Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed -
  FAQ FAQ  Forum Search   Register Register  Login Login

"Log key words that trigger rejects."

 Post Reply Post Reply
Author
CyberBob View Drop Down
Groupie
Groupie


Joined: 26 January 2005
Status: Offline
Points: 43
Post Options Post Options   Thanks (0) Thanks(0)   Quote CyberBob Quote  Post ReplyReply Direct Link To This Post Topic: "Log key words that trigger rejects."
    Posted: 22 November 2004 at 11:30am

When you are looking at the "Keywords filter" tab and check the box "Log key words that trigger rejects."

What log is created to track these? Where is it at?

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4065
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 22 November 2004 at 11:24pm
Bob,

In the SpamFilter ISP's activity log each time an email is blcoked because of a keyword, the log will record something like the following:

09/08/04 00:02:35:032 -- (416) Found Keywords: [get your free]

In the quarantine database, the tblQuarantine table will also log the keywords in the RejectDetails column. You can find all emails blcoked due to keywords by executing the following query:

SELECT * FROM tblQuarantine WHERE (RejectID = 13)

Roberto F. LogSat Software
Back to Top
CyberBob View Drop Down
Groupie
Groupie


Joined: 26 January 2005
Status: Offline
Points: 43
Post Options Post Options   Thanks (0) Thanks(0)   Quote CyberBob Quote  Post ReplyReply Direct Link To This Post Posted: 23 November 2004 at 10:30am

Thanks but let me specify better.

Whether the box "Log key words that trigger rejects" is checked or not I see no change in the logs? What does the check box do?

I have a report setup to track error code 13 and I see the keywords that trigger the rejects if the box is checked or unchecked?

So it made me wonder if there was a separate log file being created?

**** Here's my thought. IF we could track ONLY the keywords that trigger rejects then we could create a script to compare that to our keyword list. I could then see which keywords are the most effective and keep my keyword list lean and concise. That is why I requested one other time to remove Blocked Attachments from error code 13.

I know I could run a script to look for blocked keywords also but it would be cleaner to have a list that is only keywords.

That's my two cents for now. Ideas are welcomed!

Bob

Back to Top
Ric Marques View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Ric Marques Quote  Post ReplyReply Direct Link To This Post Posted: 23 November 2004 at 1:05pm

Since that feature isn't in the program now, you could try:

SELECT        rejectdetails,
              COUNT(*) AS detailcount
FROM          tblquarantine
WHERE         rejectid=13
AND           deliver = 0)
AND           expire = 0
AND           (Left(RejectDetails,44) <> 'Found Keywords: [Found prohibited attachment')
GROUP BY      rejectdetails
ORDER BY      detailcount DESC

This will return all keywords found, with the corresponding number of times found in the quarantine database in descending order, but will exclude the 'prohibited attachment' records.

Will this get you closer to what you want?

-Ric

Back to Top
CyberBob View Drop Down
Groupie
Groupie


Joined: 26 January 2005
Status: Offline
Points: 43
Post Options Post Options   Thanks (0) Thanks(0)   Quote CyberBob Quote  Post ReplyReply Direct Link To This Post Posted: 24 November 2004 at 10:32am
Thanks I'll try this and get back to you!
Back to Top
CyberBob View Drop Down
Groupie
Groupie


Joined: 26 January 2005
Status: Offline
Points: 43
Post Options Post Options   Thanks (0) Thanks(0)   Quote CyberBob Quote  Post ReplyReply Direct Link To This Post Posted: 24 November 2004 at 1:33pm

You were close. Here is the report I was looking for. You may have to change the table name from dbo_tblQuarantine to tblQuarantine depending on your configuration.

SELECT DISTINCTROW Count(dbo_tblQuarantine.RejectDetails) AS CountOfRejectDetails, dbo_tblQuarantine.RejectDetails
FROM dbo_tblQuarantine
WHERE (((dbo_tblQuarantine.RejectID)=13))
GROUP BY dbo_tblQuarantine.RejectDetails
HAVING (((Count(dbo_tblQuarantine.RejectDetails)) Not Like "*Found prohibited attachment*"))
ORDER BY Count(dbo_tblQuarantine.RejectDetails) DESC;

Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.109 seconds.