Spam seems to be climbing after new 384 release |
Post Reply 
|
| Author | |
Terry 
Guest Group 
|
 Post Options
 Thanks(0)
 Quote Reply
 Topic: Spam seems to be climbing after new 384 releasePosted: 25 September 2004 at 6:14pm |
|
I am seeing what appears to be a trend in increased spam getting through since I upgraded to release 384. I am trying to make sense out of the log here but when I look at it it really appears that it is blocking part of the emails and accepting others from the same message? Maybe I just don't understand this or am missing something obvious? I will do some more research...but this this log excerpt for 3900 appear right to you or is it saying part of the transactions are going through? Terry 09/25/04 14:45:00:220 -- (3900) Connection from: 218.128.168.126 - Originating country : Japan |
|
 |
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4106 |
Post Options
Thanks(0)
Quote Reply
Posted: 25 September 2004 at 11:01pm |
|
Terry,At first sight no, it does not look right as the email should have been rejected. Without looking at all your black/white list files and SpamFilter.ini files we can't be sure though. If you can send them to support@logsat.com we'll take a look, but please note that within 3-4 hours we'll have a hurricane over our heads, and we may loose power/internet/phones for a few days as it happened twice already (we're in central florida). This may delay our technical support respoinses a bit.One thing you can check is to make sure you have a valid 3-digit code prefixing *all* of your "Customized Items" tab under settings. If there is not a valid error code, even though an email is to be rejected, since SpamFilter does not have a valid error code to provide the remote server, it has no chouce but to accept the email anyways.Roberto F.
LogSat Software
|
|
|
|
|
Terry
Guest Group
|
Post Options
Thanks(0)
Quote Reply
Posted: 26 September 2004 at 8:00pm |
|
Roberto, I have emailed the files per your request. Hope all goes okay with the hurricane... Terry |
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4106 |
Post Options
Thanks(0)
Quote Reply
Posted: 28 September 2004 at 12:21am |
|
Terry, we finally had power returned this evening. Right away we were able to verify that you're correct, your logs and settings do show a problem sometimes in cases where 3 or more recipients appear in an email.I believe we pinpointed the problem, and have made a pre-release build available to address it. If youlogin the registered user are you will see build 385. Please note that as we just (actually as you just have) discovered the problem, we were not able to thoroughly test it yet.The release notes for this build are as follows:// New to VersionNumber = '2.1.1.385';
{TODO -cWish : Add label to indicate "Bayesian Probability results show up in Corpus Database tab"}
{TODO -cFix : if more than 3 RCPT TO's were specfied, spam emails may have not been filtered}
{TODO -cWish : Add option to specify directory path for logfiles}Roberto F.
LogSat Software
|
|
|
|
|
Terry
Senior Member 
Joined: 06 February 2005 Status: Offline Points: 155 |
Post Options
Thanks(0)
Quote Reply
Posted: 28 September 2004 at 4:59pm |
|
Thanks Roberto, I have downloaded and installed it. I will let you know how it does.
|
|
|
|
|
Alan
Guest Group
|
Post Options
Thanks(0)
Quote Reply
Posted: 30 September 2004 at 7:53pm |
|
Roberto, I also tried the new build, but I am still experiencing this same problem with the 385 build. 09/30/04 16:35:31:719 -- (425) Connection from: 199.181.164.12 - Originating country : United States |
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4106 |
Post Options
Thanks(0)
Quote Reply
Posted: 30 September 2004 at 11:29pm |
|
Alan, Judging from these logs, everything seems to be working as expected: Nothing is causing the email to rejected for the following entries: 09/30/04 16:35:31:719 -- (425) Connection from: 199.181.164.12 - Originating country : United States Up until here, even though the email may be spam as far as I can tell (if only we could have a new build that features a live human person looking at spam we'd be infallible!), none of the filters detect it as spam so it's delivered. Note that from the logs it looks as if the sender has ended the DATA command, which forces SpamFilter to deliver the email. Rather than disconnecting and then reconnecting, the senders appears to remain connected with the same session, and starts to send more commands to send a separate email. But now the first RCPT TO command triggers one of your blacklists: At this point, SpamFilter (correctly) immediately disconnect them. If we interpreted the logs correctly, SpamFilter is operating correctly. Please let us know if you see something wrong with our analysis. Roberto F. |
|
|
|
Topic Options|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.125 seconds.