Hi,
After three days where the server would max out at 100% due to a lot of
smtp32 processes but.. also where there were not so many smtp32
processes I have now tried to revert back to 1.65, was using 1.70i1. In the
past few days I have reset the server several times but it would max out
again
I see the same (with a very small domain and very light usage). The mail
server is nowhere near the strongest, but is sometmies stressed with 1.70
(and was the same with 1.69b) but not 1.65.
My recommendation for those that are experiencing this is to try adding a
line "DECODE OFF" to the \IMail
Hi Scott,
> >I see the same (with a very small domain and very light usage). The mail
> >server is nowhere near the strongest, but is sometmies stressed with 1.70
> >(and was the same with 1.69b) but not 1.65.
>
> My recommendation for those that are experiencing this is to try adding a
> line "D
I keep getting mail that slipps through that IMO shouldn't be that
hard to catch really... They use a variant of the html comments but
the way they do it it don't get detected as a mail with to many html
comments.
Below is a snippet of example text inside the html formated e-mail :
Penis
Enlarge
Title: Message
Hi;
Is anyone keeping
track or have any stats on the % of spam in:
.biz
.us
domains?
From what I see it
appears .biz and .us type domains have a higher probability of being SPAM as a
percentage of legitimate emails with those domains.
Regards,
Kami
Title: Message
What
do you mean?
Mail
from these domains or mail to these domains?
-Original Message-From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]On Behalf Of Kami
RazvanSent: Wednesday, June 04, 2003 3:19 PMTo:
[EMAIL PROTECTED]Subject: [Declude.JunkMail] Stats on
I guess you would do checks on the negative weights first and then the
positive and at any point a test goes above the threshold you would
stop. Unless by adding all the positive tests together it would still
be below threshold whereas you wouldn't need to do any positive tests
(unlikely though).
As an ISP we decide the best way to handle spam was to rank and tag so
the user can decide, in this case we must have all tests process so that
the rankings are accurate. If Scott's team were to add some mechanism
to optionally process portions, that would be fine, at least his team
understands th
Mail from these domains..
Based on what I see .. email coming from email addresses with .biz or .us
have a higher probability of being a spam than .com.
Of course this is a matter of percentage. We don't receive that many emails
with .biz but from what I see majority (if not all) emails with t
I think you need to skip attachments or at least make it an option in the
CFG file. I have already discounted the use of BASE64 test because if there
is a text attachment the test will be triggered.
Why do you need full-mime support to skip attachments??
Kevin Bilbee
-Original Message-
I think you need to skip attachments or at least make it an option in the
CFG file.
That's something that we are looking into. Note, however, that few
anti-spam programs have full MIME support in them (Ipswitch doesn't for
example). MIME decoding is very complex (it took Ipswitch years to get
Title: Message
We're seeing more and more valid domains using
.biz, .us and .info. I think it's taking a while but they are finally
starting to be adopted.
-David
I posted this on the Declude Virus list and didn't get any response. (Hope
is wasn't a stupid question :-). Anybody here have anything to offer?
Thanks. -David
>I just noticed on Declude site that it is compatible for use on a RAM
drive.
>Haven't used one of these since DOS but trying to squeeze
IMO, RAM drives are best for page files and databases.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of David Sullivan
> Sent: Wednesday, June
Windows & .NET Magazine (which mentioned Declude JunkMail in their April,
2003 Enterprise Spam Filters Buyers Guide) is having a "Reader's Choice"
vote, where you can let them know what software you think is the best in
its class, and even which offer the best support.
If you think that the Dec
Don't get scared the from the very long list, you don't have to vote on
everything.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, June 04, 2003 7:47 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Vote for Declude!
Yeah, declude is not very much HDD IO intensive, CPU power is the key.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Wednesday, June 04, 2003 7:27 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Declude on RAM Drive
This is an entry from today's dec.log file. There are others like it.
06/04/2003 12:09:23 Q27c20609028ae1d0 Msg failed OSSRC (This E-mail came
from 207.44.129.132, a potential spam source listed in OSSRC.).
Action=SUBJECT.
Yet when I run the IP address in www.dnsstuff.com 's Spam Database L
This is an entry from today's dec.log file. There are others like it.
06/04/2003 12:09:23 Q27c20609028ae1d0 Msg failed OSSRC (This E-mail came
from 207.44.129.132, a potential spam source listed in OSSRC.).
Action=SUBJECT.
Yet when I run the IP address in www.dnsstuff.com 's Spam Database L
Charles:
>They need to not be greedy matches or better yet support a very small set
of rules, an overly simplified
>engine could allow for word boundries and whitespace with optional letters
and make word and phrase
>filters much more powerful.
I agree, regular expressions are somewhat more powerf
It probably just recently dropped out of the OSSRC database and possibly
your DNS that JunkMail is using still has the old entry cached.
Bill
- Original Message -
From: "Todd Praski" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, June 04, 2003 11:40 AM
Subject: [Declude.Junk
Kami,
I'm running ten IP4r tests, referred to in my original email as an "external DB
query." There seems to be a descrepency between this as a cause and Scott's answer:
> the Declude process should not show high CPU usage in this case.
> Declude uses the "Sleep()" command, which giv
Scott,
The servers in question are not [yet] running Declude Virus so what happened should be
a purely Declude JunkMail question. With as lean as Declude is, looks like the only
way to test this is in the moment. During yesterdays "moment", it was tuff to sit by
turning off one test at a time
Hi,
Would this cause BADHEADERS failure for bogus Message ID?
<[EMAIL PROTECTED]> (real IP changed to protect the
guilty)
I assume it's the IP address that's bogus?
Thanks
David
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the
Assuming we're all talking about the same thing, Declude continues to run
as a process waiting for replies from IP4r requests but does not consume
much CPU time while doing so.
That is correct. It should use very, very little CPU time while waiting
for the results to come back.
Does pulling o
Would this cause BADHEADERS failure for bogus Message ID?
<[EMAIL PROTECTED]> (real IP changed to protect the
guilty)
I assume it's the IP address that's bogus?
Yes, it would. That's not a valid Message-ID: header.
Specifically, the RFCs require that if an IP address is used, it be in
[bracke
I truly wish I could explain it..
May be I am dreaming.. But what I see is Declude does not get to 100% CPU
since we moved it to IMail to do IP4r.
This morning for example I saw about 10 or so Declude processes.. One at
19%.. A lot at 0% and then jumping to 10% and going away some hit 100% for 1
I have noticed that using the v1.65 I never see Declude use more the 45%
CPU.
Using 1.70 Beta I see Declude Max the CPU's 100%
Has anyone else seen the same.
Fred
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, June 04, 2003 4
Kami,
Is your DNS that IMAIL/Declude uses local to you? Or are you using an
upstream DNS? That many IPV4 tests may warrant this. We noticed a large
performance boost by using a DNS on the local LAN.
Just a thought
- Original Message -
From: "Kami Razvan" <[EMAIL PROTECTED]>
I played with a content body test for .biz/ and had FPs in no time. You can play with
a low weight test with these, but their use will only increase with time. I treat
them the same as .net/.org/.com, one [painfully slow] iteration at a time.
Dan
On Wednesday, June 4, 2003 6:19, Kami Razvan
Thats interesting, I upgraded both of the problem servers to 1.70 two days (about 36
hours) before this hit. I'm going to see if I can switch back to 1.69iX to see if
there is a difference.
Dan
On Wednesday, June 4, 2003 14:50, Frederick Samarelli <[EMAIL PROTECTED]> wrote:
>I have noticed th
Hi;
Our DNS is local. Same IP range and 2 racks above the mail server.
We are also using IMail 8 with the cache DNS option- if that makes a
difference with our configuration it is hard to say.
Regards,
Kami
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behal
I'm not exactly sure how the JunkMail engine works,
so I apologize in advance if this is a rookie question.
Although JunkMail does a great job of catching English-based
junk emails I still get very basic Spanish and Korean (I think)
spam emails. So, does JunkMail catch non-English junk mail?
Any ot
This leads me to ask a question? What char set(s)\Codepage(s) does junkmail
support???
Example answer I am looking for would be UTF-8.
Kevin Bilbee
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Jose Gosende
> Sent: Wednesday, June 04, 2003 4:15 PM
>
I'm not exactly sure how the JunkMail engine works,
so I apologize in advance if this is a rookie question.
Although JunkMail does a great job of catching English-based
junk emails I still get very basic Spanish and Korean (I think)
spam emails. So, does JunkMail catch non-English junk mail?
Any o
This leads me to ask a question? What char set(s)\Codepage(s) does junkmail
support???
Example answer I am looking for would be UTF-8.
You'll need to be more specific.
Declude JunkMail will process the E-mails no matter what character set(s)
they use. All of the Declude JunkMail processing shou
Kami, just for the heck of it, turn off Imail DNS caching and see what
happens.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Kami Razvan
> S
I see the same (with a very small domain and very light usage). The mail
server is nowhere near the strongest, but is sometmies stressed with 1.70
(and was the same with 1.69b) but not 1.65.
> -Original Message-
> From: Frederick
> I have noticed that using the v1.65 I never see Declude
That answers my question?
Thank you.
Kevin
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Wednesday, June 04, 2003 5:49 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] language limitation?
>This leads me to ask a question?
Read the manual about the Anti-Spam settings so you can disable them until
you want to enable them. Many people have had problems with messages being
sent to the root address.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
> -Original Message-
> Fr
40 matches
Mail list logo
