass any whitelisting for E-mails
with at least a specific number of recipients and at least a specific
weight.
For example, you could define a test with the following line in the
global.cfg file: BYPASSWHITELIST bypasswhitelist 60 5 0 0. The 60 refers to
the weight the E-mail must reach, and the 5 refers to the minimum number of
recipients. In this case, it would attempt to bypass the whitelisting for
E-mail with 5 or more recipients and a weight of 60 or higher.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:24 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test or filtering option for authenticated
messages

Question: Is there any Declude JunkMail test or a filtering option to use in
case the sender was authenticated? I couldn't find it in the manual or the
release notes. If not, could someone at Declude please add it to the
wishlist.

I'd like to use it either one to counterbalance some weight instead of
WHITELIST AUTH which whitelists the message for authenticated senders from
all tests.

If a test something like:

AUTHAUTHx   x   -10 0

As a filtering option like:

AUTHEND IS  TRUE

Or

AUTH-10 IS  TRUE

Maybe others would find them useful, what do you think?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 







---
[This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus
system]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The arc

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-12 Thread Adolfo Justiniano

I think that it wouldn't work.

First because I just need to archive some addresses not all and second
because probably the WHITELIST AUTH if triggered will also ignore any action
like the COPYTO.

Am I wrong?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 3:10 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Have you tried using 

CATCHALLMAILS   catchallmails   x   x   0   0

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Thank you David for the suggestion, but it doesn't work in my case.

I'll explain what I'm doing: instead of using IMail's copyall function for
archival, which BTW is very resource intensive, I use Declude's COPYTO
action using a filter that triggers only the accounts that I want to archive
their incoming and outgoing mail, so I can't use the WHITELIST AUTH because
if I do the COPYTO action is ignored. The BYPASSWHITELIST test will do the
same, ignoring the COPYTO action for those messages that are below the
weight or number of recipients and I need to archive all the messages of
those users that are in the filter.

As I'm not using the WHITELIST AUTH I need to counterbalance some weight for
those users that are authenticated, thus why I need a test or a filtering
option.

Thank you for considering adding it, I'm certain that it could be of some
use to others as well and a good weapon to be added to Declude's great
arsenal.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 10:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

As an FYI this test can be useful if you are concerned that not all users
should be whitelisted when authenticated.

BYPASSWHITELIST 

This optional test instructs Declude to bypass any whitelisting for E-mails
with at least a specific number of recipients and at least a specific
weight.
For example, you could define a test with the following line in the
global.cfg file: BYPASSWHITELIST bypasswhitelist 60 5 0 0. The 60 refers to
the weight the E-mail must reach, and the 5 refers to the minimum number of
recipients. In this case, it would attempt to bypass the whitelisting for
E-mail with 5 or more recipients and a weight of 60 or higher.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:24 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test or filtering option for authenticated
messages

Question: Is there any Declude JunkMail test or a filtering option to use in
case the sender was authenticated? I couldn't find it in the manual or the
release notes. If not, could someone at Declude please add it to the
wishlist.

I'd like to use it either one to counterbalance some weight instead of
WHITELIST AUTH which whitelists the message for authenticated senders from
all tests.

If a test something like:

AUTHAUTHx   x   -10 0

As a filtering option like:

AUTHEND IS  TRUE

Or

AUTH-10 IS  TRUE

Maybe others would find them useful, what do you think?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 







---
[This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus
system]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus
system]


---
[This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus
system]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMA

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-12 Thread David Barker

Have you tried using 

CATCHALLMAILS   catchallmails   x   x   0   0

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:57 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

Thank you David for the suggestion, but it doesn't work in my case.

I'll explain what I'm doing: instead of using IMail's copyall function for
archival, which BTW is very resource intensive, I use Declude's COPYTO
action using a filter that triggers only the accounts that I want to archive
their incoming and outgoing mail, so I can't use the WHITELIST AUTH because
if I do the COPYTO action is ignored. The BYPASSWHITELIST test will do the
same, ignoring the COPYTO action for those messages that are below the
weight or number of recipients and I need to archive all the messages of
those users that are in the filter.

As I'm not using the WHITELIST AUTH I need to counterbalance some weight for
those users that are authenticated, thus why I need a test or a filtering
option.

Thank you for considering adding it, I'm certain that it could be of some
use to others as well and a good weapon to be added to Declude's great
arsenal.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 10:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

As an FYI this test can be useful if you are concerned that not all users
should be whitelisted when authenticated.

BYPASSWHITELIST 

This optional test instructs Declude to bypass any whitelisting for E-mails
with at least a specific number of recipients and at least a specific
weight.
For example, you could define a test with the following line in the
global.cfg file: BYPASSWHITELIST bypasswhitelist 60 5 0 0. The 60 refers to
the weight the E-mail must reach, and the 5 refers to the minimum number of
recipients. In this case, it would attempt to bypass the whitelisting for
E-mail with 5 or more recipients and a weight of 60 or higher.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:24 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test or filtering option for authenticated
messages

Question: Is there any Declude JunkMail test or a filtering option to use in
case the sender was authenticated? I couldn't find it in the manual or the
release notes. If not, could someone at Declude please add it to the
wishlist.

I'd like to use it either one to counterbalance some weight instead of
WHITELIST AUTH which whitelists the message for authenticated senders from
all tests.

If a test something like:

AUTHAUTHx   x   -10 0

As a filtering option like:

AUTHEND IS  TRUE

Or

AUTH-10 IS  TRUE

Maybe others would find them useful, what do you think?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 







---
[This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus
system]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus
system]


---
[This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus
system]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-12 Thread Adolfo Justiniano

Thank you David for the suggestion, but it doesn't work in my case.

I'll explain what I'm doing: instead of using IMail's copyall function for
archival, which BTW is very resource intensive, I use Declude's COPYTO
action using a filter that triggers only the accounts that I want to archive
their incoming and outgoing mail, so I can't use the WHITELIST AUTH because
if I do the COPYTO action is ignored. The BYPASSWHITELIST test will do the
same, ignoring the COPYTO action for those messages that are below the
weight or number of recipients and I need to archive all the messages of
those users that are in the filter.

As I'm not using the WHITELIST AUTH I need to counterbalance some weight for
those users that are authenticated, thus why I need a test or a filtering
option.

Thank you for considering adding it, I'm certain that it could be of some
use to others as well and a good weapon to be added to Declude's great
arsenal.

Best,


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 10:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages

As an FYI this test can be useful if you are concerned that not all users
should be whitelisted when authenticated.

BYPASSWHITELIST 

This optional test instructs Declude to bypass any whitelisting for E-mails
with at least a specific number of recipients and at least a specific
weight.
For example, you could define a test with the following line in the
global.cfg file: BYPASSWHITELIST bypasswhitelist 60 5 0 0. The 60 refers to
the weight the E-mail must reach, and the 5 refers to the minimum number of
recipients. In this case, it would attempt to bypass the whitelisting for
E-mail with 5 or more recipients and a weight of 60 or higher.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:24 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test or filtering option for authenticated
messages

Question: Is there any Declude JunkMail test or a filtering option to use in
case the sender was authenticated? I couldn't find it in the manual or the
release notes. If not, could someone at Declude please add it to the
wishlist.

I'd like to use it either one to counterbalance some weight instead of
WHITELIST AUTH which whitelists the message for authenticated senders from
all tests.

If a test something like:

AUTHAUTHx   x   -10 0

As a filtering option like:

AUTHEND IS  TRUE

Or

AUTH-10 IS  TRUE

Maybe others would find them useful, what do you think?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 







---
[This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus
system]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus
system]


---
[This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus system]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test or filtering option for authenticated messages

2007-10-12 Thread David Barker

As an FYI this test can be useful if you are concerned that not all users
should be whitelisted when authenticated.

BYPASSWHITELIST 

This optional test instructs Declude to bypass any whitelisting for E-mails
with at least a specific number of recipients and at least a specific
weight.
For example, you could define a test with the following line in the
global.cfg file: BYPASSWHITELIST bypasswhitelist 60 5 0 0. The 60 refers to
the weight the E-mail must reach, and the 5 refers to the minimum number of
recipients. In this case, it would attempt to bypass the whitelisting for
E-mail with 5 or more recipients and a weight of 60 or higher.

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adolfo
Justiniano
Sent: Friday, October 12, 2007 2:24 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test or filtering option for authenticated
messages

Question: Is there any Declude JunkMail test or a filtering option to use in
case the sender was authenticated? I couldn't find it in the manual or the
release notes. If not, could someone at Declude please add it to the
wishlist.

I'd like to use it either one to counterbalance some weight instead of
WHITELIST AUTH which whitelists the message for authenticated senders from
all tests.

If a test something like:

AUTHAUTHx   x   -10 0

As a filtering option like:

AUTHEND IS  TRUE

Or

AUTH-10 IS  TRUE

Maybe others would find them useful, what do you think?


Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net 







---
[This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus
system]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test idea

2006-09-04 Thread John T \(Lists\)

Scott, I specifically specified 3 characters not 4 to allow for the 2
character TLDs.

I would be very interested to see the results based on 3 characters, not 4.

Ratio of 1 to 13 is not bad if we are talking about a resulting penalty of
20-25% of hold weight.

Also, if the test could be configured to not only allow for specified tests
failed end but also other parameters say HELO contains
problematicdomaincausingtoomanyfalsepositives would that help?

John T
eServices For You

"Seek, and ye shall find!"

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
> Sent: Monday, September 04, 2006 8:15 AM
> To: declude.junkmail@declude.com
> Subject: Re: [Declude.JunkMail] Test idea
> 
> I ran a query on this looking at my August email results (228889 emails):
> 
> Excluding HELOBOGUS
> Excluding (timeout) and [No Reverse DNS] and (Private IP)
> Looking at last 4 chars of helo <> last 4 chars of revdns
> 
> 1487 ham:
> including gov / us mismatches
> a fair amount of .com / .org with DSL / CABLE static revdns
> small amount of valid mismatches shaw.ca / shawcable.net
> mindspring.com/earthlink.net. I've definitely seen this from some non US
> mailservers where a country code is in one and .net is in another.
> 
> 19668 spam
> lots of zommbies,especially non-US
> Fair amount of static spammers .net / .info mismatches for example
> 
> - Original Message -
> From: "John T (Lists)" <[EMAIL PROTECTED]>
> To: 
> Sent: Monday, September 04, 2006 1:29 AM
> Subject: [Declude.JunkMail] Test idea
> 
> 
> > Idea! (Ouch)
> >
> > If email failed HELOBOGUS or NOREVDNS (or other specified tests) END
> > otherwise compare the last 3 characters of the HELO with the last 3
> > characters of the REVDNS and if not match add say 1/5 or so of HOLD
> > weight.
> >
> > Thoughts, comments, boos, yahs, Go back to sleep (Can I Please?)
> >
> > John T
> > eServices For You
> >
> > "Seek, and ye shall find!"
> >
> >
> >
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
> >
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test idea

2006-09-04 Thread Markus Gufler

Scott,

I can't remmeber exactly my suggestion (as said it was around two years ago)
but I've made a similar research as you in the logfiles in order to go sure
that the HH-SS / SH-SH ratio would be good enough to consider it a valuable
option for some points in the weighting system. 

There are more values that can be compared:
HELO
REVDNS
MAILFROM
COUNTRY
...

There are many zombies out who send messages with randomly
selected/generated values.

If there is a message with 
HELO xy.domain.de
REVDNS xy.domain.net
MAILFROM [EMAIL PROTECTED]
and COUNTRY shows Mexiko as origin 

then it maybe should be possible to add something like 20 - 40% of your hold
weight to the final weight of this message.

Markus


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of Scott Fisher
> Sent: Monday, September 04, 2006 5:15 PM
> To: declude.junkmail@declude.com
> Subject: Re: [Declude.JunkMail] Test idea
> 
> I ran a query on this looking at my August email results 
> (228889 emails):
> 
> Excluding HELOBOGUS
> Excluding (timeout) and [No Reverse DNS] and (Private IP) 
> Looking at last 4 chars of helo <> last 4 chars of revdns
> 
> 1487 ham:
> including gov / us mismatches
> a fair amount of .com / .org with DSL / CABLE static revdns 
> small amount of valid mismatches shaw.ca / shawcable.net 
> mindspring.com/earthlink.net. I've definitely seen this from 
> some non US mailservers where a country code is in one and 
> .net is in another.
> 
> 19668 spam
> lots of zommbies,especially non-US
> Fair amount of static spammers .net / .info mismatches for example
> 
> - Original Message -
> From: "John T (Lists)" <[EMAIL PROTECTED]>
> To: 
> Sent: Monday, September 04, 2006 1:29 AM
> Subject: [Declude.JunkMail] Test idea
> 
> 
> > Idea! (Ouch)
> >
> > If email failed HELOBOGUS or NOREVDNS (or other specified tests) END
> > otherwise compare the last 3 characters of the HELO with the last 3
> > characters of the REVDNS and if not match add say 1/5 or so of HOLD 
> > weight.
> >
> > Thoughts, comments, boos, yahs, Go back to sleep (Can I Please?)
> >
> > John T
> > eServices For You
> >
> > "Seek, and ye shall find!"
> >
> >
> >
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
> > 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 
> 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test idea

2006-09-04 Thread Scott Fisher


I ran a query on this looking at my August email results (228889 emails):

Excluding HELOBOGUS
Excluding (timeout) and [No Reverse DNS] and (Private IP)
Looking at last 4 chars of helo <> last 4 chars of revdns

1487 ham:
including gov / us mismatches
a fair amount of .com / .org with DSL / CABLE static revdns
small amount of valid mismatches shaw.ca / shawcable.net 
mindspring.com/earthlink.net. I've definitely seen this from some non US 
mailservers where a country code is in one and .net is in another.


19668 spam
lots of zommbies,especially non-US
Fair amount of static spammers .net / .info mismatches for example

- Original Message - 
From: "John T (Lists)" <[EMAIL PROTECTED]>

To: 
Sent: Monday, September 04, 2006 1:29 AM
Subject: [Declude.JunkMail] Test idea



Idea! (Ouch)

If email failed HELOBOGUS or NOREVDNS (or other specified tests) END
otherwise compare the last 3 characters of the HELO with the last 3
characters of the REVDNS and if not match add say 1/5 or so of HOLD 
weight.


Thoughts, comments, boos, yahs, Go back to sleep (Can I Please?)

John T
eServices For You

"Seek, and ye shall find!"




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.






---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test idea

2006-09-04 Thread Darrell \([EMAIL PROTECTED])

Wouldnt this block Imail servers?  Assume the Imail server had revdns.

1.) If email failed HELOBOGUS or NOREVDNS END
Imail server would pass this since it has REVDNS

2.) compare the last 3 characters of the HELO with the last 3 characters of 
the REVDNS

Since the HELO changes with the outbound domain chances are the revdns is 
not for the domain but for the server in general (speaking of hosting 
environments).  I only bring this up because of all the issues folks have 
with CBL etc.

Darrell

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers.

- Original Message - 
From: "Markus Gufler" <[EMAIL PROTECTED]>
To: 
Sent: Monday, September 04, 2006 2:41 AM
Subject: RE: [Declude.JunkMail] Test idea


> If email failed HELOBOGUS or NOREVDNS (or other specified
> tests) END otherwise compare the last 3 characters of the
> HELO with the last 3 characters of the REVDNS and if not
> match add say 1/5 or so of HOLD weight.

Hmm John, I consider it a good idea. As I can remember I suggested it
arround 2 years ago. You know what happened in the meantime?
Ok, so yes you can go back to sleep like a bear for the comming next winter
and be currious if in the meantime will happened something new ;-)

Markus



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test idea

2006-09-03 Thread Markus Gufler

> If email failed HELOBOGUS or NOREVDNS (or other specified 
> tests) END otherwise compare the last 3 characters of the 
> HELO with the last 3 characters of the REVDNS and if not 
> match add say 1/5 or so of HOLD weight.

Hmm John, I consider it a good idea. As I can remember I suggested it
arround 2 years ago. You know what happened in the meantime? 
Ok, so yes you can go back to sleep like a bear for the comming next winter
and be currious if in the meantime will happened something new ;-)

Markus



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test - can I post?

2006-06-14 Thread R. Scott Perry


> Well hell Scott!
> Hope all is going well for you:)

> Good the hear from you Scott! I hope things are well with you.

> Hear hear!

:)

Thank you all for the kind words.  :)  It is very nice to see all these 
familiar faces (and some new ones, too!).

  -Scott



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test - can I post?

2006-06-14 Thread Matt


Hear hear!



Dave Doherty wrote:



Good the hear from you Scott! I hope things are well with you.





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.






---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test - can I post?

2006-06-14 Thread David Barker

Andrew,

I am fully aware of the situation, and I posted a response yesterday. If
would like to discuss this further please feel free to contact me offline.

David B
www.declude.com


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck,
Andrew
Sent: Wednesday, June 14, 2006 12:41 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test - can I post?

David, have you heard the phrase "Caesar's wife must be above reproach"?

A company that sells email based products has to do a superlative job in
their own field.

I've already got a fulltime job thanks, but I just can't help getting pulled
into the forum and paying attention to what Declude is doing when Declude is
doing such a hack job.

I've had my own issues with tech support and have been flabbergasted at the
snail's pace of production.

We've been waiting a very long time for native URI support.

Heck, we've been waiting a long time for proper MIME decoding, never mind
the lack of robust body decoding whose bug was mentioned yesterday by Matt,
and never mind the similar problem with header decoding when the header has
non-RFC compliant line terminators.

We can all accept that a company undergoing changes is going to face
difficulties, but when you combine the lack of communication along with
technical difficulties in managing your own product... it just can't look
worse.

It's very disheartening to see Declude behaving this way; similar to what
has been said earlier, I put in a Declude gateway and considered that IMail
was necessary baggage to go with it.

My company specifically wanted a Windows based antispam gateway, and Declude
was the best game in town.  Well, the competition has grown up while Declude
has been napping and I've got choices.

Andrew. 


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> David Barker
> Sent: Wednesday, June 14, 2006 7:16 AM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test - can I post?
> 
> Erik,
> 
> We have just migrated our servers, and the DNS is in the process of 
> being updated.
> 
> David B
> www.declude.com
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> Erik
> Sent: Wednesday, June 14, 2006 10:00 AM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test - can I post?
> 
> If you have ever "whitelisted" the REVDNS of:   .declude.com  
> (like it has
> been in the past - for several years); you will need to change this.  
> We had too.  Before, Declude always had the "correct" REVDNS based on 
> their domain but since their move to a new location and provider... 
> Their new REVDNS is:
> .xiolink.com (nothing relating to Declude or CPHZ.COM)
> 
> To me, this is ironic considering that Declude is in the SPAM business 
> control.  And the .xiolink.com full text lookup returns a 
> dotted/dashed IP address used by most dialup/residential customers and 
> for most of us; we use filters and external filters to detect the 
> dotted/dashed IP.
> (Full REVDNS
> for the current Declude is:   63-246-31-248.xiolink.com 
> ([63.246.31.248]))
> 
> Whitelisting based just on a to/from/return address is not enough as 
> these can be forged.  In the past we used both the to/from/return 
> address AND the REVDNS as the "whitelisting".
> 
> -Erik
> 
> 
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of 
> Marc Catuogno
> Sent: Wednesday, June 14, 2006 3:28 PM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] Test - can I post?
> 
> 
> Checking to see if I can post...
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
> 
> 


---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test - can I post?

2006-06-14 Thread Dave Doherty


Good the hear from you Scott! I hope things are well with you.





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test - can I post?

2006-06-14 Thread Erik


Yes, it is "a" "common" place holder... But for how long?   Shouldn't a
company be on top of that based on the type business they are in?  Lookup
those IP ranges to see if they those ranges are listed on any list; use DNS
that is also not listed on any URI lookup?  Normally, what... 7 to 10 days
max for have a REVDNS to populate?  Have you noticed now... The REVDNS now
shows .declude.com (ironically after I mentioned it)?  When did their move
occur... Over a month ago?  Yes.

That's not what I said on the REVDNS alone Sandy.  What I said was:

"...dotted/dashed IP address used by most filters and external filters
to detect the dotted/dashed IP"

"Whitelisting based just on a to/from/return address is not enough as these
can be forged.  In the past we used both the to/from/return address AND the
REVDNS as the "whitelisting"."

-
More important, why would you think that whitelisting based on the REVDNS
domain of a known and targeted anti-spam company would be trustworthy?

--Sandy


--
 
Sanford Whiteman, Chief Technologist 
Broadleaf Systems, a division of 
Cypress Integrated Systems, Inc. 
mailto:[EMAIL PROTECTED] 

--


---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test - can I post?

2006-06-14 Thread Sharyn Schmidt

Well hell Scott!

Hope all is going well for you:)

Sharyn





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test - can I post?

2006-06-14 Thread R. Scott Perry

> You would "think" that a company that is SPAM control and offer a 
product
> for SPAM control would look more into "who" they use for their ISP 
and how

> they setup their service.

Just for the record, I was the one that chose EasyDNS.  And at that 
time, I certainly had no knowledge of them making money from spammers.  :)


You had also mentioned the non-vanity reverse DNS 
(63-246-31-248.xiolink.com) -- that is a perfectly valid setup, and is 
in fact the same way that the DNSstuff.com mailserver is set up (which, 
like the Declude mailserver back in my day, is on a business Internet 
connection that can't have a vanity reverse DNS entry without switching 
to a much more expensive Internet provider).  It's also an old pet peeve 
of mine when people block E-mails from IPs with valid-but-non-vanity 
reverse DNS entries, as some people may remember.  Of course, it's 
better if you can have a vanity reverse DNS entry -- so it's a good 
thing that Declude is in the process of getting it -- but it is 
perfectly valid.

 -Scott



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test - can I post?

2006-06-14 Thread Sanford Whiteman

>And the .xiolink.com full text lookup returns a dotted/dashed IP
>address used by most dialup/residential customers and for most of >us...

That's not really true.  A dotted-dashed IP-like hostname is a common 
placeholder used by ISPs for IPs whose customers have not requested a PTR, even 
including large commercial accounts.  That's not the same as a PTR that *also* 
includes '-dialup', '-dsl', etc.

More important, why would you think that whitelisting based on the REVDNS 
domain of a known and targeted anti-spam company would be trustworthy?

--Sandy


--
 
Sanford Whiteman, Chief Technologist 
Broadleaf Systems, a division of 
Cypress Integrated Systems, Inc. 
mailto:[EMAIL PROTECTED] 

--


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test - can I post?

2006-06-14 Thread Colbeck, Andrew

David, have you heard the phrase "Caesar's wife must be above reproach"?

A company that sells email based products has to do a superlative job in
their own field.

I've already got a fulltime job thanks, but I just can't help getting
pulled into the forum and paying attention to what Declude is doing when
Declude is doing such a hack job.

I've had my own issues with tech support and have been flabbergasted at
the snail's pace of production.

We've been waiting a very long time for native URI support.

Heck, we've been waiting a long time for proper MIME decoding, never
mind the lack of robust body decoding whose bug was mentioned yesterday
by Matt, and never mind the similar problem with header decoding when
the header has non-RFC compliant line terminators.

We can all accept that a company undergoing changes is going to face
difficulties, but when you combine the lack of communication along with
technical difficulties in managing your own product... it just can't
look worse.

It's very disheartening to see Declude behaving this way; similar to
what has been said earlier, I put in a Declude gateway and considered
that IMail was necessary baggage to go with it.

My company specifically wanted a Windows based antispam gateway, and
Declude was the best game in town.  Well, the competition has grown up
while Declude has been napping and I've got choices.

Andrew. 


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of David Barker
> Sent: Wednesday, June 14, 2006 7:16 AM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test - can I post?
> 
> Erik,
> 
> We have just migrated our servers, and the DNS is in the 
> process of being updated.
> 
> David B
> www.declude.com 
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of Erik
> Sent: Wednesday, June 14, 2006 10:00 AM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test - can I post?
> 
> If you have ever "whitelisted" the REVDNS of:   .declude.com  
> (like it has
> been in the past - for several years); you will need to 
> change this.  We had too.  Before, Declude always had the 
> "correct" REVDNS based on their domain but since their move 
> to a new location and provider... Their new REVDNS is:
> .xiolink.com (nothing relating to Declude or CPHZ.COM)
> 
> To me, this is ironic considering that Declude is in the SPAM 
> business control.  And the .xiolink.com full text lookup 
> returns a dotted/dashed IP address used by most 
> dialup/residential customers and for most of us; we use 
> filters and external filters to detect the dotted/dashed IP.  
> (Full REVDNS
> for the current Declude is:   63-246-31-248.xiolink.com 
> ([63.246.31.248]))
> 
> Whitelisting based just on a to/from/return address is not 
> enough as these can be forged.  In the past we used both the 
> to/from/return address AND the REVDNS as the "whitelisting".
> 
> -Erik
> 
> 
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of Marc Catuogno
> Sent: Wednesday, June 14, 2006 3:28 PM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] Test - can I post?
> 
> 
> Checking to see if I can post...
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 
> 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test - can I post?

2006-06-14 Thread Erik

On other thing... As I mentioned before about the "declude" site/ip

Lookup on Scott's DNS Report:
http://www.dnsreport.com/tools/dnsreport.ch?domain=xiolink.com


Notice all the errors???

Now lookup:
http://www.dnsreport.com/tools/dnsreport.ch?domain=declude.com

easydns.com ?   I don't know about the most of you; but don't you find that
"easydns.com" is mostly listed on spam sources; this based on our logs from
Darrell's URLBL program.

You would "think" that a company that is SPAM control and offer a product
for SPAM control would look more into "who" they use for their ISP and how
they setup their service.

Just as Scott Fisher said once awhile back (I believe it was him)... Ironic.

-Erik


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc
Catuogno
Sent: Wednesday, June 14, 2006 3:28 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test - can I post?
Importance: High


Checking to see if I can post...



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test - can I post?

2006-06-14 Thread David Barker

Erik,

We have just migrated our servers, and the DNS is in the process of being
updated.

David B
www.declude.com 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik
Sent: Wednesday, June 14, 2006 10:00 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test - can I post?

If you have ever "whitelisted" the REVDNS of:   .declude.com  (like it has
been in the past - for several years); you will need to change this.  We had
too.  Before, Declude always had the "correct" REVDNS based on their domain
but since their move to a new location and provider... Their new REVDNS is:
.xiolink.com (nothing relating to Declude or CPHZ.COM)

To me, this is ironic considering that Declude is in the SPAM business
control.  And the .xiolink.com full text lookup returns a dotted/dashed IP
address used by most dialup/residential customers and for most of us; we use
filters and external filters to detect the dotted/dashed IP.  (Full REVDNS
for the current Declude is:   63-246-31-248.xiolink.com ([63.246.31.248]))

Whitelisting based just on a to/from/return address is not enough as these
can be forged.  In the past we used both the to/from/return address AND the
REVDNS as the "whitelisting".

-Erik



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc
Catuogno
Sent: Wednesday, June 14, 2006 3:28 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test - can I post?


Checking to see if I can post...



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test - can I post?

2006-06-14 Thread Erik

If you have ever "whitelisted" the REVDNS of:   .declude.com  (like it has
been in the past - for several years); you will need to change this.  We had
too.  Before, Declude always had the "correct" REVDNS based on their domain
but since their move to a new location and provider... Their new REVDNS is:
.xiolink.com (nothing relating to Declude or CPHZ.COM)

To me, this is ironic considering that Declude is in the SPAM business
control.  And the .xiolink.com full text lookup returns a dotted/dashed IP
address used by most dialup/residential customers and for most of us; we use
filters and external filters to detect the dotted/dashed IP.  (Full REVDNS
for the current Declude is:   63-246-31-248.xiolink.com ([63.246.31.248]))

Whitelisting based just on a to/from/return address is not enough as these
can be forged.  In the past we used both the to/from/return address AND the
REVDNS as the "whitelisting".

-Erik



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc
Catuogno
Sent: Wednesday, June 14, 2006 3:28 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test - can I post?


Checking to see if I can post...



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test

2006-06-13 Thread Kevin Bilbee

Most of the historic traffic had to do with Scott actively participating in the 
list and listing his clients. I have noticed the less Declude participates the 
quieter the list gets.

And Declude has been keeping to them selves as of late.

Kevin Bilbee


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
> Gary Steiner
> Sent: Tuesday, June 13, 2006 12:43 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test
> 
> No.  Most likely it is because declude.junkmail typically experiences a
> lot of traffic, but recently it's been extremely quiet.  I guess some
> folks just got paranoid.
> 
> Instead of posting "test" messages, it would be better if folks asked a
> question or made an appropriate comment to start a thread.
> 
> 
> 
>  Original Message 
> > From: "Arik Keller" <[EMAIL PROTECTED]>
> > Sent: Tuesday, June 13, 2006 2:02 PM
> > To: declude.junkmail@declude.com
> > Subject: RE: [Declude.JunkMail] Test
> >
> > Have we been having problems with this?
> >
> >
> >
> >   _
> >
> > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
> > Shaun Patterson
> > Sent: Tuesday, June 13, 2006 1:50 PM
> > To: declude.junkmail@declude.com
> > Subject: [Declude.JunkMail] Test
> >
> >
> >
> > Another Test to See that the List is working properly.
> >
> >
> >
> >
> >
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
> 





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test

2006-06-13 Thread John T \(Lists\)

Yes Gary, there was (hopefully was not is) a major problem. Many
questions/information was being posted but never showing up. Hopefully that
has been rectified.

John T
eServices For You

"Seek, and ye shall find!"


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary
> Steiner
> Sent: Tuesday, June 13, 2006 12:43 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test
> 
> No.  Most likely it is because declude.junkmail typically experiences a
lot of traffic, but
> recently it's been extremely quiet.  I guess some folks just got paranoid.
> 
> Instead of posting "test" messages, it would be better if folks asked a
question or
> made an appropriate comment to start a thread.
> 
> 
> 
>  Original Message 
> > From: "Arik Keller" <[EMAIL PROTECTED]>
> > Sent: Tuesday, June 13, 2006 2:02 PM
> > To: declude.junkmail@declude.com
> > Subject: RE: [Declude.JunkMail] Test
> >
> > Have we been having problems with this?
> >
> >
> >
> >   _
> >
> > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Shaun
> > Patterson
> > Sent: Tuesday, June 13, 2006 1:50 PM
> > To: declude.junkmail@declude.com
> > Subject: [Declude.JunkMail] Test
> >
> >
> >
> > Another Test to See that the List is working properly.
> >
> >
> >
> >
> >
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test

2006-06-13 Thread Gary Steiner

No.  Most likely it is because declude.junkmail typically experiences a lot of 
traffic, but recently it's been extremely quiet.  I guess some folks just got 
paranoid.

Instead of posting "test" messages, it would be better if folks asked a 
question or made an appropriate comment to start a thread.



 Original Message 
> From: "Arik Keller" <[EMAIL PROTECTED]>
> Sent: Tuesday, June 13, 2006 2:02 PM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Test
> 
> Have we been having problems with this?
> 
>  
> 
>   _  
> 
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Shaun
> Patterson
> Sent: Tuesday, June 13, 2006 1:50 PM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] Test
> 
>  
> 
> Another Test to See that the List is working properly.
> 
>  
> 
> 
>




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test

2006-06-13 Thread Arik Keller









Have we been having problems with this?

 









From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Shaun Patterson
Sent: Tuesday, June 13, 2006 1:50
PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test



 



Another Test to See that the List is working properly.





 








---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.
---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

RE: [Declude.JunkMail] Test

2006-06-13 Thread Arik Keller









y

 









From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Shaun Patterson
Sent: Tuesday, June 13, 2006 1:50
PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test



 



Another Test to See that the List is working properly.





 








---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.
---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

RE: [Declude.JunkMail] Test Message

2006-06-12 Thread Gerry Comeau









yep

 









From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Shaun Patterson
Sent: Monday, June 12, 2006 12:08
PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Test Message



 



This is a Test Message to ensure the lists are working
properly.





 








---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.
---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

Re: [Declude.JunkMail] test order

2005-10-24 Thread Travis Sullivan

I wish one of the guys from declude would chime in.  Well my logs report the 
tests failed in order they were listed in the global.cfg file.  Everytime. 
I moved a few around just to see and they did follow.


But, from what you all said here, that doesn't matter.

Declude folks?

Since external tests create the most load on the system, it would be nice to 
run them last and only if skipifweight hasn't been met.


Travis


- Original Message - 
From: "Scott Fisher" <[EMAIL PROTECTED]>

To: 
Sent: Monday, October 24, 2005 10:28 PM
Subject: Re: [Declude.JunkMail] test order



I think the order is:
ip4r & rhsbl
declude internal
spamdomains
external
ipfile/fromfile
filters

- Original Message - 
From: "Travis Sullivan" <[EMAIL PROTECTED]>

To: 
Sent: Monday, October 24, 2005 9:57 PM
Subject: Re: [Declude.JunkMail] test order


Is it a fact that declude processes in the order the results apear in the 
logs, from left to right?


Thanks,
Travis
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] test order

2005-10-24 Thread Scott Fisher


I think the order is:
ip4r & rhsbl
declude internal
spamdomains
external
ipfile/fromfile
filters

- Original Message - 
From: "Travis Sullivan" <[EMAIL PROTECTED]>

To: 
Sent: Monday, October 24, 2005 9:57 PM
Subject: Re: [Declude.JunkMail] test order


Is it a fact that declude processes in the order the results apear in the 
logs, from left to right?


Thanks,
Travis
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] test order

2005-10-24 Thread Travis Sullivan

Is it a fact that declude processes in the order the results apear in the 
logs, from left to right?


   external tests, ip4, dns, declude app tests, then custom filters 
<


Then, this means the external test of spamc32/spamassassin with the 
skipifweight option is used is meaningless since it is the first test fired.


Only then our custom filters being last make the difference.  Thus, if you 
have a safe-mail filter like I do, crediting points to mail servers 
considered safe, will have little affect if the global.cfg file contains 
stoponfirstdelete.  Thereby forcing wider use of whitelists.


It would be nice if WE had the option of setting the global.cfg in order of 
which WE wanted the tests to fire.


I am sure since I am relatively new at this, someone has said this before.

Travis 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] test order

2005-10-24 Thread Travis Sullivan

Is it a fact that declude processes in the order the results apear in the 
logs, from left to right?


Thanks,
Travis 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] test

2005-07-02 Thread Barry Simpson

It seems to just be very quiet. Happy 4th to everyone

Barry

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Robert
Sent: Saturday, July 02, 2005 8:20 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] test

This is the last message I received.
Something going on?


- Original Message - 
From: Matt <[EMAIL PROTECTED]>
To: 
Sent: Wednesday, June 29, 2005 5:57 PM
Subject: Re: [Declude.JunkMail] OT: Free Microsoft telephone support code


> It's been taken.
> 
> Matt
> 
> 
> 
> Matt wrote:
> 
> > I have a card that give me one free telephone support incident with 
> > Microsoft, but it expires tomorrow and I have no use for it currently 
> > (I should have posted this earlier).  If anyone has use for this and 
> > could use it by 6 p.m. EST tomorrow, I can E-mail the code to you.  
> > This is free to anyone on a first come first serve basis.  E-mail me 
> > off-list to request the code.  When and if someone has claimed it I 
> > will post a follow up to this list.
> >
> > Matt
> >
> 
> -- 
> =
> MailPure custom filters for Declude JunkMail Pro.
> http://www.mailpure.com/software/
> =
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] test

2005-07-02 Thread John Tolmachoff \(Lists\)

FYI, I will be around off and on Saturday and Monday.

Unless something major happens, it usually gets quite right before a holiday
and through it.

John T
eServices For You


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Robert
> Sent: Saturday, July 02, 2005 10:23 AM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] test
> 
> thanks for the reply.
> 
> 
> Robert
> 
> - Original Message -
> From: Darrell ([EMAIL PROTECTED]) <[EMAIL PROTECTED]>
> To: 
> Sent: Saturday, July 02, 2005 9:40 AM
> Subject: Re: [Declude.JunkMail] test
> 
> 
> > No, its just been unusually quiet or we both have problems :)
> >
> > Darrell
> >  --
> > DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus.  Try
> it
> > today - http://www.invariantsystems.com
> >
> > Robert writes:
> >
> > > This is the last message I received.
> > > Something going on?
> > >
> > >
> > > - Original Message -
> > > From: Matt <[EMAIL PROTECTED]>
> > > To: 
> > > Sent: Wednesday, June 29, 2005 5:57 PM
> > > Subject: Re: [Declude.JunkMail] OT: Free Microsoft telephone support
> code
> > >
> > >
> > >> It's been taken.
> > >>
> > >> Matt
> > >>
> > >>
> > >>
> > >> Matt wrote:
> > >>
> > >> > I have a card that give me one free telephone support incident with
> > >> > Microsoft, but it expires tomorrow and I have no use for it
currently
> > >> > (I should have posted this earlier).  If anyone has use for this
and
> > >> > could use it by 6 p.m. EST tomorrow, I can E-mail the code to you.
> > >> > This is free to anyone on a first come first serve basis.  E-mail
me
> > >> > off-list to request the code.  When and if someone has claimed it I
> > >> > will post a follow up to this list.
> > >> >
> > >> > Matt
> > >> >
> > >>
> > >> --
> > >>
> =
> > >> MailPure custom filters for Declude JunkMail Pro.
> > >> http://www.mailpure.com/software/
> > >>
> =
> > >>
> > >> ---
> > >> This E-mail came from the Declude.JunkMail mailing list.  To
> > >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > >> type "unsubscribe Declude.JunkMail".  The archives can be found
> > >> at http://www.mail-archive.com.
> > >>
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > at http://www.mail-archive.com.
> >
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] test

2005-07-02 Thread Robert

thanks for the reply.


Robert

- Original Message -
From: Darrell ([EMAIL PROTECTED]) <[EMAIL PROTECTED]>
To: 
Sent: Saturday, July 02, 2005 9:40 AM
Subject: Re: [Declude.JunkMail] test


> No, its just been unusually quiet or we both have problems :)
>
> Darrell
>  --
> DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus.  Try
it
> today - http://www.invariantsystems.com
>
> Robert writes:
>
> > This is the last message I received.
> > Something going on?
> >
> >
> > - Original Message -
> > From: Matt <[EMAIL PROTECTED]>
> > To: 
> > Sent: Wednesday, June 29, 2005 5:57 PM
> > Subject: Re: [Declude.JunkMail] OT: Free Microsoft telephone support
code
> >
> >
> >> It's been taken.
> >>
> >> Matt
> >>
> >>
> >>
> >> Matt wrote:
> >>
> >> > I have a card that give me one free telephone support incident with
> >> > Microsoft, but it expires tomorrow and I have no use for it currently
> >> > (I should have posted this earlier).  If anyone has use for this and
> >> > could use it by 6 p.m. EST tomorrow, I can E-mail the code to you.
> >> > This is free to anyone on a first come first serve basis.  E-mail me
> >> > off-list to request the code.  When and if someone has claimed it I
> >> > will post a follow up to this list.
> >> >
> >> > Matt
> >> >
> >>
> >> --
> >> =
> >> MailPure custom filters for Declude JunkMail Pro.
> >> http://www.mailpure.com/software/
> >> =
> >>
> >> ---
> >> This E-mail came from the Declude.JunkMail mailing list.  To
> >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >> type "unsubscribe Declude.JunkMail".  The archives can be found
> >> at http://www.mail-archive.com.
> >>
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] test

2005-07-02 Thread Darrell \([EMAIL PROTECTED])

No, its just been unusually quiet or we both have problems :) 


Darrell
--
DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus.  Try it 
today - http://www.invariantsystems.com 

Robert writes: 


This is the last message I received.
Something going on? 



- Original Message - 
From: Matt <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, June 29, 2005 5:57 PM
Subject: Re: [Declude.JunkMail] OT: Free Microsoft telephone support code 



It's been taken. 

Matt 

 

Matt wrote: 

> I have a card that give me one free telephone support incident with 
> Microsoft, but it expires tomorrow and I have no use for it currently 
> (I should have posted this earlier).  If anyone has use for this and 
> could use it by 6 p.m. EST tomorrow, I can E-mail the code to you.  
> This is free to anyone on a first come first serve basis.  E-mail me 
> off-list to request the code.  When and if someone has claimed it I 
> will post a follow up to this list.

>
> Matt
> 


--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
= 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test Order

2005-05-17 Thread Darrell \([EMAIL PROTECTED])

David,

There is no way native to Declude to prevent an external test from running
based on the results of another external test.  The only thing I can think
of is set invURIBL's SKIPWEIGHT value to the weight that Sniffer would have
added.  This will cause invURIBL exit and not process the message.

Darrell

---
DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus.  Try it
today - http://www.invariantsystems.com

- Original Message - 
From: "David Sullivan" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, May 17, 2005 10:31 AM
Subject: [Declude.JunkMail] Test Order


> I know this has been discussed at times before but am not sure of the
> status since the more recent releases. I'm looking at running invURIBL
> but I would like to run it AFTER Sniffer and ONLY if Sniffer didn't
> return a hit. Is this possible?
>
> Also, I have an external test that I want to use to process the
> message (HOLD it or send it back to Imail for delivery) but to do this
> my test would have to be the LAST one called. Is this possible?
>
>
>
> -- 
> Best regards,
>  David  mailto:[EMAIL PROTECTED]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test needed along with sniffer

2004-09-08 Thread Matt





Harry,

I use SURBL myself in addition to 85 other filter files, for a total of
265 KB of filters.  Probably only 20% of them are BODY filter lines
though, and I don't think I have any ANYWHERE filters in use.  I
consider our installation to be heavy, but I have spent a lot of time
making it efficient.

I think what you should do is tier your spam blocking by weight.  We
operate a Hold and a Drop range, and when something hits the Drop
weight we stop processing filters on it.  Over 80% of the spam never
runs our custom filters and that has saved us an enormous amount of CPU
cycles.  You would do this with the SKIPIFWEIGHT setting in the top of
every custom filter file.  We Hold starting at a score of 10 (mostly 13
though) and Drop at a score of 25.  We manage to get 98% of the spam to
land in our Drop range which we don't review at all.  Our false
positive rate in the Drop range is far less than 1 in 10,000, and
typically results from widely blacklisted sources that no one complains
about.  I am only aware of about 3 FP's to land in this range over the
last year.  More importantly, it allows us to focus on the > 2% that
lands in our Hold range where we typically find about 2 to 3 FP's per
100 messages that land in there, though most of that is what we
consider to be legitimate advertising or newsletters from mixed sources.

I highly recommend that you focus on adding SKIPIFWEIGHT to your
filters and tiering your scoring and actions appropriately.  It is
generally safe to toss what scores 3 times your hold weight, though
some filter architectures can enhance false positives and it is
important to limit incidences where the same FP issue can trip multiple
filters.

Matt


Harry Vanderzand wrote:

  Message
  
  
  thank you Matt,
   
  I am running 179i16 so I may have another issue at
hand here
   
  I have 42k myfilter file with every entry set to
anywhere which essentially does a similar thing that surbl is doing.  I
mine the web info from them manually everyday.
   
  I do it on my own account as my account attracts
a tremendous amount of spam I guess because it has been around for 10
years.  Whatever gets through to it after declude has been going into
my filter file
   
  I have surbl running with its 35k file
   
  I have today eliminated my filter file and will
likely eliminate surbl once I get the full version of sniffer going. 
So far I see no more going through as it is likely that surbl has been
better at that process than me.  
   
  I am starting to realize that these body filters
are expensive in cpu cycles
   
  I will share what I learn from all this
   
  I appreciate your assistance.  
  Harry Vanderzand 
  inTown Internet & Computer Services
  
  11 Belmont Ave. W.
  Kitchener, ON
N2M 1L2
519-741-1222
  Did you know we offer: 
- Province wide dial-up and high speed internet access 
- Web accessible email with anti-spam\antivirus protection
- Computer hardware sales and service
- Experienced website developers 
  
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Matt
Sent: Wednesday, September 08, 2004 3:56 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Test needed along with
sniffer


Harry,

Sniffer is a great addition to any Declude setup, however your issues
are not due to just simply the size of your processors.  We run a dual
1 GHz PIII system with RAID 5 and 5x10K Cheetahs, and we've managed to
exceed 90,000 messages a day with dual virus scanners, and we could
handle a bit more still.  My thought is that you are either running a
ton of BODY filters, a very slow virus scanner/scanners, or you are
experiencing some form of I/O limitation.  The idle processes also
suggest that maybe there is an issue and an upgrade to a more recent
version of Declude such as 1.79 or an interim release thereafter would
be a good idea and most around here run them.

You should be able to minimally do 10 times your current volume, so
keep looking and keep describing your environment and a solution will
likely come along.

Matt



Harry Vanderzand wrote:

  I am getting service timeouts due mostly to all the declude instances of
traffic volume

I handle about 2 messages a day, most of them during business hours

I find that I accumulate declude processes that have consumed up to a minute
of cpu time only to be idle and just sit there

This also causes accumulated memory to be consumed

I have been rebooting this server about twice a week

I have also been spending time everyday adding to my filter files 

The server is a dual Xeon 2.4Ghz, 533 frontside bus with an Intel SATA raid
card running Raid 10

It has about 100 small web site that do not get much traffic

My goal is to reduce management time of the machine and to stabilize it so
the need to reboot it is lessened

I am prepared to put in a dual Xeon 3.4GH, etc but also want to make sure
that I d

RE: [Declude.JunkMail] Test needed along with sniffer

2004-09-08 Thread Scott Fisher

I don't know if your filters have a SKIPIFWEIGHT line. You can add a SKIPIFWEIGHT that 
will bypass the filters that enter that filter with a high spam weight. This should 
get you to bypass lots of e-mail. This probably causes me to skip 75-80% of the most 
obvious spam.

I also have a TESTSFAILED END line for items that are psuedo-whitelisted from 
friendlier sites. This probably forces the body filters to be skipped on about 7-8% of 
the mostly non-spam messages.

This leaves the battleground of about 10 to 15% of the messages that need to have body 
filters applied.

I also put my body filters last in the global.cfg. So the quicker 
HELO/MAILFROM/SUBJECT/COUNTRY filters are run first.

Scott Fisher
Director of IT
Farm Progress Companies

>>> [EMAIL PROTECTED] 09/08/04 04:16PM >>>
thank you Matt,
 
I am running 179i16 so I may have another issue at hand here
 
I have 42k myfilter file with every entry set to anywhere which essentially
does a similar thing that surbl is doing.  I mine the web info from them
manually everyday.
 
I do it on my own account as my account attracts a tremendous amount of spam
I guess because it has been around for 10 years.  Whatever gets through to
it after declude has been going into my filter file
 
I have surbl running with its 35k file
 
I have today eliminated my filter file and will likely eliminate surbl once
I get the full version of sniffer going.  So far I see no more going through
as it is likely that surbl has been better at that process than me.  
 
I am starting to realize that these body filters are expensive in cpu cycles
 
I will share what I learn from all this
 
I appreciate your assistance.  

Harry Vanderzand 
inTown Internet & Computer Services 
11 Belmont Ave. W.
Kitchener, ON
N2M 1L2
519-741-1222
Did you know we offer: 
- Province wide dial-up and high speed internet access 
- Web accessible email with anti-spam\antivirus protection
- Computer hardware sales and service
- Experienced website developers 

-Original Message-
From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Wednesday, September 08, 2004 3:56 PM
To: [EMAIL PROTECTED] 
Subject: Re: [Declude.JunkMail] Test needed along with sniffer


Harry,

Sniffer is a great addition to any Declude setup, however your issues are
not due to just simply the size of your processors.  We run a dual 1 GHz
PIII system with RAID 5 and 5x10K Cheetahs, and we've managed to exceed
90,000 messages a day with dual virus scanners, and we could handle a bit
more still.  My thought is that you are either running a ton of BODY
filters, a very slow virus scanner/scanners, or you are experiencing some
form of I/O limitation.  The idle processes also suggest that maybe there is
an issue and an upgrade to a more recent version of Declude such as 1.79 or
an interim release thereafter would be a good idea and most around here run
them.

You should be able to minimally do 10 times your current volume, so keep
looking and keep describing your environment and a solution will likely come
along.

Matt



Harry Vanderzand wrote:


I am getting service timeouts due mostly to all the declude instances of

traffic volume



I handle about 2 messages a day, most of them during business hours



I find that I accumulate declude processes that have consumed up to a minute

of cpu time only to be idle and just sit there



This also causes accumulated memory to be consumed



I have been rebooting this server about twice a week



I have also been spending time everyday adding to my filter files 



The server is a dual Xeon 2.4Ghz, 533 frontside bus with an Intel SATA raid

card running Raid 10



It has about 100 small web site that do not get much traffic



My goal is to reduce management time of the machine and to stabilize it so

the need to reboot it is lessened



I am prepared to put in a dual Xeon 3.4GH, etc but also want to make sure

that I do not overkill



Harry Vanderzand 

inTown Internet & Computer Services 

11 Belmont Ave. W.

Kitchener, ON

N2M 1L2

519-741-1222

Did you know we offer: 

- Province wide dial-up and high speed internet access 

- Web accessible email with anti-spam\antivirus protection

- Computer hardware sales and service

- Experienced website developers 







  

-Original Message-

From: [EMAIL PROTECTED] 

[mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler

Sent: Wednesday, September 08, 2004 11:22 AM

To: [EMAIL PROTECTED] 

Subject: RE: [Declude.JunkMail] Test needed along with sniffer









I am testing sniffer right now and wonder if I need to run

all the other tests along side it.



I am trying to reduce my daily workload of analyzing the

"spamtrap" and hope that sniffer and surbl will do this.



Do I even need surbl?

  

Do you have so much workload on your mailserver that you need 

to downsize your spam-filter to one or two tests?



Maybe http://www2.spamchk.com/p

RE: [Declude.JunkMail] Test needed along with sniffer

2004-09-08 Thread Harry Vanderzand

Thank you, I will try the report out.



> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of support
> Sent: Wednesday, September 08, 2004 4:06 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Test needed along with sniffer
> 
> 
> Harry, 
> 
> We have a utility to let you know how well a specific test 
> does in our log 
> parser (DLAnalyzer).  The test is called the "Test Breakdown Summary 
> Report".  Essentially you can pick a certain test(s) and see 
> which other 
> tests fail along with them.  This report has helped us 
> eliminate tests that 
> performed the same as other tests. 
> 
> For example you can configure the report to summarize 
> messages that failed 
> "Sniffer".  It will than show you what other tests failed on 
> messages that 
> also failed Sniffer.  You can get more granular by even 
> excluding tests.  
> For example: Show me which tests were triggered in 
> conjunction with Sniffer, 
> but did not fail "XBL". 
> 
> Below is the link for a sample output from this report. 
> http://www.invariantsystems.com/dlanalyzer/testsamples/TestSum
> maryBreakdownR 
> eport.html 
> 
> In the above report you can see that out of all messages that 
> failed the 
> weight30 test 85% of them also failed SPAMCOP and 63% failed XBL.. 
> 
> Darrell 
> 
>  
> --
> --
> Check out http://www.invariantsystems.com for utilities for 
> Declude And 
> Imail.  IMail/Declude Overflow Queue Monitoring, MRTG 
> Integration, and Log 
> Parsers. 
> 
> 
> Harry Vanderzand writes: 
> 
> > I am testing sniffer right now and wonder if I need to run all the 
> > other tests along side it.
> > 
> > I am trying to reduce my daily workload of analyzing the "spamtrap" 
> > and hope that sniffer and surbl will do this.
> > 
> > Do I even need surbl?
> > 
> > Any advice in this matter would be greatly appreciated.
> > 
> > Thanks in advance
> > 
> > Harry Vanderzand
> > inTown Internet & Computer Services  
> > 
> > 
> > ---
> > [This E-mail was scanned for viruses by Declude Virus 
> > (http://www.declude.com)]
> > 
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To 
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> > "unsubscribe Declude.JunkMail".  The archives can be found at 
> > http://www.mail-archive.com.
>  
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 
> 


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test needed along with sniffer

2004-09-08 Thread Harry Vanderzand

Thank you very much.

I will absorb this and share what I learn


> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil
> Sent: Wednesday, September 08, 2004 2:00 PM
> To: Harry Vanderzand
> Cc: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Test needed along with sniffer
> 
> 
> On Wednesday, September 8, 2004, 11:13:18 AM, Harry wrote:
> 
> HV> I am testing sniffer right now and wonder if I need to 
> run all the 
> HV> other tests along side it.
> 
> Well, you can probably get by without the other tests, but 
> since you have Declude it would be MUCH better if you keep 
> the other tests in place. Declude's strength is that it 
> allows you to aggregate a variety of tests for greater 
> accuracy. Sniffer is very, very good, but you will certainly 
> see some benefit by using it along with other tests.
> 
> HV> I am trying to reduce my daily workload of analyzing the 
> "spamtrap" 
> HV> and hope that sniffer and surbl will do this.
> 
> Sniffer is perfect for that - particularly if you share your 
> spamtrap data with us. Put another way, if you allow us to 
> use your spamtrap then we will be taking over this work for 
> you. All we need is POP3 account information and some details 
> on how your spamtrap was formed so that we can properly 
> classify it in our SPHUD (Spam Processing Heads Up Display).
> 
> HV> Do I even need surbl?
> 
> Probably not. One of the AI elements in our robots 
> crossreferences incoming spamtrap data with SURBL and other 
> tests. More often than not we have the domain tagged before 
> we see it in SURBL, and if we don't we grab it quickly.
> 
> HV> Any advice in this matter would be greatly appreciated.
> 
> I recommend reviewing the Spam Test Quality Analysis:
> 
> <http://www2.spamchk.com/public.html>
> 
> You can use this to help tune your Declude configuration. I 
> recommend applying the forumula:
> 
> W = (a^2)100
> 
> Where (W) is the individual test weight (magnitude) based on 
> test accuracy and (a) is the accuracy measured in the 
> analysis (SA = spam-test accuracy, HA = ham-test accuracy). [ 
> Regarding (magnitude), ham tests generate negative weights 
> and spam tests generate positive weights. W will always be a 
> positive value, so if you use an HA value for (a) then you 
> will want to apply a negative W as your weight in Declude. ]
> 
> For example,
> 
>   SNIFFER SA = 0.95, so W = ((0.95)^2)*100 = 90.25, Weight = 90.
> 
>   FIVETEN-SRC SA = 0.59, so W = ((0.59)^2)*100 = 34.81, Weight = 35.
> 
>   NOLEGITCONTENT HA=0.38, so
> W = ((0.38)^2)*100 = 14.44, Weight = -14
> 
> -- This test is measured when the test does not fail, so -14
>must go in second weight column, not the first.
> 
> If you use this analysis you should have your "hold weight" 
> at or about 100. If you set your hold weight lower than 100, 
> you will capture more spam at the risk of more false 
> positives. If you set your hold weight higher than 100 you 
> will have fewer false positives and more spam.
> 
> !! This is research in progress - these formulas appear to 
> work very well in preliminary testing. If you are already 
> happy with your weighting system then you should probably 
> stick with that until this theory has been tested further. !!
>
> We are developing a utility to do this work automatically.
> In the mean time, you can go through your test weights 
> manually. You shouldn't have to do this frequently.
> 
> Hope this helps,
> _M
> 
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test needed along with sniffer

2004-09-08 Thread Harry Vanderzand

Title: Message



thank 
you Matt,
 
I am 
running 179i16 so I may have another issue at hand 
here
 
I have 
42k myfilter file with every entry set to anywhere which essentially does a 
similar thing that surbl is doing.  I mine the web info from them manually 
everyday.
 
I do 
it on my own account as my account attracts a tremendous amount of spam I guess 
because it has been around for 10 years.  Whatever gets through to it after 
declude has been going into my filter file
 
I have 
surbl running with its 35k file
 
I have 
today eliminated my filter file and will likely eliminate surbl once I get the 
full version of sniffer going.  So far I see no more going through as it is 
likely that surbl has been better at that process than me.  

 
I am 
starting to realize that these body filters are expensive in cpu 
cycles
 
I will 
share what I learn from all this
 
I 
appreciate your assistance.  
Harry Vanderzand inTown Internet & Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2519-741-1222Did you know we offer: - Province wide dial-up and high 
speed internet access - Web accessible email with anti-spam\antivirus 
protection- Computer hardware sales and service- Experienced website 
developers 

  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of MattSent: Wednesday, September 08, 2004 3:56 
  PMTo: [EMAIL PROTECTED]Subject: Re: 
  [Declude.JunkMail] Test needed along with 
  snifferHarry,Sniffer is a great addition to any 
  Declude setup, however your issues are not due to just simply the size of your 
  processors.  We run a dual 1 GHz PIII system with RAID 5 and 5x10K 
  Cheetahs, and we've managed to exceed 90,000 messages a day with dual virus 
  scanners, and we could handle a bit more still.  My thought is that you 
  are either running a ton of BODY filters, a very slow virus scanner/scanners, 
  or you are experiencing some form of I/O limitation.  The idle processes 
  also suggest that maybe there is an issue and an upgrade to a more recent 
  version of Declude such as 1.79 or an interim release thereafter would be a 
  good idea and most around here run them.You should be able to 
  minimally do 10 times your current volume, so keep looking and keep describing 
  your environment and a solution will likely come 
  along.MattHarry Vanderzand wrote:
  I am getting service timeouts due mostly to all the declude instances of
traffic volume

I handle about 2 messages a day, most of them during business hours

I find that I accumulate declude processes that have consumed up to a minute
of cpu time only to be idle and just sit there

This also causes accumulated memory to be consumed

I have been rebooting this server about twice a week

I have also been spending time everyday adding to my filter files 

The server is a dual Xeon 2.4Ghz, 533 frontside bus with an Intel SATA raid
card running Raid 10

It has about 100 small web site that do not get much traffic

My goal is to reduce management time of the machine and to stabilize it so
the need to reboot it is lessened

I am prepared to put in a dual Xeon 3.4GH, etc but also want to make sure
that I do not overkill

Harry Vanderzand 
inTown Internet & Computer Services 
11 Belmont Ave. W.
Kitchener, ON
N2M 1L2
519-741-1222
Did you know we offer: 
- Province wide dial-up and high speed internet access 
- Web accessible email with anti-spam\antivirus protection
- Computer hardware sales and service
- Experienced website developers 



  
-Original Message-
From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]] On Behalf Of Markus Gufler
Sent: Wednesday, September 08, 2004 11:22 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Test needed along with sniffer




  I am testing sniffer right now and wonder if I need to run
all the other tests along side it.

I am trying to reduce my daily workload of analyzing the
"spamtrap" and hope that sniffer and surbl will do this.

Do I even need surbl?
  Do you have so much workload on your mailserver that you need 
to downsize your spam-filter to one or two tests?

Maybe http://www2.spamchk.com/public.htm will give you some answer.

Markus


---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
type "unsubscribe Declude.JunkMail".  The archives can be 
found at http://www.mail-archive.com.




---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Test needed along with sniffer

2004-09-08 Thread support

Harry, 

We have a utility to let you know how well a specific test does in our log 
parser (DLAnalyzer).  The test is called the "Test Breakdown Summary 
Report".  Essentially you can pick a certain test(s) and see which other 
tests fail along with them.  This report has helped us eliminate tests that 
performed the same as other tests. 

For example you can configure the report to summarize messages that failed 
"Sniffer".  It will than show you what other tests failed on messages that 
also failed Sniffer.  You can get more granular by even excluding tests.  
For example: Show me which tests were triggered in conjunction with Sniffer, 
but did not fail "XBL". 

Below is the link for a sample output from this report.
http://www.invariantsystems.com/dlanalyzer/testsamples/TestSummaryBreakdownR 
eport.html 

In the above report you can see that out of all messages that failed the 
weight30 test 85% of them also failed SPAMCOP and 63% failed XBL.. 

Darrell 


Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log 
Parsers. 

Harry Vanderzand writes: 

I am testing sniffer right now and wonder if I need to run all the other
tests along side it. 

I am trying to reduce my daily workload of analyzing the "spamtrap" and hope
that sniffer and surbl will do this. 

Do I even need surbl? 

Any advice in this matter would be greatly appreciated. 

Thanks in advance  

Harry Vanderzand 
inTown Internet & Computer Services  

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test needed along with sniffer

2004-09-08 Thread Matt





Harry,

Sniffer is a great addition to any Declude setup, however your issues
are not due to just simply the size of your processors.  We run a dual
1 GHz PIII system with RAID 5 and 5x10K Cheetahs, and we've managed to
exceed 90,000 messages a day with dual virus scanners, and we could
handle a bit more still.  My thought is that you are either running a
ton of BODY filters, a very slow virus scanner/scanners, or you are
experiencing some form of I/O limitation.  The idle processes also
suggest that maybe there is an issue and an upgrade to a more recent
version of Declude such as 1.79 or an interim release thereafter would
be a good idea and most around here run them.

You should be able to minimally do 10 times your current volume, so
keep looking and keep describing your environment and a solution will
likely come along.

Matt



Harry Vanderzand wrote:

  I am getting service timeouts due mostly to all the declude instances of
traffic volume

I handle about 2 messages a day, most of them during business hours

I find that I accumulate declude processes that have consumed up to a minute
of cpu time only to be idle and just sit there

This also causes accumulated memory to be consumed

I have been rebooting this server about twice a week

I have also been spending time everyday adding to my filter files 

The server is a dual Xeon 2.4Ghz, 533 frontside bus with an Intel SATA raid
card running Raid 10

It has about 100 small web site that do not get much traffic

My goal is to reduce management time of the machine and to stabilize it so
the need to reboot it is lessened

I am prepared to put in a dual Xeon 3.4GH, etc but also want to make sure
that I do not overkill

Harry Vanderzand 
inTown Internet & Computer Services 
11 Belmont Ave. W.
Kitchener, ON
N2M 1L2
519-741-1222
Did you know we offer: 
- Province wide dial-up and high speed internet access 
- Web accessible email with anti-spam\antivirus protection
- Computer hardware sales and service
- Experienced website developers 



  
  
-Original Message-
From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]] On Behalf Of Markus Gufler
Sent: Wednesday, September 08, 2004 11:22 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Test needed along with sniffer





  I am testing sniffer right now and wonder if I need to run
all the other tests along side it.

I am trying to reduce my daily workload of analyzing the
"spamtrap" and hope that sniffer and surbl will do this.

Do I even need surbl?
  

Do you have so much workload on your mailserver that you need 
to downsize your spam-filter to one or two tests?

Maybe http://www2.spamchk.com/public.htm will give you some answer.

Markus


---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
type "unsubscribe Declude.JunkMail".  The archives can be 
found at http://www.mail-archive.com.



  
  

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Test needed along with sniffer

2004-09-08 Thread Pete McNeil

On Wednesday, September 8, 2004, 11:13:18 AM, Harry wrote:

HV> I am testing sniffer right now and wonder if I need to run all the other
HV> tests along side it.

Well, you can probably get by without the other tests, but since
you have Declude it would be MUCH better if you keep the other tests
in place. Declude's strength is that it allows you to aggregate a
variety of tests for greater accuracy. Sniffer is very, very good, but
you will certainly see some benefit by using it along with other
tests.

HV> I am trying to reduce my daily workload of analyzing the "spamtrap" and hope
HV> that sniffer and surbl will do this.

Sniffer is perfect for that - particularly if you share your spamtrap
data with us. Put another way, if you allow us to use your spamtrap
then we will be taking over this work for you. All we need is POP3
account information and some details on how your spamtrap was formed
so that we can properly classify it in our SPHUD (Spam Processing Heads Up
Display).

HV> Do I even need surbl?

Probably not. One of the AI elements in our robots crossreferences
incoming spamtrap data with SURBL and other tests. More often than not
we have the domain tagged before we see it in SURBL, and if we don't
we grab it quickly.

HV> Any advice in this matter would be greatly appreciated.

I recommend reviewing the Spam Test Quality Analysis:



You can use this to help tune your Declude configuration. I recommend
applying the forumula:

W = (a^2)100

Where (W) is the individual test weight (magnitude) based on test
accuracy and (a) is the accuracy measured in the analysis (SA =
spam-test accuracy, HA = ham-test accuracy). [ Regarding (magnitude),
ham tests generate negative weights and spam tests generate positive
weights. W will always be a positive value, so if you use an HA value
for (a) then you will want to apply a negative W as your weight in
Declude. ]

For example,

  SNIFFER SA = 0.95, so W = ((0.95)^2)*100 = 90.25, Weight = 90.

  FIVETEN-SRC SA = 0.59, so W = ((0.59)^2)*100 = 34.81, Weight = 35.

  NOLEGITCONTENT HA=0.38, so
W = ((0.38)^2)*100 = 14.44, Weight = -14

-- This test is measured when the test does not fail, so -14
   must go in second weight column, not the first.

If you use this analysis you should have your "hold weight" at or
about 100. If you set your hold weight lower than 100, you will
capture more spam at the risk of more false positives. If you set your
hold weight higher than 100 you will have fewer false positives and
more spam.

!! This is research in progress - these formulas appear to work very
well in preliminary testing. If you are already happy with your
weighting system then you should probably stick with that until this
theory has been tested further. !!
   
We are developing a utility to do this work automatically.
In the mean time, you can go through your test weights manually.
You shouldn't have to do this frequently.

Hope this helps,
_M



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test needed along with sniffer

2004-09-08 Thread Scott Fisher

Sniffer is very good. It detected 47600 out of 49250 spam messages for me through Sept 
1-5.

The SURBL filter contains a lot of body filters and can be CPU intensive.



Scott Fisher
Director of IT
Farm Progress Companies

>>> [EMAIL PROTECTED] 09/08/04 10:13AM >>>
I am testing sniffer right now and wonder if I need to run all the other
tests along side it.

I am trying to reduce my daily workload of analyzing the "spamtrap" and hope
that sniffer and surbl will do this.

Do I even need surbl?

Any advice in this matter would be greatly appreciated.

Thanks in advance 

Harry Vanderzand 
inTown Internet & Computer Services 


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test needed along with sniffer

2004-09-08 Thread Harry Vanderzand

I am getting service timeouts due mostly to all the declude instances of
traffic volume

I handle about 2 messages a day, most of them during business hours

I find that I accumulate declude processes that have consumed up to a minute
of cpu time only to be idle and just sit there

This also causes accumulated memory to be consumed

I have been rebooting this server about twice a week

I have also been spending time everyday adding to my filter files 

The server is a dual Xeon 2.4Ghz, 533 frontside bus with an Intel SATA raid
card running Raid 10

It has about 100 small web site that do not get much traffic

My goal is to reduce management time of the machine and to stabilize it so
the need to reboot it is lessened

I am prepared to put in a dual Xeon 3.4GH, etc but also want to make sure
that I do not overkill

Harry Vanderzand 
inTown Internet & Computer Services 
11 Belmont Ave. W.
Kitchener, ON
N2M 1L2
519-741-1222
Did you know we offer: 
- Province wide dial-up and high speed internet access 
- Web accessible email with anti-spam\antivirus protection
- Computer hardware sales and service
- Experienced website developers 



> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
> Sent: Wednesday, September 08, 2004 11:22 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Test needed along with sniffer
> 
> 
> 
> > I am testing sniffer right now and wonder if I need to run
> > all the other tests along side it.
> > 
> > I am trying to reduce my daily workload of analyzing the
> > "spamtrap" and hope that sniffer and surbl will do this.
> > 
> > Do I even need surbl?
> 
> Do you have so much workload on your mailserver that you need 
> to downsize your spam-filter to one or two tests?
> 
> Maybe http://www2.spamchk.com/public.htm will give you some answer.
> 
> Markus
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 
> 


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test needed along with sniffer

2004-09-08 Thread Markus Gufler


> I am testing sniffer right now and wonder if I need to run 
> all the other tests along side it.
> 
> I am trying to reduce my daily workload of analyzing the 
> "spamtrap" and hope that sniffer and surbl will do this.
> 
> Do I even need surbl?

Do you have so much workload on your mailserver that you need to downsize
your spam-filter to one or two tests?

Maybe http://www2.spamchk.com/public.htm will give you some answer.

Markus


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Matt





In your Global.cfg give it a -1.  In your filter file, set the
MAXWEIGHT to 1 and score each line of the filter as 1 as well.  One hit
will end the filter with a score of 1 and then the -1 from the
Global.cfg will be added to that for a total of 0.

If you set MAXWEIGHT to 0, the filter will always end immediately
because it starts with a score of 0.  Same thing with MINWEIGHT.

Matt



Kevin Bilbee wrote:

  So you are saying in the global.cfg to give the test a -1 and set "MAXWEIGHT
0" in the filter file???


Kevin Bilbee

  
  
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Matt
Sent: Friday, July 09, 2004 11:58 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Test Action Failure


Kevin,

You can accomodate for that by giving it a negative weight in your
Global.cfg.  The total weight is a combination of the two and the
Global.cfg score won't be assessed without a positive hit on a filter
line (END statements don't count).

Matt



Kevin Bilbee wrote:



  A small problem I see with this is  a new test that I do not want to add
weight to.

So I just did a MAXWEIGHT 1 and made each line a weight of 1.

Kevin Bilbee



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Matt
Sent: Friday, July 09, 2004 11:33 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Test Action Failure


Kevin,

Think about using "MAXWEIGHT 10" in the beginning of the file.  This will
end the test immediately when a score of 10 is reached.  This can be an
effective incremental method of saving processing power.  It can also be
redefined so you can have groupings of filter lines at weight
  

10, followed


  by ones at weight 5, etc.

MAXWEIGHT was created for exactly the type of need that you have
  

here, and


  it works well in most cases.

Matt



Kevin Bilbee wrote:

I get it now. But, is there anyway to fail the test and end the
  

test in one


  line instead of two.

For example the way I under stand now it is if you want to short circut a
test you would use END, but this would not fail the test to if
  

you want the


  test to fail you would have to do something like


HEADERS 10 CONTAINS X-Bulk:  99
HEADERS END CONTAINS X-Bulk:  99


This will fail the test and then end the test. But also doubles
  

the lines in


  the test file


How about a line like this


HEADERS ENDWITHFAIL CONTAINS X-Bulk:  99


It would fail the test and end the test and use the weight defined in the
Global.cfg??


Would cause my body filter to be much more efficient by failing
  

the test on


  a match and not continuing to process the whole body filter file.


Kevin Bilbee



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Friday, July 09, 2004 10:06 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Test Action Failure




Can you clarify the END for me?

It ends the processing of the filter.


Would this fail the test if the e-mail came with a revdns of us.info?

revdns 10 contains info

revdns end contains info

mailfrom 10 contains info

In this case, the E-mail would fail the test (the first line fails the
test; the second one causes the test to end).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in
mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus

(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


---
[This E-mail was scanned for viruses by Declude Virus
  

  
  (http://www.declude.com)]
  
  
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





  
  
--

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Scott Fisher

I think you'd want to give the test a -1 in the global.cfg, with a MAXWEIGHT 1 within 
the filter.
So you'd net a 0 then.


Scott Fisher
Director of IT
Farm Progress Companies

>>> [EMAIL PROTECTED] 07/09/04 02:21PM >>>
So you are saying in the global.cfg to give the test a -1 and set "MAXWEIGHT
0" in the filter file???


Kevin Bilbee

> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] Behalf Of Matt
> Sent: Friday, July 09, 2004 11:58 AM
> To: [EMAIL PROTECTED] 
> Subject: Re: [Declude.JunkMail] Test Action Failure
>
>
> Kevin,
>
> You can accomodate for that by giving it a negative weight in your
> Global.cfg.  The total weight is a combination of the two and the
> Global.cfg score won't be assessed without a positive hit on a filter
> line (END statements don't count).
>
> Matt
>
>
>
> Kevin Bilbee wrote:
>
> >A small problem I see with this is  a new test that I do not want to add
> >weight to.
> >
> >So I just did a MAXWEIGHT 1 and made each line a weight of 1.
> >
> >Kevin Bilbee
> >
> >
> >
> >-Original Message-
> >From: [EMAIL PROTECTED] 
> >[mailto:[EMAIL PROTECTED] Behalf Of Matt
> >Sent: Friday, July 09, 2004 11:33 AM
> >To: [EMAIL PROTECTED] 
> >Subject: Re: [Declude.JunkMail] Test Action Failure
> >
> >
> >Kevin,
> >
> >Think about using "MAXWEIGHT 10" in the beginning of the file.  This will
> >end the test immediately when a score of 10 is reached.  This can be an
> >effective incremental method of saving processing power.  It can also be
> >redefined so you can have groupings of filter lines at weight
> 10, followed
> >by ones at weight 5, etc.
> >
> >MAXWEIGHT was created for exactly the type of need that you have
> here, and
> >it works well in most cases.
> >
> >Matt
> >
> >
> >
> >Kevin Bilbee wrote:
> >
> >I get it now. But, is there anyway to fail the test and end the
> test in one
> >line instead of two.
> >
> >For example the way I under stand now it is if you want to short circut a
> >test you would use END, but this would not fail the test to if
> you want the
> >test to fail you would have to do something like
> >
> >
> >HEADERS 10 CONTAINS X-Bulk:  99
> >HEADERS END CONTAINS X-Bulk:  99
> >
> >
> >This will fail the test and then end the test. But also doubles
> the lines in
> >the test file
> >
> >
> >How about a line like this
> >
> >
> >HEADERS ENDWITHFAIL CONTAINS X-Bulk:  99
> >
> >
> >It would fail the test and end the test and use the weight defined in the
> >Global.cfg??
> >
> >
> >Would cause my body filter to be much more efficient by failing
> the test on
> >a match and not continuing to process the whole body filter file.
> >
> >
> >Kevin Bilbee
> >
> >
> >
> >-Original Message-
> >From: [EMAIL PROTECTED] 
> >[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
> >Sent: Friday, July 09, 2004 10:06 AM
> >To: [EMAIL PROTECTED] 
> >Subject: RE: [Declude.JunkMail] Test Action Failure
> >
> >
> >
> >
> >Can you clarify the END for me?
> >
> >It ends the processing of the filter.
> >
> >
> >Would this fail the test if the e-mail came with a revdns of us.info?
> >
> >revdns 10 contains info
> >
> >revdns end contains info
> >
> >mailfrom 10 contains info
> >
> >In this case, the E-mail would fail the test (the first line fails the
> >test; the second one causes the test to end).
> >
> >-Scott
> >---
> >Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> >since 2000.
> >Declude Virus: Ultra reliable virus detection and the leader in
> >mailserver
> >vulnerability detection.
> >Find out what you've been missing: Ask for a free 30-day evaluation.
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >
> >(http://www.declude.com)] 
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
> >
> >
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)] 
> >

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Kevin Bilbee

So you are saying in the global.cfg to give the test a -1 and set "MAXWEIGHT
0" in the filter file???


Kevin Bilbee

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Matt
> Sent: Friday, July 09, 2004 11:58 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Test Action Failure
>
>
> Kevin,
>
> You can accomodate for that by giving it a negative weight in your
> Global.cfg.  The total weight is a combination of the two and the
> Global.cfg score won't be assessed without a positive hit on a filter
> line (END statements don't count).
>
> Matt
>
>
>
> Kevin Bilbee wrote:
>
> >A small problem I see with this is  a new test that I do not want to add
> >weight to.
> >
> >So I just did a MAXWEIGHT 1 and made each line a weight of 1.
> >
> >Kevin Bilbee
> >
> >
> >
> >-Original Message-
> >From: [EMAIL PROTECTED]
> >[mailto:[EMAIL PROTECTED] Behalf Of Matt
> >Sent: Friday, July 09, 2004 11:33 AM
> >To: [EMAIL PROTECTED]
> >Subject: Re: [Declude.JunkMail] Test Action Failure
> >
> >
> >Kevin,
> >
> >Think about using "MAXWEIGHT 10" in the beginning of the file.  This will
> >end the test immediately when a score of 10 is reached.  This can be an
> >effective incremental method of saving processing power.  It can also be
> >redefined so you can have groupings of filter lines at weight
> 10, followed
> >by ones at weight 5, etc.
> >
> >MAXWEIGHT was created for exactly the type of need that you have
> here, and
> >it works well in most cases.
> >
> >Matt
> >
> >
> >
> >Kevin Bilbee wrote:
> >
> >I get it now. But, is there anyway to fail the test and end the
> test in one
> >line instead of two.
> >
> >For example the way I under stand now it is if you want to short circut a
> >test you would use END, but this would not fail the test to if
> you want the
> >test to fail you would have to do something like
> >
> >
> >HEADERS 10 CONTAINS X-Bulk:  99
> >HEADERS END CONTAINS X-Bulk:  99
> >
> >
> >This will fail the test and then end the test. But also doubles
> the lines in
> >the test file
> >
> >
> >How about a line like this
> >
> >
> >HEADERS ENDWITHFAIL CONTAINS X-Bulk:  99
> >
> >
> >It would fail the test and end the test and use the weight defined in the
> >Global.cfg??
> >
> >
> >Would cause my body filter to be much more efficient by failing
> the test on
> >a match and not continuing to process the whole body filter file.
> >
> >
> >Kevin Bilbee
> >
> >
> >
> >-Original Message-
> >From: [EMAIL PROTECTED]
> >[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
> >Sent: Friday, July 09, 2004 10:06 AM
> >To: [EMAIL PROTECTED]
> >Subject: RE: [Declude.JunkMail] Test Action Failure
> >
> >
> >
> >
> >Can you clarify the END for me?
> >
> >It ends the processing of the filter.
> >
> >
> >Would this fail the test if the e-mail came with a revdns of us.info?
> >
> >revdns 10 contains info
> >
> >revdns end contains info
> >
> >mailfrom 10 contains info
> >
> >In this case, the E-mail would fail the test (the first line fails the
> >test; the second one causes the test to end).
> >
> >-Scott
> >---
> >Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> >since 2000.
> >Declude Virus: Ultra reliable virus detection and the leader in
> >mailserver
> >vulnerability detection.
> >Find out what you've been missing: Ask for a free 30-day evaluation.
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
> >
> >
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://ww

Re: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Matt

Kevin,
You can accomodate for that by giving it a negative weight in your 
Global.cfg.  The total weight is a combination of the two and the 
Global.cfg score won't be assessed without a positive hit on a filter 
line (END statements don't count).

Matt

Kevin Bilbee wrote:
A small problem I see with this is  a new test that I do not want to add
weight to.
So I just did a MAXWEIGHT 1 and made each line a weight of 1.
Kevin Bilbee

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Matt
Sent: Friday, July 09, 2004 11:33 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Test Action Failure
Kevin,
Think about using "MAXWEIGHT 10" in the beginning of the file.  This will
end the test immediately when a score of 10 is reached.  This can be an
effective incremental method of saving processing power.  It can also be
redefined so you can have groupings of filter lines at weight 10, followed
by ones at weight 5, etc.
MAXWEIGHT was created for exactly the type of need that you have here, and
it works well in most cases.
Matt

Kevin Bilbee wrote:
I get it now. But, is there anyway to fail the test and end the test in one
line instead of two.
For example the way I under stand now it is if you want to short circut a
test you would use END, but this would not fail the test to if you want the
test to fail you would have to do something like
HEADERS 10 CONTAINS X-Bulk:  99
HEADERS END CONTAINS X-Bulk:  99
This will fail the test and then end the test. But also doubles the lines in
the test file
How about a line like this
HEADERS ENDWITHFAIL CONTAINS X-Bulk:  99
It would fail the test and end the test and use the weight defined in the
Global.cfg??
Would cause my body filter to be much more efficient by failing the test on
a match and not continuing to process the whole body filter file.
Kevin Bilbee

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Friday, July 09, 2004 10:06 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Test Action Failure

Can you clarify the END for me?
It ends the processing of the filter.
Would this fail the test if the e-mail came with a revdns of us.info?
revdns 10 contains info
revdns end contains info
mailfrom 10 contains info
In this case, the E-mail would fail the test (the first line fails the
test; the second one causes the test to end).
   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in
mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
 

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Kevin Bilbee

A small problem I see with this is  a new test that I do not want to add
weight to.

So I just did a MAXWEIGHT 1 and made each line a weight of 1.

Kevin Bilbee



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Matt
Sent: Friday, July 09, 2004 11:33 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Test Action Failure


Kevin,

Think about using "MAXWEIGHT 10" in the beginning of the file.  This will
end the test immediately when a score of 10 is reached.  This can be an
effective incremental method of saving processing power.  It can also be
redefined so you can have groupings of filter lines at weight 10, followed
by ones at weight 5, etc.

MAXWEIGHT was created for exactly the type of need that you have here, and
it works well in most cases.

Matt



Kevin Bilbee wrote:

I get it now. But, is there anyway to fail the test and end the test in one
line instead of two.

For example the way I under stand now it is if you want to short circut a
test you would use END, but this would not fail the test to if you want the
test to fail you would have to do something like


HEADERS 10 CONTAINS X-Bulk:  99
HEADERS END CONTAINS X-Bulk:  99


This will fail the test and then end the test. But also doubles the lines in
the test file


How about a line like this


HEADERS ENDWITHFAIL CONTAINS X-Bulk:  99


It would fail the test and end the test and use the weight defined in the
Global.cfg??


Would cause my body filter to be much more efficient by failing the test on
a match and not continuing to process the whole body filter file.


Kevin Bilbee



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Friday, July 09, 2004 10:06 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Test Action Failure




Can you clarify the END for me?

It ends the processing of the filter.


Would this fail the test if the e-mail came with a revdns of us.info?

revdns 10 contains info

revdns end contains info

mailfrom 10 contains info

In this case, the E-mail would fail the test (the first line fails the
test; the second one causes the test to end).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in
mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus

(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Kevin Bilbee




OK 
that makes sence. I will try it. thanks Matt
 
 
Kevin 
Bilbee

  -Original Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]On Behalf Of 
  MattSent: Friday, July 09, 2004 11:33 AMTo: 
  [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Test 
  Action FailureKevin,Think about using "MAXWEIGHT 
  10" in the beginning of the file.  This will end the test immediately 
  when a score of 10 is reached.  This can be an effective incremental 
  method of saving processing power.  It can also be redefined so you can 
  have groupings of filter lines at weight 10, followed by ones at weight 5, 
  etc.MAXWEIGHT was created for exactly the type of need that you have 
  here, and it works well in most cases.MattKevin Bilbee 
  wrote:
  I get it now. But, is there anyway to fail the test and end the test in one
line instead of two.

For example the way I under stand now it is if you want to short circut a
test you would use END, but this would not fail the test to if you want the
test to fail you would have to do something like

  
HEADERS 10 CONTAINS X-Bulk:  99
HEADERS END CONTAINS X-Bulk:  99

This will fail the test and then end the test. But also doubles the lines in
the test file


How about a line like this

  
HEADERS ENDWITHFAIL CONTAINS X-Bulk:  99

It would fail the test and end the test and use the weight defined in the
Global.cfg??


Would cause my body filter to be much more efficient by failing the test on
a match and not continuing to process the whole body filter file.


Kevin Bilbee


  
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Friday, July 09, 2004 10:06 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Test Action Failure




  Can you clarify the END for me?
  It ends the processing of the filter.


  Would this fail the test if the e-mail came with a revdns of us.info?

revdns 10 contains info

revdns end contains info

mailfrom 10 contains info
  In this case, the E-mail would fail the test (the first line fails the
test; the second one causes the test to end).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in
mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Matt





Kevin,

Think about using "MAXWEIGHT 10" in the beginning of the file.  This
will end the test immediately when a score of 10 is reached.  This can
be an effective incremental method of saving processing power.  It can
also be redefined so you can have groupings of filter lines at weight
10, followed by ones at weight 5, etc.

MAXWEIGHT was created for exactly the type of need that you have here,
and it works well in most cases.

Matt



Kevin Bilbee wrote:

  I get it now. But, is there anyway to fail the test and end the test in one
line instead of two.

For example the way I under stand now it is if you want to short circut a
test you would use END, but this would not fail the test to if you want the
test to fail you would have to do something like

  
  
HEADERS 10 CONTAINS X-Bulk:  99
HEADERS END CONTAINS X-Bulk:  99

  
  
This will fail the test and then end the test. But also doubles the lines in
the test file


How about a line like this

  
  
HEADERS ENDWITHFAIL CONTAINS X-Bulk:  99

  
  
It would fail the test and end the test and use the weight defined in the
Global.cfg??


Would cause my body filter to be much more efficient by failing the test on
a match and not continuing to process the whole body filter file.


Kevin Bilbee


  
  
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Friday, July 09, 2004 10:06 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Test Action Failure





  Can you clarify the END for me?
  

It ends the processing of the filter.



  Would this fail the test if the e-mail came with a revdns of us.info?

revdns 10 contains info

revdns end contains info

mailfrom 10 contains info
  

In this case, the E-mail would fail the test (the first line fails the
test; the second one causes the test to end).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in
mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus

  
  (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Kevin Bilbee

I get it now. But, is there anyway to fail the test and end the test in one
line instead of two.

For example the way I under stand now it is if you want to short circut a
test you would use END, but this would not fail the test to if you want the
test to fail you would have to do something like

>HEADERS 10 CONTAINS X-Bulk:  99
>HEADERS END CONTAINS X-Bulk:  99

This will fail the test and then end the test. But also doubles the lines in
the test file


How about a line like this

>HEADERS ENDWITHFAIL CONTAINS X-Bulk:  99

It would fail the test and end the test and use the weight defined in the
Global.cfg??


Would cause my body filter to be much more efficient by failing the test on
a match and not continuing to process the whole body filter file.


Kevin Bilbee


> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
> Sent: Friday, July 09, 2004 10:06 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Test Action Failure
>
>
>
> >Can you clarify the END for me?
>
> It ends the processing of the filter.
>
> >Would this fail the test if the e-mail came with a revdns of us.info?
> >
> >revdns 10 contains info
> >
> >revdns end contains info
> >
> >mailfrom 10 contains info
>
> In this case, the E-mail would fail the test (the first line fails the
> test; the second one causes the test to end).
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in
> mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread R. Scott Perry


Can you clarify the END for me?
It ends the processing of the filter.
Would this fail the test if the e-mail came with a revdns of us.info?
revdns 10 contains info
revdns end contains info
mailfrom 10 contains info
In this case, the E-mail would fail the test (the first line fails the 
test; the second one causes the test to end).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Scott Fisher

-Scott
Can you clarify the END for me?

Would this fail the test if the e-mail came with a revdns of us.info?

revdns 10 contains info

revdns end contains info

mailfrom 10 contains info





Scott Fisher
Director of IT
Farm Progress Companies

>>> [EMAIL PROTECTED] 07/09/04 11:44AM >>>

>OK why then the
>07/09/2004 00:15:58 Q462a09e900349a60 Triggered CONTAINS filter SAVFILTER on
>X-Bulk:  99 [weight->0; X-Bulk:  99

Because a line in the filter matched.  But:

>here are the contents of the sav-smtp.txt that did not work, why?
>HEADERS END CONTAINS X-Bulk:  99
>HEADERS END CONTAINS X-Bulk:  98
...

>and here are my modified lines that do work, I changed this last night and
>route to now works
>HEADERS 0 CONTAINS X-Bulk:  99
>HEADERS 0 CONTAINS X-Bulk:  98
...

When Declude JunkMail encounters "END" in a filter, it does *not* fail the 
test.  Why?  Because it was designed to be used in a case like this:

 TESTSFAILED END CONTAINSAWESOMETEST
 ...

In this case, you want to skip the filter if the AWESOMETEST test failed 
(since you are positive the E-mail is spam, and don't want the rest of the 
filter to run).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread R. Scott Perry


OK why then the
07/09/2004 00:15:58 Q462a09e900349a60 Triggered CONTAINS filter SAVFILTER on
X-Bulk:  99 [weight->0; X-Bulk:  99
Because a line in the filter matched.  But:
here are the contents of the sav-smtp.txt that did not work, why?
HEADERS END CONTAINS X-Bulk:  99
HEADERS END CONTAINS X-Bulk:  98
...
and here are my modified lines that do work, I changed this last night and
route to now works
HEADERS 0 CONTAINS X-Bulk:  99
HEADERS 0 CONTAINS X-Bulk:  98
...
When Declude JunkMail encounters "END" in a filter, it does *not* fail the 
test.  Why?  Because it was designed to be used in a case like this:

TESTSFAILED END CONTAINSAWESOMETEST
...
In this case, you want to skip the filter if the AWESOMETEST test failed 
(since you are positive the E-mail is spam, and don't want the rest of the 
filter to run).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Kevin Bilbee

OK why then the
07/09/2004 00:15:58 Q462a09e900349a60 Triggered CONTAINS filter SAVFILTER on
X-Bulk:  99 [weight->0; X-Bulk:  99

here are the contents of the sav-smtp.txt that did not work, why?
HEADERS END CONTAINS X-Bulk:  99
HEADERS END CONTAINS X-Bulk:  98
HEADERS END CONTAINS X-Bulk:  97
HEADERS END CONTAINS X-Bulk:  96
HEADERS END CONTAINS X-Bulk:  95
HEADERS END CONTAINS X-Bulk:  94
HEADERS END CONTAINS X-Bulk:  93
HEADERS END CONTAINS X-Bulk:  92
HEADERS END CONTAINS X-Bulk:  91


and here are my modified lines that do work, I changed this last night and
route to now works
HEADERS 0 CONTAINS X-Bulk:  99
HEADERS 0 CONTAINS X-Bulk:  98
HEADERS 0 CONTAINS X-Bulk:  97
HEADERS 0 CONTAINS X-Bulk:  96
HEADERS 0 CONTAINS X-Bulk:  95
HEADERS 0 CONTAINS X-Bulk:  94
HEADERS 0 CONTAINS X-Bulk:  93
HEADERS 0 CONTAINS X-Bulk:  92
HEADERS 0 CONTAINS X-Bulk:  91

Log from a message that has the message failed line
07/09/2004 02:23:13 Q6400122200f49c21 Triggered CONTAINS filter SAVFILTER on
X-Bulk:  99 [weight->0; X-Bulk:  99
07/09/2004 02:23:14 Q6400122200f49c21 DSBL:6 CBL:8 ROUTING:4
CIP-LeadingTextMatch:5 .  Total weight = 23.
07/09/2004 02:23:14 Q6400122200f49c21 Msg failed DSBL
("http://dsbl.org/listing?ip=218.255.207.94";). Action=IGNORE.
07/09/2004 02:23:14 Q6400122200f49c21 Msg failed CBL ("Blocked - see
http://cbl.abuseat.org/lookup.cgi?ip=218.255.207.94";). Action=IGNORE.
07/09/2004 02:23:14 Q6400122200f49c21 Msg failed ROUTING (This E-mail was
routed in a poor manner consistent with spam [210f].). Action=IGNORE.
07/09/2004 02:23:14 Q6400122200f49c21 Msg failed CIP-LeadingTextMatch
(Message failed CIP-LeadingTextMatch: 13.). Action=IGNORE.
07/09/2004 02:23:14 Q6400122200f49c21 Msg failed SPAM-MED (Total weight
between 14 and 24.). Action=IGNORE.
07/09/2004 02:23:14 Q6400122200f49c21 R1 Message OK
07/09/2004 02:23:14 Q6400122200f49c21 Subject:  noticeable
07/09/2004 02:23:14 Q6400122200f49c21 From: [EMAIL PROTECTED]
To:  IP: 218.255.207.94 ID: M2004070902153414397 07/09/2004 02:23:14
Q6400122200f49c21 Tests failed [weight=23]: DSBL=IGNORE CBL=IGNORE
IPNOTINMX=IGNORE ROUTING=IGNORE SAVFILTER=IGNORE CIP-LeadingTextMatch=IGNORE
SPAM-MED=IGNORE
07/09/2004 02:23:14 Q6400122200f49c21 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/09/2004 02:23:14 Q6400122200f49c21 Redirecting
[EMAIL PROTECTED] to file
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/09/2004 02:23:14 Q6400122200f49c21 Msg failed DSBL
("http://dsbl.org/listing?ip=218.255.207.94";). Action=WARN.
07/09/2004 02:23:14 Q6400122200f49c21 Msg failed CBL ("Blocked - see
http://cbl.abuseat.org/lookup.cgi?ip=218.255.207.94";). Action=WARN.
07/09/2004 02:23:14 Q6400122200f49c21 Msg failed ROUTING (This E-mail was
routed in a poor manner consistent with spam [210f].). Action=WARN.
07/09/2004 02:23:14 Q6400122200f49c21 Msg failed SAVFILTER (Message failed
SAVFILTER test (line 1, weight 0)). Action=ROUTETO.
07/09/2004 02:23:14 Q6400122200f49c21 Msg failed CIP-LeadingTextMatch
(Message failed CIP-LeadingTextMatch: 13.). Action=WARN.
07/09/2004 02:23:14 Q6400122200f49c21 Msg failed SPAM-MED (Total weight
between 14 and 24.). Action=HOLD.
07/09/2004 02:23:14 Q6400122200f49c21 Subject:  noticeable
07/09/2004 02:23:14 Q6400122200f49c21 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]  IP: 218.255.207.94 ID:
M2004070902153414397 07/09/2004 02:23:14 Q6400122200f49c21 Tests failed
[weight=23]: DSBL=WARN CBL=WARN IPNOTINMX=IGNORE ROUTING=WARN
SAVFILTER=ROUTETO CIP-LeadingTextMatch=WARN SPAM-MED=HOLD
07/09/2004 02:23:14 Q6400122200f49c21 Last action = HOLD.



So I guess my new question would be why can a message trigger a test but not
fail a test using END and how do I use end where the test is triggered and
fails?


Kevin Bilbee


> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
> Sent: Friday, July 09, 2004 4:11 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Test Action Failure
>
>
>
> >Why did this not ROUTETO
> ...
> >The test trigered the Contains for the SAVFILTER but SAVFILTER
> does not show
> >up in the Tests Failed Section
>
> Well, there is a very clear answer to your question -- Declude
> JunkMail did
> not use the ROUTETO action for the SAVFILTER test because the E-mail did
> not fail the SAVFILTER test.
>
> I'm guessing, though, that you will want the answer to the next
> question --
> "Why didn't this E-mail fail the SAVFILTER test?".  The key to answering
> that would be the contents of the sav-smtp.txt file, which I
> believe have a
> line in there that is preventing the test from failing in this case.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> De

Re: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread R. Scott Perry


Why did this not ROUTETO
...
The test trigered the Contains for the SAVFILTER but SAVFILTER does not show
up in the Tests Failed Section
Well, there is a very clear answer to your question -- Declude JunkMail did 
not use the ROUTETO action for the SAVFILTER test because the E-mail did 
not fail the SAVFILTER test.

I'm guessing, though, that you will want the answer to the next question -- 
"Why didn't this E-mail fail the SAVFILTER test?".  The key to answering 
that would be the contents of the sav-smtp.txt file, which I believe have a 
line in there that is preventing the test from failing in this case.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test failed..what is nALLOW

2004-07-08 Thread Matt Goodhue

Yes I do have an test called allow that was setup with the -100 in the
wrong column.

Thanks for the explanation that makes sense now.

Matt


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Thursday, July 08, 2004 4:16 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Test failed..what is nALLOW

Do you have a test called ALLOW that uses a not failed weight (a value
in the last column)?
If so, these will get a small n prepended to the test name in the logs.

For example an e-mail that does not fail.
NOLEGITCONTENT  nolegitcontent  x   x   0   -20
will show up in the logs as nNOLEGITCONTENT



Scott Fisher
Director of IT
Farm Progress Companies

>>> [EMAIL PROTECTED] 07/08/04 02:55PM >>>
I have been going through my Declude logs and I see where it tells me
what tests have failed and the weight that was assigned to that
particular message.  What is this nALLOW and where does it come from?

 

Here is the test failed line from my log:

 

SBL-XBL:70 DSBL:60 SPAMCOP:60 BADHEADERS:90 SPAMHEADERS:40
FIVETEN-SPAM:50 nALLOW:-100 SPAMCHK:4 .  Total weight = 274

 

Thanks.
Matt


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test failed..what is nALLOW

2004-07-08 Thread Scott Fisher

Do you have a test called ALLOW that uses a not failed weight (a value in the last 
column)?
If so, these will get a small n prepended to the test name in the logs.

For example an e-mail that does not fail.
NOLEGITCONTENT  nolegitcontent  x   x   0   -20
will show up in the logs as nNOLEGITCONTENT



Scott Fisher
Director of IT
Farm Progress Companies

>>> [EMAIL PROTECTED] 07/08/04 02:55PM >>>
I have been going through my Declude logs and I see where it tells me
what tests have failed and the weight that was assigned to that
particular message.  What is this nALLOW and where does it come from?

 

Here is the test failed line from my log:

 

SBL-XBL:70 DSBL:60 SPAMCOP:60 BADHEADERS:90 SPAMHEADERS:40
FIVETEN-SPAM:50 nALLOW:-100 SPAMCHK:4 .  Total weight = 274

 

Thanks.
Matt


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test

2004-04-11 Thread Jeff Kratka

Yep same here. It's a never ending battle.

Jeff Kratka

-- Original Message --
From: "Jeff Maze - Hostmaster" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date: Sun, 11 Apr 2004 10:39:20 -0400

>Ok.. Got it back..  I guess just not a lot going on..
>
>But have noticed an INFLUX of spam messages lately..  A lot not being caught
>by the filters but also a lot being caught.. 
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze -
>Hostmaster
>Sent: Sunday, April 11, 2004 10:32 AM
>To: [EMAIL PROTECTED]
>Subject: [Declude.JunkMail] Test
>
>Haven't received messages from here nor Declude.Virus since Friday.. Just
>doing a test..
>
>
>---
>[This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
>just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
>Declude.JunkMail".  The archives can be found at
>http://www.mail-archive.com.
>
>
>---
>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>

--
**
TymeWyse Internet
P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417
tel/fax: (541) 839-6027  -  [EMAIL PROTECTED]
**
--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test

2004-04-11 Thread Jeff Maze - Hostmaster

Ok.. Got it back..  I guess just not a lot going on..

But have noticed an INFLUX of spam messages lately..  A lot not being caught
by the filters but also a lot being caught.. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze -
Hostmaster
Sent: Sunday, April 11, 2004 10:32 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Test

Haven't received messages from here nor Declude.Virus since Friday.. Just
doing a test..


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Matt





Serge,

I was actually going to hard code the size parameters in the script
because I believe Declude will end up running it multiple times if the
calls are different, but only once if they are all the same and you are
tracking different result codes.

So far I've thought that I would do one result code for less than 1024
bytes (1K), one result code for between 30,720 and 102,400 (30K to
100K), one result code for more than 102,400 bytes (100K), and then a
result code of zero for everything else.  I would probably set these
tests up as SIZE-XSM, SIZE-LG and SIZE-XLG, adding a few points to
SIZE-XSM, using SIZE-LG and SIZE-XLG to defeat costly filters that are
useful for zombie spam, and crediting a few points to SIZE-XLG. 
Declude is smart enough to only run this test once for all three result
codes as long as the call is the same for all three.

You could easily modify this script for your own needs and use the
COPYFILE action to place large messages in a special hold directory and
then run a  simple script at certain times to move these files over to
your spool for delivery (picked up by your queue the next time it runs).

Regarding counting recipients, Declude appends the location of the D*
spool file to the script when called, and you then parse that out of
the arguments and use it however you see fit.  You can change the
leading D to an Q in the file name and make use of the MAIL FROM and
RCPT TO information in that file.  Note that Declude takes this further
by doing things like resolving aliases to actual accounts for locally
hosted E-mail, and that would require a good deal more programming,
however you could definitely count the number of RCPT TO statements and
return a code for that.  This isn't something that I'm looking to do
myself, and coding for me is a bit like pulling teeth as some simple
things can take days for me to figure out as this CScript thing did,
but I'd be happy to help identify what needs to be done.

Matt



serge wrote:

  
  
  
  Matt
  I would definetly be interested by
the code
  I suppose you are going to pass a
size as a parameter to the script, and have the test pass or fail if
the file is smaler/larger than the parameter ?
   
  Also, I am curious about the test
environement you are using, is this documentend somewhere? ho to call
declude and collect the results to see if they are as expected ? Do you
set a special test directory with local global.cfg and local logs?
   
  Interested in devoloping some tests
about size and number of "remote recipients" so we can delay large
files to low traffic hours (bandwidth too expensive in here).
   
  TIA
   
  
-
Original Message - 
From:
Matt

To:
[EMAIL PROTECTED]

Sent:
Wednesday, April 07, 2004 12:50 AM
Subject:
Re: [Declude.JunkMail] Test for message size and return codes


Thanks everyone for your help here.  The CScript method does in fact
work!  Looks like I'll probably be able to get some of those other
things taken care of as well now that I understand what was at issue
here, or at least how to work around it.

Darin, I hear you loud and clear about the utility of having compiled
code, and if you are still interested after I test a bit more, I may
ask you for some assistance.  What I'll probably do is grab myself a
copy of Visual Studio .Net and have a friend help me convert the
vbscript to a VB.Net (if that's a good choice).  I suppose it wouldn't
hurt to start learning VB.Net (ASP.Net) anyway.

When I get the file size test optimized (meaning figuring out what
sizes are useful to tag), and I get the Sniffer bypasser running, I'll
share the sources here.  I'm sure there are a lot of things that can be
done over the long-term.

Thanks,

Matt



Darin Cox wrote:

  
  Hi Matt,
   
  What we're saying is to try this
   
      EXTERNALTEST            external    30    "cscript.exe
C:\IMail\Declude\test.vbs"      0    0
  
  instead of
   
      EXTERNALTEST            external    30   
"C:\IMail\Declude\test.vbs"      0    0
  
  Not sure, but you may have to
provide a path to cscript.exe.  It should be in the
%SYSTEMROOT%\system32 directory on your machine.
  
Darin.
   
   
  -
Original Message -
  From:
  Matt
  
  To: [EMAIL PROTECTED]
      
  Sent: Tuesday, April 06, 2004 6:30 PM
  Subject: Re: [Declude.JunkMail] Test for message size
and return codes
  
  
  
Andrew,
  
Thanks for taking the time to check things out.  I haven't tried
calling the script with another script, just Declude, so there are no
cscript calls being made here.  I came across this old post where Scott
provided some background though on the "ExitProcess" method:
  
    http://www.mail-archive.com/[EMAIL PROTECTED]/msg02589.html
  
I assu

Re: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Darin Cox




Definitely,
 
I see this as primarily being used in two 
ways
 
1. Reduce false positives by negative weighting 
larger filesmaybe...
 
2. Stopgap for new viruses until new definitions 
are released by check for file size ranges (assuming a particular virus always 
sends similar file sizes).
 
Probably many other provider-specific uses for 
these kinds of plug-ins...
Darin.
 
 
- Original Message - 
From: serge 
To: [EMAIL PROTECTED] 

Sent: Tuesday, April 06, 2004 9:04 PM
Subject: Re: [Declude.JunkMail] Test for message size and return 
codes

Matt
I would definetly be interested by the 
code
I suppose you are going to pass a size as a 
parameter to the script, and have the test pass or fail if the file is 
smaler/larger than the parameter ?
 
Also, I am curious about the test environement you 
are using, is this documentend somewhere? ho to call declude and collect the 
results to see if they are as expected ? Do you set a special test directory 
with local global.cfg and local logs?
 
Interested in devoloping some tests about size and 
number of "remote recipients" so we can delay large files to low traffic hours 
(bandwidth too expensive in here).
 
TIA
 

  - Original Message - 
  From: 
  Matt 
  To: [EMAIL PROTECTED] 
  
  Sent: Wednesday, April 07, 2004 12:50 
  AM
  Subject: Re: [Declude.JunkMail] Test for 
  message size and return codes
  Thanks everyone for your help here.  The CScript method 
  does in fact work!  Looks like I'll probably be able to get some of those 
  other things taken care of as well now that I understand what was at issue 
  here, or at least how to work around it.Darin, I hear you loud and 
  clear about the utility of having compiled code, and if you are still 
  interested after I test a bit more, I may ask you for some assistance.  
  What I'll probably do is grab myself a copy of Visual Studio .Net and have a 
  friend help me convert the vbscript to a VB.Net (if that's a good 
  choice).  I suppose it wouldn't hurt to start learning VB.Net (ASP.Net) 
  anyway.When I get the file size test optimized (meaning figuring out 
  what sizes are useful to tag), and I get the Sniffer bypasser running, I'll 
  share the sources here.  I'm sure there are a lot of things that can be 
  done over the long-term.Thanks,MattDarin Cox 
  wrote:
  

Hi Matt,
 
What we're saying is to try 
this
 
    EXTERNALTEST        
    external    30    
"cscript.exe C:\IMail\Declude\test.vbs"      
0    0
instead of
 
    EXTERNALTEST        
    external    30    
"C:\IMail\Declude\test.vbs"      0    
0
Not sure, but you may have to provide a path to 
cscript.exe.  It should be in the %SYSTEMROOT%\system32 directory on 
your machine.
Darin.
 
 
- 
Original Message - 
From: 
Matt 

To: [EMAIL PROTECTED] 

Sent: Tuesday, April 06, 2004 6:30 PM
Subject: Re: [Declude.JunkMail] Test for message size and return 
codes
Andrew,Thanks for taking the time to check things 
out.  I haven't tried calling the script with another script, just 
Declude, so there are no cscript calls being made here.  I came across 
this old post where Scott provided some background though on the 
"ExitProcess" method:    http://www.mail-archive.com/[EMAIL PROTECTED]/msg02589.htmlI 
assume that this will work, but this isn't best practices for result codes 
from vbscript so far as I can tell, it was an old work around that could be 
used with VB4 when it didn't have the benefit of WScript.Quit.  I'll 
probably give that a try though.Scott, is there a reason why Declude 
isn't accepting the result code from WScript.Quit?  Here's a sample 
piece of code that I was using to test:    - 
Global.cfg -    EXTERNALTEST    
        external    
30    "C:\IMail\Declude\test.vbs"      
0    0    - test.vbs 
-    
WScript.Quit(30)Thanks,MattColbeck, Andrew 
wrote:

  
  Putting all 
  of 60 seconds into this, Matt, I've the following I can help 
  with:
   
  Your link 
  works great, so the method of calling it is probably suspect.  I 
  haven't tried to check the return code in Declude, but in a mini-script it 
  works fine.
   
  Have you 
  set the cscript host to be the default host?
   
  cscript 
  //H:CScript
   
  Are you 
  calling cscript.exe with command line parameters in your declude config 
  file, e.g.
   
  cscript 
  temp.vbs //B //NoLogo //T:2
   
  Here was my 
  test for your link:
   
  Listing of 
  temp.vbs:
  
  WScript.Quit (1);
   
  // This 
  line of code is never executed.var i

Re: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Darin Cox




Glad it's working now.
 
There's a significantly different object model in .NET, so you'll have to 
rewrite the file access portions to use the new objects...  and you 
obviously have to have the framework deployed on the server to use it, but I've 
been very pleased over the past couple of years with the speed of console 
apps in it (reminds me of those blessed pre-windows days )...and would recommend it over using Visual Studio 6 for speed of 
coding since you can use either C# or VB.NET instead of C++.  For the best 
performance you still end up in C++, though.  Haven't done any benchmarking 
for simple console apps, though...they might end up close in 
performance.
 
Darin.
 
 
- Original Message - 
From: Matt 
To: [EMAIL PROTECTED] 

Sent: Tuesday, April 06, 2004 8:50 PM
Subject: Re: [Declude.JunkMail] Test for message size and return 
codes
Thanks everyone for your help here.  The CScript method does 
in fact work!  Looks like I'll probably be able to get some of those other 
things taken care of as well now that I understand what was at issue here, or at 
least how to work around it.Darin, I hear you loud and clear about the 
utility of having compiled code, and if you are still interested after I test a 
bit more, I may ask you for some assistance.  What I'll probably do is grab 
myself a copy of Visual Studio .Net and have a friend help me convert the 
vbscript to a VB.Net (if that's a good choice).  I suppose it wouldn't hurt 
to start learning VB.Net (ASP.Net) anyway.When I get the file size test 
optimized (meaning figuring out what sizes are useful to tag), and I get the 
Sniffer bypasser running, I'll share the sources here.  I'm sure there are 
a lot of things that can be done over the 
long-term.Thanks,MattDarin Cox wrote:

  
  Hi Matt,
   
  What we're saying is to try 
this
   
      EXTERNALTEST        
      external    30    
  "cscript.exe C:\IMail\Declude\test.vbs"      
  0    0
  instead of
   
      EXTERNALTEST        
      external    30    
  "C:\IMail\Declude\test.vbs"      0    
  0
  Not sure, but you may have to provide a path to 
  cscript.exe.  It should be in the %SYSTEMROOT%\system32 directory on your 
  machine.
  Darin.
   
   
  - 
  Original Message - 
  From: 
  Matt 
  To: [EMAIL PROTECTED] 
  
  Sent: Tuesday, April 06, 2004 6:30 PM
  Subject: Re: [Declude.JunkMail] Test for message size and return 
  codes
  Andrew,Thanks for taking the time to check things 
  out.  I haven't tried calling the script with another script, just 
  Declude, so there are no cscript calls being made here.  I came across 
  this old post where Scott provided some background though on the "ExitProcess" 
  method:    http://www.mail-archive.com/[EMAIL PROTECTED]/msg02589.htmlI 
  assume that this will work, but this isn't best practices for result codes 
  from vbscript so far as I can tell, it was an old work around that could be 
  used with VB4 when it didn't have the benefit of WScript.Quit.  I'll 
  probably give that a try though.Scott, is there a reason why Declude 
  isn't accepting the result code from WScript.Quit?  Here's a sample piece 
  of code that I was using to test:    - Global.cfg 
  -    EXTERNALTEST        
      external    30    
  "C:\IMail\Declude\test.vbs"      0    
  0    - test.vbs -    
  WScript.Quit(30)Thanks,MattColbeck, Andrew 
  wrote:
  

Putting all 
of 60 seconds into this, Matt, I've the following I can help 
with:
 
Your link 
works great, so the method of calling it is probably suspect.  I 
haven't tried to check the return code in Declude, but in a mini-script it 
works fine.
 
Have you set 
the cscript host to be the default host?
 
cscript 
//H:CScript
 
Are you 
calling cscript.exe with command line parameters in your declude config 
file, e.g.
 
cscript 
temp.vbs //B //NoLogo //T:2
 
Here was my 
test for your link:
 
Listing of 
temp.vbs:

WScript.Quit 
(1);
 
// This line 
of code is never executed.var i = 0;
 
Listing of 
calltemp.cmd:
--
cscript 
temp.vbs //B //NoLogo //T:2@if errorlevel 10 echo errorlevel is 
10@if errorlevel 1 echo errorlevel is 1@if errorlevel 0 echo 
errorlevel is 0
 
Results of 
running calltemp.cmd:

C:\temp\>calltemp.cmd
 
C:\temp\>cscript temp.vbs //B //NoLogo //T:2errorlevel is 
1errorlevel is 0
 
which shows 
that all is right with the world.  Hope that helps 
some.
 
Andrew 
8)
 
-----Original Message-----From: 
Matt [mailto:[EMAIL PROTECTED]] 
Sent: Tuesday, April 06, 2004 2:29 PM

Re: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread serge




Matt
I would definetly be interested by the 
code
I suppose you are going to pass a size as a 
parameter to the script, and have the test pass or fail if the file is 
smaler/larger than the parameter ?
 
Also, I am curious about the test environement you 
are using, is this documentend somewhere? ho to call declude and collect the 
results to see if they are as expected ? Do you set a special test directory 
with local global.cfg and local logs?
 
Interested in devoloping some tests about size and 
number of "remote recipients" so we can delay large files to low traffic hours 
(bandwidth too expensive in here).
 
TIA
 

  - Original Message - 
  From: 
  Matt 
  To: [EMAIL PROTECTED] 
  
  Sent: Wednesday, April 07, 2004 12:50 
  AM
  Subject: Re: [Declude.JunkMail] Test for 
  message size and return codes
  Thanks everyone for your help here.  The CScript method 
  does in fact work!  Looks like I'll probably be able to get some of those 
  other things taken care of as well now that I understand what was at issue 
  here, or at least how to work around it.Darin, I hear you loud and 
  clear about the utility of having compiled code, and if you are still 
  interested after I test a bit more, I may ask you for some assistance.  
  What I'll probably do is grab myself a copy of Visual Studio .Net and have a 
  friend help me convert the vbscript to a VB.Net (if that's a good 
  choice).  I suppose it wouldn't hurt to start learning VB.Net (ASP.Net) 
  anyway.When I get the file size test optimized (meaning figuring out 
  what sizes are useful to tag), and I get the Sniffer bypasser running, I'll 
  share the sources here.  I'm sure there are a lot of things that can be 
  done over the long-term.Thanks,MattDarin Cox 
  wrote:
  

Hi Matt,
 
What we're saying is to try 
this
 
    EXTERNALTEST        
    external    30    
"cscript.exe C:\IMail\Declude\test.vbs"      
0    0
instead of
 
    EXTERNALTEST        
    external    30    
"C:\IMail\Declude\test.vbs"      0    
0
Not sure, but you may have to provide a path to 
cscript.exe.  It should be in the %SYSTEMROOT%\system32 directory on 
your machine.
Darin.
 
 
- 
Original Message - 
From: 
Matt 

To: [EMAIL PROTECTED] 

Sent: Tuesday, April 06, 2004 6:30 PM
Subject: Re: [Declude.JunkMail] Test for message size and return 
codes
Andrew,Thanks for taking the time to check things 
out.  I haven't tried calling the script with another script, just 
Declude, so there are no cscript calls being made here.  I came across 
this old post where Scott provided some background though on the 
"ExitProcess" method:    http://www.mail-archive.com/[EMAIL PROTECTED]/msg02589.htmlI 
assume that this will work, but this isn't best practices for result codes 
from vbscript so far as I can tell, it was an old work around that could be 
used with VB4 when it didn't have the benefit of WScript.Quit.  I'll 
probably give that a try though.Scott, is there a reason why Declude 
isn't accepting the result code from WScript.Quit?  Here's a sample 
piece of code that I was using to test:    - 
Global.cfg -    EXTERNALTEST    
        external    
30    "C:\IMail\Declude\test.vbs"      
0    0    - test.vbs 
-    
WScript.Quit(30)Thanks,MattColbeck, Andrew 
wrote:

  
  Putting all 
  of 60 seconds into this, Matt, I've the following I can help 
  with:
   
  Your link 
  works great, so the method of calling it is probably suspect.  I 
  haven't tried to check the return code in Declude, but in a mini-script it 
  works fine.
   
  Have you 
  set the cscript host to be the default host?
   
  cscript 
  //H:CScript
   
  Are you 
  calling cscript.exe with command line parameters in your declude config 
  file, e.g.
   
  cscript 
  temp.vbs //B //NoLogo //T:2
   
  Here was my 
  test for your link:
   
  Listing of 
  temp.vbs:
  
  WScript.Quit (1);
   
  // This 
  line of code is never executed.var i = 0;
   
  Listing of 
  calltemp.cmd:
  --
  cscript 
  temp.vbs //B //NoLogo //T:2@if errorlevel 10 echo errorlevel is 
  10@if errorlevel 1 echo errorlevel is 1@if errorlevel 0 echo 
  errorlevel is 0
   
  Results of 
  running calltemp.cmd:
  
  C:\temp\>calltemp.cmd
   
  C:\temp\>cscript temp.vbs //B //NoLogo //T:2errorlevel is 
  1errorlevel is 0
   
  which shows 
  that all is right wit

Re: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Matt





Thanks everyone for your help here.  The CScript method does in fact
work!  Looks like I'll probably be able to get some of those other
things taken care of as well now that I understand what was at issue
here, or at least how to work around it.

Darin, I hear you loud and clear about the utility of having compiled
code, and if you are still interested after I test a bit more, I may
ask you for some assistance.  What I'll probably do is grab myself a
copy of Visual Studio .Net and have a friend help me convert the
vbscript to a VB.Net (if that's a good choice).  I suppose it wouldn't
hurt to start learning VB.Net (ASP.Net) anyway.

When I get the file size test optimized (meaning figuring out what
sizes are useful to tag), and I get the Sniffer bypasser running, I'll
share the sources here.  I'm sure there are a lot of things that can be
done over the long-term.

Thanks,

Matt



Darin Cox wrote:

  
  
  
  Hi Matt,
   
  What we're saying is to try this
   
     
EXTERNALTEST            external    30    "cscript.exe
C:\IMail\Declude\test.vbs"      0    0
  
  instead of
   
      EXTERNALTEST            external    30   
"C:\IMail\Declude\test.vbs"      0    0
  
  Not sure, but you may have to
provide a path to cscript.exe.  It should be in the
%SYSTEMROOT%\system32 directory on your machine.
  
Darin.
   
   
  -
Original Message -
  From:
  Matt
  
  To: [EMAIL PROTECTED]
  
  Sent: Tuesday, April 06, 2004 6:30 PM
  Subject: Re: [Declude.JunkMail] Test for message size and
return codes
  
  
  
Andrew,
  
Thanks for taking the time to check things out.  I haven't tried
calling the script with another script, just Declude, so there are no
cscript calls being made here.  I came across this old post where Scott
provided some background though on the "ExitProcess" method:
  
    http://www.mail-archive.com/[EMAIL PROTECTED]/msg02589.html
  
I assume that this will work, but this isn't best practices for result
codes from vbscript so far as I can tell, it was an old work around
that could be used with VB4 when it didn't have the benefit of
WScript.Quit.  I'll probably give that a try though.
  
Scott, is there a reason why Declude isn't accepting the result code
from WScript.Quit?  Here's a sample piece of code that I was using to
test:
  
    - Global.cfg -
    EXTERNALTEST            external    30   
"C:\IMail\Declude\test.vbs"      0    0
  
    - test.vbs -
    WScript.Quit(30)
  
Thanks,
  
Matt
  
  
Colbeck, Andrew wrote:
  

Putting
all of 60 seconds into this, Matt, I've the following I can help with:
 
Your
link works great, so the method of calling it is probably suspect.  I
haven't tried to check the return code in Declude, but in a mini-script
it works fine.
 
Have
you set the cscript host to be the default host?
 
cscript
//H:CScript
 
Are
you calling cscript.exe with command line parameters in your declude
config file, e.g.
 
cscript
temp.vbs //B //NoLogo //T:2
 
Here
was my test for your link:
 
Listing
of temp.vbs:

WScript.Quit
(1);
 
//
This line of code is never executed.
var i = 0;
 
Listing
of calltemp.cmd:
--
cscript
temp.vbs //B //NoLogo //T:2
@if errorlevel 10 echo errorlevel is 10
@if errorlevel 1 echo errorlevel is 1
@if errorlevel 0 echo errorlevel is 0
 
Results
of running calltemp.cmd:

C:\temp\>calltemp.cmd
 
C:\temp\>cscript
temp.vbs //B //NoLogo //T:2
errorlevel is 1
errorlevel is 0
 
which
shows that all is right with the world.  Hope that helps some.
 
Andrew
8)
 
-Original Message-
    From: Matt [mailto:[EMAIL PROTECTED]] 
Sent: Tuesday, April 06, 2004 2:29 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Test for message size and
return codes


Kevin and Darin,
  
This is something that would be configured as an external test in
Declude, and it's not calling any other programs so I'm not sure that
cscript is useful here.  If I was calling something like Sniffer, I do
understand that the call should be made with cscript though.  I also
understand the limitations of scripted code vs compiled code, but I can
do some basic scripting (most of my experience is in simple database
ASP stuff) and test some ideas before finding someone to code it up as
something that can be compiled.  For something as basic as checking
just the file size, this should work plenty fast though, it doesn't
even need to open the file.
  
The real issue that I have though is pumping out a result code from
vbscript to Declude.  From my reading of things, the WScript.Quit
method should do this, but it's not working.  BTW, there is no
CS

RE: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Colbeck, Andrew

Title: Message



Matt, try the 
more verbose:
 EXTERNALTEST    
external    30    "C:\Windows\System32\cscript.exe 
C:\IMail\Declude\test.vbs //B //NoLogo 
//T:2"  0    0
 
I don't know how 
that will mangle the order of the parameter passing of the message filename, but 
sniffer manages to cope with a parameter in the calling 
string.
 
If that's 
unworkable, then I guess the thing to do would be to get a command line 
parameter as "localsystem" by doing an:
 
at 5:00PM 
/interactive cmd /k
 
and 
then:
 
cscript test.vbs 
//B //NoLogo //T:2 //S
 
to save the 
command line options for "this user" which would then be "localsystem".  
Then your calling the just the .vbs file in your declude calling string might 
work as expected.
 
On the other 
hand, all my blather might be a red herring.  I'm assuming that there is a 
difference in the model of the Windows Scripting Host between wscript and 
cscript and/or Interactive vs. Batch that is messing up your errorlevel 
value.
 
Andrew 
8)

  
  -Original Message-From: Matt 
  [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 06, 2004 3:31 
  PMTo: [EMAIL PROTECTED]Subject: Re: 
  [Declude.JunkMail] Test for message size and return 
  codesAndrew,Thanks for taking the time to check 
  things out.  I haven't tried calling the script with another script, just 
  Declude, so there are no cscript calls being made here.  I came across 
  this old post where Scott provided some background though on the "ExitProcess" 
  method:    http://www.mail-archive.com/[EMAIL PROTECTED]/msg02589.htmlI 
  assume that this will work, but this isn't best practices for result codes 
  from vbscript so far as I can tell, it was an old work around that could be 
  used with VB4 when it didn't have the benefit of WScript.Quit.  I'll 
  probably give that a try though.Scott, is there a reason why Declude 
  isn't accepting the result code from WScript.Quit?  Here's a sample piece 
  of code that I was using to test:    - Global.cfg 
  -    EXTERNALTEST        
      external    30    
  "C:\IMail\Declude\test.vbs"      0    
  0    - test.vbs -    
  WScript.Quit(30)Thanks,MattColbeck, Andrew 
  wrote:
  

Putting all 
of 60 seconds into this, Matt, I've the following I can help 
with:
 
Your link 
works great, so the method of calling it is probably suspect.  I 
haven't tried to check the return code in Declude, but in a mini-script it 
works fine.
 
Have you set 
the cscript host to be the default host?
 
cscript 
//H:CScript
 
Are you 
calling cscript.exe with command line parameters in your declude config 
file, e.g.
 
cscript 
temp.vbs //B //NoLogo //T:2
 
Here was my 
test for your link:
 
Listing of 
temp.vbs:

WScript.Quit 
(1);
 
// This line 
of code is never executed.var i = 0;
 
Listing of 
calltemp.cmd:
--
cscript 
temp.vbs //B //NoLogo //T:2@if errorlevel 10 echo errorlevel is 
10@if errorlevel 1 echo errorlevel is 1@if errorlevel 0 echo 
errorlevel is 0
 
Results of 
running calltemp.cmd:

C:\temp\>calltemp.cmd
 
C:\temp\>cscript temp.vbs //B //NoLogo //T:2errorlevel is 
1errorlevel is 0
 
which shows 
that all is right with the world.  Hope that helps 
some.
 
Andrew 
8)
 
-Original Message-From: 
Matt [mailto:[EMAIL PROTECTED]] 
Sent: Tuesday, April 06, 2004 2:29 PMTo: [EMAIL PROTECTED]Subject: 
Re: [Declude.JunkMail] Test for message size and return 
codes
Kevin and Darin,This 
  is something that would be configured as an external test in Declude, and 
  it's not calling any other programs so I'm not sure that cscript is useful 
  here.  If I was calling something like Sniffer, I do understand that 
  the call should be made with cscript though.  I also understand the 
  limitations of scripted code vs compiled code, but I can do some basic 
  scripting (most of my experience is in simple database ASP stuff) and test 
  some ideas before finding someone to code it up as something that can be 
  compiled.  For something as basic as checking just the file size, 
  this should work plenty fast though, it doesn't even need to open the 
  file.The real issue that I have though is pumping out a result 
  code from vbscript to Declude.  From my reading of things, the 
  WScript.Quit method should do this, but it's not working.  BTW, there 
  is no CScript.Quit method.  Here's the page on MSDN for 
  WScript.Quit:    http://msdn.microsoft.com/library/default.asp?url=""

Re: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Darin Cox




Hi Matt,
 
What we're saying is to try this
 
    EXTERNALTEST        
    external    30    "cscript.exe 
C:\IMail\Declude\test.vbs"      0    
0
instead of
 
    EXTERNALTEST        
    external    30    
"C:\IMail\Declude\test.vbs"      0    
0
Not sure, but you may have to provide a path to 
cscript.exe.  It should be in the %SYSTEMROOT%\system32 directory on your 
machine.
Darin.
 
 
- Original Message - 
From: Matt 
To: [EMAIL PROTECTED] 

Sent: Tuesday, April 06, 2004 6:30 PM
Subject: Re: [Declude.JunkMail] Test for message size and return 
codes
Andrew,Thanks for taking the time to check 
things out.  I haven't tried calling the script with another script, just 
Declude, so there are no cscript calls being made here.  I came across this 
old post where Scott provided some background though on the "ExitProcess" 
method:    http://www.mail-archive.com/[EMAIL PROTECTED]/msg02589.htmlI 
assume that this will work, but this isn't best practices for result codes from 
vbscript so far as I can tell, it was an old work around that could be used with 
VB4 when it didn't have the benefit of WScript.Quit.  I'll probably give 
that a try though.Scott, is there a reason why Declude isn't accepting 
the result code from WScript.Quit?  Here's a sample piece of code that I 
was using to test:    - Global.cfg 
-    EXTERNALTEST        
    external    30    
"C:\IMail\Declude\test.vbs"      0    
0    - test.vbs -    
WScript.Quit(30)Thanks,MattColbeck, Andrew 
wrote:

  
  Putting all of 
  60 seconds into this, Matt, I've the following I can help 
  with:
   
  Your link works 
  great, so the method of calling it is probably suspect.  I haven't tried 
  to check the return code in Declude, but in a mini-script it works 
  fine.
   
  Have you set 
  the cscript host to be the default host?
   
  cscript 
  //H:CScript
   
  Are you calling 
  cscript.exe with command line parameters in your declude config file, 
  e.g.
   
  cscript 
  temp.vbs //B //NoLogo //T:2
   
  Here was my 
  test for your link:
   
  Listing of 
  temp.vbs:
  
  WScript.Quit 
  (1);
   
  // This line of 
  code is never executed.var i = 0;
   
  Listing of 
  calltemp.cmd:
  --
  cscript 
  temp.vbs //B //NoLogo //T:2@if errorlevel 10 echo errorlevel is 10@if 
  errorlevel 1 echo errorlevel is 1@if errorlevel 0 echo errorlevel is 
  0
   
  Results of 
  running calltemp.cmd:
  
  C:\temp\>calltemp.cmd
   
  C:\temp\>cscript temp.vbs //B //NoLogo //T:2errorlevel is 
  1errorlevel is 0
   
  which shows 
  that all is right with the world.  Hope that helps 
  some.
   
  Andrew 
  8)
   
  -Original Message-From: Matt 
  [mailto:[EMAIL PROTECTED]] 
  Sent: Tuesday, April 06, 2004 2:29 PMTo: [EMAIL PROTECTED]Subject: 
  Re: [Declude.JunkMail] Test for message size and return 
  codes
  Kevin and Darin,This 
is something that would be configured as an external test in Declude, and 
it's not calling any other programs so I'm not sure that cscript is useful 
here.  If I was calling something like Sniffer, I do understand that 
the call should be made with cscript though.  I also understand the 
limitations of scripted code vs compiled code, but I can do some basic 
scripting (most of my experience is in simple database ASP stuff) and test 
some ideas before finding someone to code it up as something that can be 
compiled.  For something as basic as checking just the file size, this 
should work plenty fast though, it doesn't even need to open the 
file.The real issue that I have though is pumping out a result code 
from vbscript to Declude.  From my reading of things, the WScript.Quit 
method should do this, but it's not working.  BTW, there is no 
CScript.Quit method.  Here's the page on MSDN for 
WScript.Quit:    http://msdn.microsoft.com/library/default.asp?url="">I 
can't find anything else in vbscript that is supposed to be used for 
returning a result code except for an old method for ExitProcess that 
existed before WScript.Quit came around.  Here's an example of that, 
but I'm not sure how to use it exactly, or even if that would 
work.    http://www.mentalis.org/apilist/ExitProcess.shtmlI'm 
more concerned that WScript.Quit is sending the exit code back to Declude in 
the wrong format, or possibly that you just can't use vbscript, or at least 
WScript to return a result code.This one little script is only one 
of many little but useful things that could be done if I can get my hands 
around this.  I came across similar problems when I was trying to 
create a handler for Sniffer that would skip calling Sniffer if the weight 
was alread

Re: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Darin Cox




Hi Matt,
 
WScript.Quit(errorlevel) is the correct command 
within your script.  The problem is that you probably need to explicitly 
call cscript and pass it the vbs script name as mentioned before.  Cscript 
is always used to process WScript or VBScript, but depending on your 
environment, you may need to explicitly call it instead of just calling the vbs 
script directly.  Try it, you'll like it  

 
Yes, this will be fine for testing, but once you 
try to move this to a production environment, you'll most likely find that the 
load and parse time for the script multiplies the run time by a factor of 10, 
probably running it into the 1000 millisecond range to process.  
Compiling the code would definitely be the way to go, dropping the processing 
time to on the order of 100 milliseconds without any other 
optimization.
 
For those that run .NET environments, I don't mind 
compiling it into a console app...requires a few changes due to the differing 
object structure, but it wouldn't take that long.
Darin.
 
 
- Original Message - 
From: Matt 
To: [EMAIL PROTECTED] 

Sent: Tuesday, April 06, 2004 5:28 PM
Subject: Re: [Declude.JunkMail] Test for message size and return 
codes
Kevin and Darin,This is something that would be 
configured as an external test in Declude, and it's not calling any other 
programs so I'm not sure that cscript is useful here.  If I was calling 
something like Sniffer, I do understand that the call should be made with 
cscript though.  I also understand the limitations of scripted code vs 
compiled code, but I can do some basic scripting (most of my experience is in 
simple database ASP stuff) and test some ideas before finding someone to code it 
up as something that can be compiled.  For something as basic as checking 
just the file size, this should work plenty fast though, it doesn't even need to 
open the file.The real issue that I have though is pumping out a result 
code from vbscript to Declude.  From my reading of things, the WScript.Quit 
method should do this, but it's not working.  BTW, there is no CScript.Quit 
method.  Here's the page on MSDN for 
WScript.Quit:    http://msdn.microsoft.com/library/default.asp?url="">I 
can't find anything else in vbscript that is supposed to be used for returning a 
result code except for an old method for ExitProcess that existed before 
WScript.Quit came around.  Here's an example of that, but I'm not sure how 
to use it exactly, or even if that would work.    http://www.mentalis.org/apilist/ExitProcess.shtmlI'm 
more concerned that WScript.Quit is sending the exit code back to Declude in the 
wrong format, or possibly that you just can't use vbscript, or at least WScript 
to return a result code.This one little script is only one of many 
little but useful things that could be done if I can get my hands around 
this.  I came across similar problems when I was trying to create a handler 
for Sniffer that would skip calling Sniffer if the weight was already high 
enough for my Drop setting.  I thought the problem was related to 
retrieving the result code from Sniffer, but it will echo it in testing, however 
I can't get it to Declude in proper result code 
format.MattDarin Cox wrote:

  
  

  Probably need to use cscript to call the vbs file 
  like "cscript filesize.vbs d0smd"
   
  Also, it would probably be much better to compile 
  this into a C++ or C#/VB.net console app.  Interpreted code like 
  this runs a lot slower than compiled.  Haven't done tests for 
  this in the past couple of years, but it used to be an order of magnitude 
  faster for compiled over interpreted.
  Darin.
   
   
  - 
  Original Message - 
  From: 
  Matt 
  To: [EMAIL PROTECTED] 
  
  Sent: Tuesday, April 06, 2004 3:53 PM
  Subject: [Declude.JunkMail] Test for message size and return 
  codes
  Scott,I have tried scripting several different things 
  with vbscript for use as external tests in Declude to no avail.  Here for 
  example is a simple piece of code that can detect if a message is above or 
  below a certain size:
  Dim Args, oFSO, oFileSet Args = WScript.ArgumentsSet 
oFSO = CreateObject("Scripting.FileSystemObject")Set oFile = 
oFSO.GetFile(Args(0))If oFile.size > 102400 
Then    'Return a code of 1Else    
'Return a code of 0End IfSet Args = nothingSet oFile = 
nothingSet oFSO = nothingI have comments in there for 
  the result codes because I tried the WScript.Quit(1) method and Declude 
  doesn't pick that up.  From everything that I have read, it appears that 
  this is the preferred method with vbscript (note that I'm not an expert in 
  this area by any means), and the ExitProcess method indicated in your manual 
  is an old work around that was appropriate (the only method) for old 
  VB.I've searched the Internet several times for a good

RE: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Kevin Bilbee

Try this

- Global.cfg -
EXTERNALTEST external 30 "cscript C:\IMail\Declude\test.vbs //nologo //T:60"
0 0

Kevin Bilbee

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Kevin Bilbee




Matt 
what is the line in declude for calling the script???
 
I did 
not intend for you to change your script? change the line in declude to call the 
script using "cscript.exe nameofscript.vbs".
 
Leave 
your script the way tiy have it.
 
 
Kevin 
Bilbee

  -Original Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]On Behalf Of 
  MattSent: Tuesday, April 06, 2004 2:29 PMTo: 
  [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Test 
  for message size and return codesKevin and 
  Darin,This is something that would be configured as an external test 
  in Declude, and it's not calling any other programs so I'm not sure that 
  cscript is useful here.  If I was calling something like Sniffer, I do 
  understand that the call should be made with cscript though.  I also 
  understand the limitations of scripted code vs compiled code, but I can do 
  some basic scripting (most of my experience is in simple database ASP stuff) 
  and test some ideas before finding someone to code it up as something that can 
  be compiled.  For something as basic as checking just the file size, this 
  should work plenty fast though, it doesn't even need to open the 
  file.The real issue that I have though is pumping out a result code 
  from vbscript to Declude.  From my reading of things, the WScript.Quit 
  method should do this, but it's not working.  BTW, there is no 
  CScript.Quit method.  Here's the page on MSDN for 
  WScript.Quit:    http://msdn.microsoft.com/library/default.asp?url="">I 
  can't find anything else in vbscript that is supposed to be used for returning 
  a result code except for an old method for ExitProcess that existed before 
  WScript.Quit came around.  Here's an example of that, but I'm not sure 
  how to use it exactly, or even if that would work.    
  http://www.mentalis.org/apilist/ExitProcess.shtmlI'm 
  more concerned that WScript.Quit is sending the exit code back to Declude in 
  the wrong format, or possibly that you just can't use vbscript, or at least 
  WScript to return a result code.This one little script is only one of 
  many little but useful things that could be done if I can get my hands around 
  this.  I came across similar problems when I was trying to create a 
  handler for Sniffer that would skip calling Sniffer if the weight was already 
  high enough for my Drop setting.  I thought the problem was related to 
  retrieving the result code from Sniffer, but it will echo it in testing, 
  however I can't get it to Declude in proper result code 
  format.MattDarin Cox wrote:
  



Probably need to use cscript to call the vbs 
file like "cscript filesize.vbs d0smd"
 
Also, it would probably be much better to 
compile this into a C++ or C#/VB.net console app.  Interpreted 
code like this runs a lot slower than compiled.  Haven't done 
tests for this in the past couple of years, but it used to be an order of 
magnitude faster for compiled over interpreted.
Darin.
 
 
- 
Original Message - 
From: 
Matt 

To: [EMAIL PROTECTED] 

Sent: Tuesday, April 06, 2004 3:53 PM
Subject: [Declude.JunkMail] Test for message size and return 
codes
Scott,I have tried scripting several different things 
with vbscript for use as external tests in Declude to no avail.  Here 
for example is a simple piece of code that can detect if a message is above 
or below a certain size:
Dim Args, oFSO, oFileSet Args = 
  WScript.ArgumentsSet oFSO = 
  CreateObject("Scripting.FileSystemObject")Set oFile = 
  oFSO.GetFile(Args(0))If oFile.size > 102400 
  Then    'Return a code of 
  1Else    'Return a code of 0End IfSet 
  Args = nothingSet oFile = nothingSet oFSO = 
nothingI have comments in there for the result codes 
because I tried the WScript.Quit(1) method and Declude doesn't pick that 
up.  From everything that I have read, it appears that this is the 
preferred method with vbscript (note that I'm not an expert in this area by 
any means), and the ExitProcess method indicated in your manual is an old 
work around that was appropriate (the only method) for old VB.I've 
searched the Internet several times for a good example of returning a result 
code to Declude and I'm a bit stumped.  I was hoping that you or 
someone else has some vbscript examples that will work with Declude.  A 
lot could be done to add little functions like a test for size, which in my 
case, could be used to defeat certain filters that are targeted at zombie 
spam which are heavy on the BODY searches, such as GIBBERISH, !YDIRECTED, 
IPLINKED, and @LINKED (and I'm sure several more at 
least).Thanks,Mat

Re: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Matt





Andrew,

Thanks for taking the time to check things out.  I haven't tried
calling the script with another script, just Declude, so there are no
cscript calls being made here.  I came across this old post where Scott
provided some background though on the "ExitProcess" method:

   
http://www.mail-archive.com/[EMAIL PROTECTED]/msg02589.html

I assume that this will work, but this isn't best practices for result
codes from vbscript so far as I can tell, it was an old work around
that could be used with VB4 when it didn't have the benefit of
WScript.Quit.  I'll probably give that a try though.

Scott, is there a reason why Declude isn't accepting the result code
from WScript.Quit?  Here's a sample piece of code that I was using to
test:

    - Global.cfg -
    EXTERNALTEST            external    30   
"C:\IMail\Declude\test.vbs"      0    0

    - test.vbs -
    WScript.Quit(30)

Thanks,

Matt


Colbeck, Andrew wrote:

  
  Message
  
  Putting
all of 60 seconds into this, Matt, I've the following I can help with:
   
  Your
link works great, so the method of calling it is probably suspect.  I
haven't tried to check the return code in Declude, but in a mini-script
it works fine.
   
  Have
you set the cscript host to be the default host?
   
  cscript
//H:CScript
   
  Are
you calling cscript.exe with command line parameters in your declude
config file, e.g.
   
  cscript
temp.vbs //B //NoLogo //T:2
   
  Here
was my test for your link:
   
  Listing
of temp.vbs:
  
  WScript.Quit
(1);
   
  //
This line of code is never executed.
var i = 0;
   
  Listing
of calltemp.cmd:
  --
  cscript
temp.vbs //B //NoLogo //T:2
@if errorlevel 10 echo errorlevel is 10
@if errorlevel 1 echo errorlevel is 1
@if errorlevel 0 echo errorlevel is 0
   
  Results
of running calltemp.cmd:
  
  C:\temp\>calltemp.cmd
   
  C:\temp\>cscript
temp.vbs //B //NoLogo //T:2
errorlevel is 1
errorlevel is 0
   
  which
shows that all is right with the world.  Hope that helps some.
   
  Andrew
8)
   
  -Original Message-
  From: Matt [mailto:[EMAIL PROTECTED]] 
  Sent: Tuesday, April 06, 2004 2:29 PM
  To: [EMAIL PROTECTED]
  Subject: Re: [Declude.JunkMail] Test for message size and
return codes
  
  
  Kevin and Darin,

This is something that would be configured as an external test in
Declude, and it's not calling any other programs so I'm not sure that
cscript is useful here.  If I was calling something like Sniffer, I do
understand that the call should be made with cscript though.  I also
understand the limitations of scripted code vs compiled code, but I can
do some basic scripting (most of my experience is in simple database
ASP stuff) and test some ideas before finding someone to code it up as
something that can be compiled.  For something as basic as checking
just the file size, this should work plenty fast though, it doesn't
even need to open the file.

The real issue that I have though is pumping out a result code from
vbscript to Declude.  From my reading of things, the WScript.Quit
method should do this, but it's not working.  BTW, there is no
CScript.Quit method.  Here's the page on MSDN for WScript.Quit:

    http://msdn.microsoft.com/library/default.asp?url="">

I can't find anything else in vbscript that is supposed to be used for
returning a result code except for an old method for ExitProcess that
existed before WScript.Quit came around.  Here's an example of that,
but I'm not sure how to use it exactly, or even if that would work.

    http://www.mentalis.org/apilist/ExitProcess.shtml

I'm more concerned that WScript.Quit is sending the exit code back to
Declude in the wrong format, or possibly that you just can't use
vbscript, or at least WScript to return a result code.

This one little script is only one of many little but useful things
that could be done if I can get my hands around this.  I came across
similar problems when I was trying to create a handler for Sniffer that
would skip calling Sniffer if the weight was already high enough for my
Drop setting.  I thought the problem was related to retrieving the
result code from Sniffer, but it will echo it in testing, however I
can't get it to Declude in proper result code format.

Matt




Darin Cox wrote:

  
  
  Probably need to use cscript to
call the vbs file like "cscript filesize.vbs d0smd"
   
  Also, it would probably be much
better to compile this into a C++ or C#/VB.net console app. 
Interpreted code like this runs a lot slower than compiled.  Haven't
done tests for this in the past couple of years, but it used to be an
order of magnitude faster for compiled over interpreted.
  
Darin.

Re: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread R. Scott Perry


Scott, is there a reason why Declude isn't accepting the result code from 
WScript.Quit?  Here's a sample piece of code that I was using to test:

- Global.cfg -
EXTERNALTESTexternal30"C:\IMail\Declude\test.vbs" 
  00

- test.vbs -
WScript.Quit(30)
In theory, that should work fine.

However, I have heard of issues getting VB/VBscript programs to properly 
return an exit code.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Colbeck, Andrew

Title: Message



Putting all of 60 
seconds into this, Matt, I've the following I can help with:
 
Your link works 
great, so the method of calling it is probably suspect.  I haven't tried to 
check the return code in Declude, but in a mini-script it works 
fine.
 
Have you set the 
cscript host to be the default host?
 
cscript 
//H:CScript
 
Are you calling 
cscript.exe with command line parameters in your declude config file, 
e.g.
 
cscript temp.vbs 
//B //NoLogo //T:2
 
Here was my test 
for your link:
 
Listing of 
temp.vbs:

WScript.Quit 
(1);
 
// This line of 
code is never executed.var i = 0;
 
Listing of 
calltemp.cmd:
--
cscript temp.vbs 
//B //NoLogo //T:2@if errorlevel 10 echo errorlevel is 10@if errorlevel 
1 echo errorlevel is 1@if errorlevel 0 echo errorlevel is 
0
 
Results of 
running calltemp.cmd:

C:\temp\>calltemp.cmd
 
C:\temp\>cscript temp.vbs //B //NoLogo //T:2errorlevel is 
1errorlevel is 0
 
which shows that 
all is right with the world.  Hope that helps some.
 
Andrew 
8)
 
-Original Message-From: Matt 
[mailto:[EMAIL PROTECTED] Sent: Tuesday, April 06, 2004 2:29 
PMTo: [EMAIL PROTECTED]Subject: Re: 
[Declude.JunkMail] Test for message size and return codes
Kevin and Darin,This is 
  something that would be configured as an external test in Declude, and it's 
  not calling any other programs so I'm not sure that cscript is useful 
  here.  If I was calling something like Sniffer, I do understand that the 
  call should be made with cscript though.  I also understand the 
  limitations of scripted code vs compiled code, but I can do some basic 
  scripting (most of my experience is in simple database ASP stuff) and test 
  some ideas before finding someone to code it up as something that can be 
  compiled.  For something as basic as checking just the file size, this 
  should work plenty fast though, it doesn't even need to open the 
  file.The real issue that I have though is pumping out a result code 
  from vbscript to Declude.  From my reading of things, the WScript.Quit 
  method should do this, but it's not working.  BTW, there is no 
  CScript.Quit method.  Here's the page on MSDN for 
  WScript.Quit:    http://msdn.microsoft.com/library/default.asp?url="">I 
  can't find anything else in vbscript that is supposed to be used for returning 
  a result code except for an old method for ExitProcess that existed before 
  WScript.Quit came around.  Here's an example of that, but I'm not sure 
  how to use it exactly, or even if that would work.    
  http://www.mentalis.org/apilist/ExitProcess.shtmlI'm 
  more concerned that WScript.Quit is sending the exit code back to Declude in 
  the wrong format, or possibly that you just can't use vbscript, or at least 
  WScript to return a result code.This one little script is only one of 
  many little but useful things that could be done if I can get my hands around 
  this.  I came across similar problems when I was trying to create a 
  handler for Sniffer that would skip calling Sniffer if the weight was already 
  high enough for my Drop setting.  I thought the problem was related to 
  retrieving the result code from Sniffer, but it will echo it in testing, 
  however I can't get it to Declude in proper result code 
  format.MattDarin Cox wrote:
  



Probably need to use cscript to call the vbs 
file like "cscript filesize.vbs d0smd"
 
Also, it would probably be much better to 
compile this into a C++ or C#/VB.net console app.  Interpreted 
code like this runs a lot slower than compiled.  Haven't done 
tests for this in the past couple of years, but it used to be an order of 
magnitude faster for compiled over interpreted.
Darin.
 
 
- 
Original Message - 
From: 
Matt 

To: [EMAIL PROTECTED] 

Sent: Tuesday, April 06, 2004 3:53 PM
Subject: [Declude.JunkMail] Test for message size and return 
codes
Scott,I have tried scripting several different things 
with vbscript for use as external tests in Declude to no avail.  Here 
for example is a simple piece of code that can detect if a message is above 
or below a certain size:
Dim Args, oFSO, oFileSet Args = 
  WScript.ArgumentsSet oFSO = 
  CreateObject("Scripting.FileSystemObject")Set oFile = 
  oFSO.GetFile(Args(0))If oFile.size > 102400 
  Then    'Return a code of 
  1Else    'Return a code of 0End IfSet 
  Args = nothingSet oFile = nothingSet oFSO = 
nothingI have comments in there for the result codes 
because I tried the WScript.Quit(1) method and Declude doesn't pick that 
up.  From everything that I have read, it appears that this is the 
preferred method with vbscr

Re: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Matt





I just wanted to clarify also that I have been testing with
WScript.Quit(30) instead of a code of 1.

Matt



Matt wrote:

  
  
Kevin and Darin,
  
This is something that would be configured as an external test in
Declude, and it's not calling any other programs so I'm not sure that
cscript is useful here.  If I was calling something like Sniffer, I do
understand that the call should be made with cscript though.  I also
understand the limitations of scripted code vs compiled code, but I can
do some basic scripting (most of my experience is in simple database
ASP stuff) and test some ideas before finding someone to code it up as
something that can be compiled.  For something as basic as checking
just the file size, this should work plenty fast though, it doesn't
even need to open the file.
  
The real issue that I have though is pumping out a result code from
vbscript to Declude.  From my reading of things, the WScript.Quit
method should do this, but it's not working.  BTW, there is no
CScript.Quit method.  Here's the page on MSDN for WScript.Quit:
  
   
  http://msdn.microsoft.com/library/default.asp?url="">
  
I can't find anything else in vbscript that is supposed to be used for
returning a result code except for an old method for ExitProcess that
existed before WScript.Quit came around.  Here's an example of that,
but I'm not sure how to use it exactly, or even if that would work.
  
    http://www.mentalis.org/apilist/ExitProcess.shtml
  
I'm more concerned that WScript.Quit is sending the exit code back to
Declude in the wrong format, or possibly that you just can't use
vbscript, or at least WScript to return a result code.
  
This one little script is only one of many little but useful things
that could be done if I can get my hands around this.  I came across
similar problems when I was trying to create a handler for Sniffer that
would skip calling Sniffer if the weight was already high enough for my
Drop setting.  I thought the problem was related to retrieving the
result code from Sniffer, but it will echo it in testing, however I
can't get it to Declude in proper result code format.
  
Matt
  
  
  
  
Darin Cox wrote:
  




Probably need to use cscript to
call
the vbs file like "cscript filesize.vbs d0smd"
 
Also, it would probably be much
better to compile this into a C++ or C#/VB.net console app. 
Interpreted code like this runs a lot slower than compiled.  Haven't
done tests for this in the past couple of years, but it used to be an
order of magnitude faster for compiled over interpreted.

Darin.
 
 
-
Original Message -
From:
Matt

To: [EMAIL PROTECTED]

Sent: Tuesday, April 06, 2004 3:53 PM
Subject: [Declude.JunkMail] Test for message size and
return codes



Scott,

I have tried scripting several different things with vbscript for use
as external tests in Declude to no avail.  Here for example is a simple
piece of code that can detect if a message is above or below a certain
size:

Dim Args, oFSO, oFile
  
Set Args = WScript.Arguments
Set oFSO = CreateObject("Scripting.FileSystemObject")
Set oFile = oFSO.GetFile(Args(0))
  
If oFile.size > 102400 Then
    'Return a code of 1
Else
    'Return a code of 0
End If
  
Set Args = nothing
Set oFile = nothing
Set oFSO = nothing


I have comments in there for the result codes because I tried the
WScript.Quit(1) method and Declude doesn't pick that up.  From
everything that I have read, it appears that this is the preferred
method with vbscript (note that I'm not an expert in this area by any
means), and the ExitProcess method indicated in your manual is an old
work around that was appropriate (the only method) for old VB.

I've searched the Internet several times for a good example of
returning a result code to Declude and I'm a bit stumped.  I was hoping
that you or someone else has some vbscript examples that will work with
Declude.  A lot could be done to add little functions like a test for
size, which in my case, could be used to defeat certain filters that
are targeted at zombie spam which are heavy on the BODY searches, such
as GIBBERISH, !YDIRECTED, IPLINKED, and @LINKED (and I'm sure several
more at least).

Thanks,

Matt
-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
  
  
  -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Matt





Kevin and Darin,

This is something that would be configured as an external test in
Declude, and it's not calling any other programs so I'm not sure that
cscript is useful here.  If I was calling something like Sniffer, I do
understand that the call should be made with cscript though.  I also
understand the limitations of scripted code vs compiled code, but I can
do some basic scripting (most of my experience is in simple database
ASP stuff) and test some ideas before finding someone to code it up as
something that can be compiled.  For something as basic as checking
just the file size, this should work plenty fast though, it doesn't
even need to open the file.

The real issue that I have though is pumping out a result code from
vbscript to Declude.  From my reading of things, the WScript.Quit
method should do this, but it's not working.  BTW, there is no
CScript.Quit method.  Here's the page on MSDN for WScript.Quit:

   
http://msdn.microsoft.com/library/default.asp?url="">

I can't find anything else in vbscript that is supposed to be used for
returning a result code except for an old method for ExitProcess that
existed before WScript.Quit came around.  Here's an example of that,
but I'm not sure how to use it exactly, or even if that would work.

    http://www.mentalis.org/apilist/ExitProcess.shtml

I'm more concerned that WScript.Quit is sending the exit code back to
Declude in the wrong format, or possibly that you just can't use
vbscript, or at least WScript to return a result code.

This one little script is only one of many little but useful things
that could be done if I can get my hands around this.  I came across
similar problems when I was trying to create a handler for Sniffer that
would skip calling Sniffer if the weight was already high enough for my
Drop setting.  I thought the problem was related to retrieving the
result code from Sniffer, but it will echo it in testing, however I
can't get it to Declude in proper result code format.

Matt




Darin Cox wrote:

  
  
  
  
  Probably need to use cscript to call
the vbs file like "cscript filesize.vbs d0smd"
   
  Also, it would probably be much
better to compile this into a C++ or C#/VB.net console app. 
Interpreted code like this runs a lot slower than compiled.  Haven't
done tests for this in the past couple of years, but it used to be an
order of magnitude faster for compiled over interpreted.
  
Darin.
   
   
  -
Original Message -
  From:
  Matt
  
  To: [EMAIL PROTECTED]
  
  Sent: Tuesday, April 06, 2004 3:53 PM
  Subject: [Declude.JunkMail] Test for message size and
return codes
  
  
  
Scott,
  
I have tried scripting several different things with vbscript for use
as external tests in Declude to no avail.  Here for example is a simple
piece of code that can detect if a message is above or below a certain
size:
  
  Dim Args, oFSO, oFile

Set Args = WScript.Arguments
Set oFSO = CreateObject("Scripting.FileSystemObject")
Set oFile = oFSO.GetFile(Args(0))

If oFile.size > 102400 Then
    'Return a code of 1
Else
    'Return a code of 0
End If

Set Args = nothing
Set oFile = nothing
Set oFSO = nothing
  
  
I have comments in there for the result codes because I tried the
WScript.Quit(1) method and Declude doesn't pick that up.  From
everything that I have read, it appears that this is the preferred
method with vbscript (note that I'm not an expert in this area by any
means), and the ExitProcess method indicated in your manual is an old
work around that was appropriate (the only method) for old VB.
  
I've searched the Internet several times for a good example of
returning a result code to Declude and I'm a bit stumped.  I was hoping
that you or someone else has some vbscript examples that will work with
Declude.  A lot could be done to add little functions like a test for
size, which in my case, could be used to defeat certain filters that
are targeted at zombie spam which are heavy on the BODY searches, such
as GIBBERISH, !YDIRECTED, IPLINKED, and @LINKED (and I'm sure several
more at least).
  
Thanks,
  
Matt
  -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Darin Cox




Probably need to use cscript to call the vbs file 
like "cscript filesize.vbs d0smd"
 
Also, it would probably be much better to compile 
this into a C++ or C#/VB.net console app.  Interpreted code like this 
runs a lot slower than compiled.  Haven't done tests for this in 
the past couple of years, but it used to be an order of magnitude faster for 
compiled over interpreted.
Darin.
 
 
- Original Message - 
From: Matt 
To: [EMAIL PROTECTED] 

Sent: Tuesday, April 06, 2004 3:53 PM
Subject: [Declude.JunkMail] Test for message size and return 
codes
Scott,I have tried scripting several different things 
with vbscript for use as external tests in Declude to no avail.  Here for 
example is a simple piece of code that can detect if a message is above or below 
a certain size:
Dim Args, oFSO, oFileSet Args = WScript.ArgumentsSet 
  oFSO = CreateObject("Scripting.FileSystemObject")Set oFile = 
  oFSO.GetFile(Args(0))If oFile.size > 102400 
  Then    'Return a code of 1Else    
  'Return a code of 0End IfSet Args = nothingSet oFile = 
  nothingSet oFSO = nothingI have comments in there for 
the result codes because I tried the WScript.Quit(1) method and Declude doesn't 
pick that up.  From everything that I have read, it appears that this is 
the preferred method with vbscript (note that I'm not an expert in this area by 
any means), and the ExitProcess method indicated in your manual is an old work 
around that was appropriate (the only method) for old VB.I've searched 
the Internet several times for a good example of returning a result code to 
Declude and I'm a bit stumped.  I was hoping that you or someone else has 
some vbscript examples that will work with Declude.  A lot could be done to 
add little functions like a test for size, which in my case, could be used to 
defeat certain filters that are targeted at zombie spam which are heavy on the 
BODY searches, such as GIBBERISH, !YDIRECTED, IPLINKED, and @LINKED (and I'm 
sure several more at least).Thanks,Matt-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

RE: [Declude.JunkMail] Test for message size and return codes

2004-04-06 Thread Kevin Bilbee




Matt 
try using CSCRIPT to execute the script. CScript is the console version of WSH 
and it may return your code properly.
 
 
Kevin 
Bilbee

  -Original Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]On Behalf Of 
  MattSent: Tuesday, April 06, 2004 12:53 PMTo: 
  [EMAIL PROTECTED]Subject: [Declude.JunkMail] Test for 
  message size and return codesScott,I have tried 
  scripting several different things with vbscript for use as external tests in 
  Declude to no avail.  Here for example is a simple piece of code that can 
  detect if a message is above or below a certain size:
  Dim Args, oFSO, oFileSet Args = WScript.ArgumentsSet 
oFSO = CreateObject("Scripting.FileSystemObject")Set oFile = 
oFSO.GetFile(Args(0))If oFile.size > 102400 
Then    'Return a code of 1Else    
'Return a code of 0End IfSet Args = nothingSet oFile = 
nothingSet oFSO = nothingI have comments in there for 
  the result codes because I tried the WScript.Quit(1) method and Declude 
  doesn't pick that up.  From everything that I have read, it appears that 
  this is the preferred method with vbscript (note that I'm not an expert in 
  this area by any means), and the ExitProcess method indicated in your manual 
  is an old work around that was appropriate (the only method) for old 
  VB.I've searched the Internet several times for a good example of 
  returning a result code to Declude and I'm a bit stumped.  I was hoping 
  that you or someone else has some vbscript examples that will work with 
  Declude.  A lot could be done to add little functions like a test for 
  size, which in my case, could be used to defeat certain filters that are 
  targeted at zombie spam which are heavy on the BODY searches, such as 
  GIBBERISH, !YDIRECTED, IPLINKED, and @LINKED (and I'm sure several more at 
  least).Thanks,Matt-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

RE: [Declude.JunkMail] test EOM

2004-04-06 Thread Markus Gufler

 

> Is there any tests (or any chance to add in the near 
> future) for the message size and for the number of 
> recepients ?

http://www.mail-archive.com/[EMAIL PROTECTED]/msg16853.html

Markus

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] test EOM

2004-04-05 Thread serge




Scott,Is there any tests (or any chance to add in the near future) 
for the message size and for the number of recepients ?Or is there something 
similar in Hijack ?

RE: [Declude.JunkMail] Test not failed.

2004-03-29 Thread John Tolmachoff \(Lists\)

> It looks like this should have been caught.  Are there any spaces/tabs at
> the end of the line in the filter file?  Is that the last line on the file
> (if so, the cursor needs to be able to go to the line below it, by hitting
> ENTER at the end of the line if necessary)?

Bingo. Was the last line and I forgot to create another line underneath.

Thanks.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test not failed.

2004-03-29 Thread R. Scott Perry


Below is a message that did not fail a filter test, GreyFilter3. What am I
missing that it did not get caught?
Line in GreyFilter3:

HELO5   IS  srv1.eservicesforyou.net

Full Headers:

Received: from srv1.eservicesforyou.net [68.164.114.3] by
mail.eservicesforyou.net
  (SMTPD32-8.05) id A0A32AD30026; Sat, 27 Mar 2004 08:49:39 -0800
It looks like this should have been caught.  Are there any spaces/tabs at 
the end of the line in the filter file?  Is that the last line on the file 
(if so, the cursor needs to be able to go to the line below it, by hitting 
ENTER at the end of the line if necessary)?

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test for e-mail size?

2004-03-14 Thread Markus Gufler


> Is there anything that can test for e-mail size?  Often I 
> have people sending those damn pictures through Kodak and so 
> on and they often get caught by filters (gibberish, spam 
> domains, and so on) these messages are often over 75kb, so I 
> was wondering if there was a way that I could add a small 
> negative weight to messages over a certain size as I rarely 
> see spam that large and I'd rather have this get through then 
> have to look for it to release it.

Our external test SpamChk has 3 parameters to assign negative weights for
messages that are over 24, 48 and 64 kBytes of size. (for over a year now :)

Until now this test is working very good because large volumes of spam does
work only if the content is not very large. (Also if send trough zonbies.)
However we've seen that the 24kB value from one year ago is become a litle
bit too low.

Last time we've seen some sporadic spams with attachments (usually inside
images) that are larger then 64 kByte.

Maybe we will change this test in something linear. So the negative weight
is calculated on the message size, beginning from a start size (let's say 50
kB) and add 1 point for every additional 50 kB.

Markus


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test for e-mail size?

2004-03-12 Thread Matt

Big thumbs up on this one.  No need to process even the beginning of an 
E-mail containing a 1 MB attachment in JunkMail.  You mentioned 
introducing a low weighted version of SKIPIFWEIGHT, and this would work 
nicely with that to defeat custom filters.

BTW, have you given any thought to putting the SKIPIFWEIGHT settings in 
the Global.cfg file?  This would save the loading times on the custom 
filters in the majority of instances when used, and it would be easier 
to maintain by just adding two new columns to the filter definitions 
(including external tests), i.e.

- Current Format -
SNIFFER-GENERALexternal063
"C:\IMail\Declude\Sniffer\programname.exe mycode"60
GIBBERISH  filter  C:\IMail\Declude\Filters\Gibberish.txt
x00

- Potential New Format -
SNIFFER-GENERALexternal063
"C:\IMail\Declude\Sniffer\programname.exe mycode"6025 -10
GIBBERISH  filter  C:\IMail\Declude\Filters\Gibberish.txt
x0025-10

Matt





R. Scott Perry wrote:


Is there anything that can test for e-mail size?


No, but that sounds like it may make for a good test.  :)

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail 
mailservers since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test for e-mail size?

2004-03-12 Thread Andy Ognenoff

> Is there anything that can test for e-mail size?  Often I have people
> sending those damn pictures through Kodak and so on and they often get
> caught by filters (gibberish, spam domains, and so on) these messages are
> often over 75kb, so I was wondering if there was a way that I could add a
> small negative weight to messages over a certain size as I rarely see spam
> that large and I'd rather have this get through then have to look for it
> to
> release it.

I think if you use spamchk you can assign negative weight to the spamchk
score if the message is over 3 preset thresholds (24k, 48k, and 64k).
Nothing that allows you to choose the threshold though.

- Andy 


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test for e-mail size?

2004-03-12 Thread R. Scott Perry


Is there anything that can test for e-mail size?
No, but that sounds like it may make for a good test.  :)

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] test gfdsghb

2004-03-10 Thread John Tolmachoff \(Lists\)

Pong :)

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of TC Online Support
> Sent: Wednesday, March 10, 2004 9:21 AM
> To: Declude.JunkMail
> Subject: [Declude.JunkMail] test gfdsghb
> 
> nfdhgfgf
> 
> Isaias Hernandez
> Internet Tech Support
> 979-775-6239
> [EMAIL PROTECTED]
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus]
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

1 2 >

1 - 100 of 178 matches

Mail list logo