Morten,

Are you using Regular Expressions in your keywords or "literal" words?  When using literals, one risk is that binary attachments contain one long string of characters and eventually, odds are, a match will turn up.  Our customers send pdf's all the time and do not seem to have that issue but I use all regular expressions.

Regards,

Dan S. (SF User)

Morten,

What version are you running?  Also, many users dissagree with me but I feel that literals only get you into trouble.  With literals, your chances of false positives becomes very high. What is good about the regular expressions is that you can filter on the methods that Spam uses to get past filters rather than the words themselves.  That way you are not "Censoring" the messages but blocking messages that are attempting to obscure their content.  That is not to say that I have ZERO literals in my expressions but I limit the use.  I actually only have 20 keywords (at this exact time) and I block an incredible amount of Spam with a very low "False Positive" count.

Some of my expressions will not work with older versions of SpamFilter.  I have some that look at the "Subject" field which is a fairly new feature.  That is why I asked about the version you are running.  If you are serious about filtering Spam for your users and are actually looking to purchase a product, I feel that SpamFilter is a great value.  If this is the direction you are going in, let me know and I can show you some examples of RegEx's that may solve your problem with blocked pdf files.

Regards,

Dan S.

Thanks for your help!

The keywordlist can be downloaded here --> http://www.authen.no/keywords.txt

Thanks again!

Morten,

We've double-checked, and PDF attachments are being correctly skipped by the keyword searches. Your keyword list is very reasonable, and while it may trigger just a small handlful of false positives it does not appear to be made of keywords that would cause you to loose PDFs.

We've added your keywords to our own SpamFilter handling LogSat's emails. Could you please send us one such emails with PDFs to support@logsat.com, followed by one without an attachment so we'll know how to find it if it does get blocked?

Could you also please send us one of your zipped SpamFilter's activity logs for a day when such emails were blocked? We'll need to know the to/from email addresses involved and the time the email was sent so we can find it.

Roberto F.
LogSat Software