RE: Re[4]: [sniffer]

We are running Sniffer with the Mdaemon plug-in and SA and it seems to work great for us, much better than our previous Imail/Declude sniffer combination. Jim Matuska Jr. Computer Tech2, CCNA Nez Perce Tribe Information Systems [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTEC

RE: Re[4]: [sniffer]

Hi Pete, Here is my setup. I still have SpamAssassin running, for two reasons. 1. It allows my users to submit False Positives, False Negatives, and Whitelisted address'. By using the built-in email address' that Mdaemon provides for those. I then setup rules in the Mdaemon Content Filter to the

RE: Re[4]: [sniffer]

_M, <<_M said>> Is that true (do you think) or is it now more likely that SA would be disabled? I have no basis, but doubt that more than 5% of MDaemon configurations have SA disabled. I'm certain Sniffer would far benefit in the overall picture if you could create an installation that ties-in t

RE: Re[4]: [sniffer]

Well, I think you will likely find that most organizations do use Mdaemon's built-in SA implementation. I have it under fairly high load and have no problems with it. No tool is perfect, so I use mutlipe tools. SA gives me a lot of flexibility in writing my own custom rules, WhiteLists, BlackLis

RE: Re[4]: [sniffer]

I would respectfully disagree with this view; Message Sniffer is a very useful addition to the Anti-Spam tools in MDaemon, but SpamAssassin catches many thing correctly that Message Sniffer misses, and the opposite happens as well ... we have Message Sniffer catching things Spam Assassin can't do

Re: Re[4]: [sniffer] Charset

-Mad, How set up is Message Sniffer to determine if an e-mail in a foreign language is spam and then code for it. I dutifully submit my Spanish spam to the spam at sortmonster.com address. It's a very, very small percentage of my overall spam, but it consistently lands in my battleground grey-weig

Re: Re[4]: [sniffer] problems!!!!

Perhaps I used the wrong terminology about what changed, since I do not know what your system architecture is, but I remember you mentioning a significant change at the time. Immediately afterwards we saw a rash of false positives. That is what I would like to have controls in place to avoid. Da

RE: Re[4]: [sniffer] Effectiveness (lately)

Would the new attached fall under the same rule? John Tolmachoff Engineer/Consultant/Owner eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Pete McNeil > Sent: Thursday, July 29, 2004 9:56 AM > To: John Tolmachoff (Lists) > Subject:

RE: Re[4]: [sniffer] Rule Strengths

Do you want me to just keep sending them to [EMAIL PROTECTED] What worries me is even though these are to non-existent users, (yes Sandy, I have going to use ldap2aliases, I am working on a problem getting a recipient policy to work on one group that needs 2 sets,) I wonder how much of this is get

RE: Re[4]: [sniffer] Recent SPAM

-Original Message- From: Pete McNeil [mailto:[EMAIL PROTECTED] On Tuesday, November 30, 2004, 1:36:13 PM, Andrew wrote: CA> Pete, could you recap for us how to set up a "Declude project" to forward CA> non-sniffer-detected spam to a custom spamtrap address at SortMonster? CA> Perhaps two

Re: Re[4]: [sniffer] Few questions

Pete, PM> One other quick note/reminder. Use the snf2check utility on your PM> downloaded rulebase files before putting them in service. This will PM> ensure that you have a complete file that is not corrupted. Yeap..that is exactly what I did when I went back and looked at the files included in

RE: Re[4]: [sniffer] Persistent Sniffer

Pete, Wow, thank you for the explanation. I did let the persistent server run for 30 min after I restarted the services. However, I did stop the services, then started Sniffer service, then restart Imail services. I could have gotten a backlog of retries at that moment that pegged the CP

Re: Re[4]: [sniffer] POP Approach

Hi Pete, Do you send out notices to licensees to let them know to renew ahead of time? I think we're getting close to renewal, and want to make sure we don't lapse. Darin. - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Rick Hogue" Cc: <[EMAIL PROTECTED]> Sent: Frid

RE: Re[4]: [sniffer] Surprising missed spam

How does a user go about modifying the custom sniffer rules? Must Sort Monster be contacted or is it possible to do this with some other system (such as a web based interface)? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Tuesday, Sep

Re: Re[4]: [sniffer] Still having problems

At 01:50 PM 1/8/2005 -0500, Pete McNeil wrote: >>>Here's one way >>> >>>http://www.sawmill.net/formats/Message_Sniffer.html > >KM> That's the only one I found in the searching I've done. I'll probably >KM> give the trial version a shot but can't see paying $139 for it. I was >KM> hoping maybe som

RE: Re[4]: [sniffer] Still having problems

11:20 AM To: sniffer@SortMonster.com Subject: Re: Re[4]: [sniffer] Still having problems At 01:50 PM 1/8/2005 -0500, Pete McNeil wrote: >>>Here's one way >>> >>>http://www.sawmill.net/formats/Message_Sniffer.html > >KM> That's the only one I found in the sear

RE: Re[4]: [sniffer] New Spam/Virus?

Thanks Pete. John - John W. Enyart EAI, Inc. 3259 Blackberry Lane Malvern, PA 19355-9670 610/935/3085 FAX 610.935.3086 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Monday, June 06, 2005 6:22 PM To: Jim Matuska Subj

RE: Re[4]: [sniffer] POP3 Account Question

Pete, How about just creating some accounts that are commonly targeted by dictionary attacks, but that were never actually valid accounts on our server? I could redirect all of them to a common mailbox. There are also a few other "common" (non-role) addresses that we do not use, which always get t

RE: Re[4]: [sniffer] Bad Rule - 828931

David Drop the q/d files back into the \spool\proc directory. Declude will reprocess them. If you put them in just the \spool, queue manager will send them out in the next queue run, bypassing Declude. John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behal

RE: Re[4]: [sniffer] Bad Rule - 828931

I just ran the grep command on my log and I got 850 hits. Now is there a way to take the output of the grep command and use it pull out the total weight of corresponding message from the declude log file, or maybe the subject? Goran Jovanovic Omega Network Solutions > -Original Message--

RE: Re[4]: [sniffer] Bad Rule - 828931

nd figure out what I am going to do about it. Goran Jovanovic Omega Network Solutions > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Goran Jovanovic > Sent: Tuesday, February 07, 2006 8:39 PM > To: sniffer@SortMonster.com > Subj

RE: Re[4]: [sniffer] Bad Rule - 828931

lf Of Goran Jovanovic > Sent: Tuesday, February 07, 2006 5:39 PM > To: sniffer@SortMonster.com > Subject: RE: Re[4]: [sniffer] Bad Rule - 828931 > > I just ran the grep command on my log and I got 850 hits. > > Now is there a way to take the output of the grep command and > use i

RE: Re[4]: [sniffer] Bad Rule - 828931

ks. > -Original Message-> From: [EMAIL PROTECTED]> [mailto:[EMAIL PROTECTED]] On Behalf Of Goran Jovanovic> Sent: Tuesday, February 07, 2006 5:39 PM> To: sniffer@SortMonster.com> Subject: RE: Re[4]: [sniffer] Bad Rule - 828931>> I just ran the grep command on my log a

Re: Re[4]: [sniffer] Bad Rule - 828931

- Groetjes, Bonno Bloksma - Original Message - From: "Goran Jovanovic" <[EMAIL PROTECTED]> To: Sent: Wednesday, February 08, 2006 3:10 AM Subject: RE: Re[4]: [sniffer] Bad Rule - 828931 OK to answer my own question. Run the following commands grep -U "

RE: Re[4]: [sniffer] Version 2-3.0i8 published.

If we don't run the Mdaemon on our systems and just use the new download, will we also see a speed increase on processing. Thanks for the time. Keith -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Wednesday, October 20, 2004 1:50 PM T

RE: Re[4]: [sniffer] Version 2-3.0i8 published.

What we did was write a wrapper around sniffer, and fire that wrapper from the Content Filter. that wrapper measures how long each sniffer instance takes. In the previous version, it took way longer when using the persistent version than when not using the persistent version. You would expect it to

RE: Re[4]: [sniffer] LogRotate no longer working?

Hi, A) for what it's worth, I ran: rename mylicense.log mylicense.log.20041101051900 and the command prompt was able to rename the file WITHOUT problems (I didn't even stop the IMAIL or Sniffer services. So it appears that nothing locks the ".log" file. B) >> Under normal conditions the persist

RE: Re[4]: [sniffer] reporting spam in bulk

I use this program to send the messages with. It's setup to use with spamcop but you can also send to [EMAIL PROTECTED] http://www.daesoft.com/SpamSource/ This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com

Re: Re[4]: [sniffer] Rash of false positives

Hi Pete,   I'll send the logs for the past two days separately to support (at).  We do run snf2check on every downloaded rulebase, so that shouldn't be an issue.   The one thing I didn't think to do was to revert to an old rulebase, but we only keep the previous, so it would have already been

Re: Re[4]: [sniffer] Rash of false positives

This morning my server quit sending mail and my tech said the Dr. Watson error on the server was my Sniffer file...I rebooted and thought it was OK but quit again..I had a lot of mail back logged...so I updated a new rule base but it did not seem to helpI reinstalled Imail and things see

RE: Re[4]: [sniffer] Rash of false positives

, November 09, 2005 11:38 AM To: sniffer@SortMonster.com Subject: Re: Re[4]: [sniffer] Rash of false positives   This morning my server quit sending mail and my tech said the Dr. Watson error on the server was my Sniffer file...I rebooted and thought it was OK but quit again..I had a lot of mail

Re: Re[4]: [sniffer] Rash of false positives

.     - Original Message - From: John Moore To: sniffer@SortMonster.com Sent: Wednesday, November 09, 2005 12:42 PM Subject: RE: Re[4]: [sniffer] Rash of false positives We had this same thing happen. It has been happening more frequently recently and we are looking into disabling sniffer as it seems to

RE: Re[4]: [sniffer] Rash of false positives

email is less than 10,000 emails per day. J   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, November 09, 2005 1:47 PM To: sniffer@SortMonster.com Subject: Re: Re[4]: [sniffer] Rash of false positives   Are corrupted rulebase files the culprit

RE: Re[4]: [sniffer] When to go persistent

Hi, I just got my service up and running using Matt's post http://www.mail-archive.com/sniffer@sortmonster.com/msg00169.html It was simple especially since I already the resource kit installed. Now I know that this I supposed to work to get the persistent instance to load the new rulebase afte

RE: Re[4]: [sniffer] When to go persistent

> Sent: Friday, February 24, 2006 7:31 AM > To: sniffer@SortMonster.com > Subject: RE: Re[4]: [sniffer] When to go persistent > > Hi, > > I just got my service up and running using Matt's post > > http://www.mail-archive.com/sniffer@sortmonster.com/msg00169.html >

RE: Re[4]: [sniffer] Download server is really slow..

Pete, I'm downloading right now and its very slow. George -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Monday, December 20, 2004 6:39 AM To: Chuck Schick Subject: Re[4]: [sniffer] Download server is really slow.. On Monday, Decembe

RE: Re[4]: [sniffer] Download server is really slow..

Hello, I'm trying at the moment, Wget says 50-90 K/s (started at 40, went quick up to 90 and now going down to 50K/s) Alex This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html

RE: Re[4]: [sniffer] Large amounts of spam still getting through

Thanks Pete, I do not remember getting an update notification but that would definitely explain why we are getting go much spam now. Rick Hogue Intent.Net - Web Hosting 3802 Handley Avenue Louisville, KY 40218 1-502-459-3100 1-800-866-2983 Toll Free New Books Available "Prosperity Or Bet

RE: Re[4]: [sniffer] Lot of Drugs Spam getting through sniffer....

Just when you think we won the battle, they move the targets and change the rules. This is why we need people like Pete and Darrell to help us fight this ever changing war. A big thanks. John T eServices For You "Seek, and ye shall find!" > -Original Message- > From: [EMAIL PROTECTED]

Re: Re[4]: [sniffer] New Version 2-3.2 has been officially released.

Hi, [] > I understand. I have no reasonable explanation for your experience. > There have been no other reported problems and I have been unable to > recreate your conditions. > > BB> I just once more "installed" the 2.3.2 exe, we'll see what happens. As it is > BB> close to 9 PM overhere it s

RE: Re[4]: [sniffer] New Version 2-3.2 has been officially released.

> Well, still no problems so far so I'll write it up to . solar spots, pick whatever you want>. > It seems it was a one time thing. You must be referring to the RAW law. John Tolmachoff Engineer/Consultant/Owner eServices For You This E-Mail came from the Message Sniffer mailing list. For

Re: Re[4]: [sniffer] New Version 2-3.2 has been officially released.

Hi, > > Well, still no problems so far so I'll write it up to . > solar spots, pick whatever you want>. > > It seems it was a one time thing. > > You must be referring to the RAW law. RAW? Random Answer Whatchamacallit? > John Tolmachoff > Engineer/Consultant/Owner > eServices For You Met

RE: Re[4]: [sniffer] New Version 2-3.2 has been officially released.

> > > Well, still no problems so far so I'll write it up to . > > solar spots, pick whatever you want>. > > > It seems it was a one time thing. > > > > You must be referring to the RAW law. > > RAW? Random Answer Whatchamacallit? Random Acts of Weirdness The RAW law, Keyboard Virus and the

RE: Re[4]: [sniffer] Message Sniffer Plugin for MDaemon Wide Beta & Promo

Tip for MDaemon plug-in users. Sniffers .cfg file has an option 'not' to scan files larger than 'X'. If this option is set than no sniffer headers will be placed into the message (if the message is larger than 'X'). Beware, if you use MD's Content Filter to instruct where to send messages based

Re: Re[4]: [sniffer] Message Sniffer Plugin for MDaemon Wide Beta & Promo

I meant do I configure actions based on the headers that sniffer returns like in the non plug in version, or does the plugin do this automatically, the documentation for the plug in is kind of vague in comparison to the older version. Jim Matuska Jr. Computer Tech2, CCNA Nez Perce Tribe Informa

RE: Re[4]: [sniffer] Last chance to renew at the old price!

It shows 292.50 now on the site so evidently they are taking the price up. Rick Hogue Intent.Net – Web Hosting 3802 Handley Avenue Louisville, KY 40218 1-502-459-3100 1-800-866-2983 Toll Free New Books Available "Prosperity Or Better Times Ten" "Hot Slot Secrets" "The Incredible Inman'

RE: Re[4]: [sniffer] can auto-forward be disabled when spam is detected?

Really! so simply renaming the forward.ima to main.fwd accomplishes what he's talking about? Where is that documented in the Imail system? Is that feature reflected/available in the windows Imail admin interfaces? Rick Robeson getlocalnews.com [EMAIL PROTECTED] ---

RE: Re[4]: [sniffer] can auto-forward be disabled when spam is detected?

> You don't think having a 'Spam' subfolder is less complex than a totally separate account? The "complexity" I referred to, was from the admin/setup point of view. I think manually creating a forwarding file for each user, that will not show up on the UI, would be more complex than having o