Spam Filter ISP Forums : Not impressed https://www.logsat.com/spamfilter/forums/ Thu, 12 Mar 2026 03:22:19 +0000 Wed, 05 Dec 2007 16:46:46 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6306 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Not impressed : Hyldsgaard wrote:Every...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11274&title=not-impressed#11274 Author: atifghaffar
Subject: 6306
Posted: 05 December 2007 at 4:46pm

Originally posted by Hyldsgaard Hyldsgaard wrote:

Every day I receive lots of emails that is obviously spam but Spam Filter just lets it right through.



Not trying  to be a fan boy,  Here are the result of  ONE day analysis
sorry about the fomattig,

+----------+-------------------------------------------+---------+
| rejectid | rejectdesc                                | Total   |
+----------+-------------------------------------------+---------+
|       19 | URL in email found in SURBL search        | 1347328 |
|       13 | Keywords found in content                 | 1103101 |
|       21 | SFDB filter match                         |  607959 |
|       15 | SPF Sender Policy Framework match         |  150683 |
|        1 | Domain is in local blacklist file         |  116063 |
|        8 | IP address is from a blacklisted country  |   73295 |
|       18 | IP blocked by honeypot entry              |   36390 |
|        7 | Exceeded maximum number of RCPT TO        |    4452 |
|       23 | Found prohibited attachment               |    2835 |
|       20 | Detected spam signature in embedded image |    1312 |
|       24 | Blank email with PDF attachment only      |     902 |
|        9 | EmailTO is in local blacklist file        |     890 |
|       25 | Too many spaces in subject                |      92 |
+----------+-------------------------------------------+---------+
13 rows in set (1 min 45.03 sec)



Edited by atifghaffar - 05 December 2007 at 4:47pm]]> Wed, 05 Dec 2007 16:46:46 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11274&title=not-impressed#11274 <![CDATA[Not impressed : I get an alert if there are more...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11273&title=not-impressed#11273 Author: atifghaffar
Subject: 6306
Posted: 05 December 2007 at 3:42pm

I get an alert if there are more than 30K quarantines/hour.
These days I am filtering them out a a different folder!

]]> Wed, 05 Dec 2007 15:42:11 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11273&title=not-impressed#11273 <![CDATA[Not impressed : Desperado, I have to to keep 10...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11272&title=not-impressed#11272 Author: atifghaffar
Subject: 6306
Posted: 05 December 2007 at 3:40pm

Desperado, I have to to keep 10 days record. So I keep 11 days.
It used to be 20-30 million entries but these days its getting like 35-40 million.

The good thing about this bad effect is that SF is working very well.! :-)


]]> Wed, 05 Dec 2007 15:40:15 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11272&title=not-impressed#11272 <![CDATA[Not impressed : Atif, We try to keep our quarantine...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11271&title=not-impressed#11271 Author: Desperado
Subject: 6306
Posted: 05 December 2007 at 3:17pm

Atif,
 
We try to keep our quarantine below a million records.  At that level, a "quick Query" like Robertos takes about 5 seconds MAX.  A full query which has to do tome text searches still only takes about 35 to 40 seconds.  I would not even think about doing a full query on 20 million records.
]]> Wed, 05 Dec 2007 15:17:53 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11271&title=not-impressed#11271 <![CDATA[Not impressed : Desperado,Do you make reports...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11270&title=not-impressed#11270 Author: atifghaffar
Subject: 6306
Posted: 05 December 2007 at 3:01pm

Desperado,

Do you make reports from your queries every day or can you run your queries at any time.

I dont see how it can be really fast with 20-30 million rows in the tblquarantine.

The parsing the log way is much slower but at least it can be done offline on a different report-server.

Thanks for sharing

]]> Wed, 05 Dec 2007 15:01:21 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11270&title=not-impressed#11270 <![CDATA[Not impressed : LogSat wrote:Atif,As an FYI,...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11269&title=not-impressed#11269 Author: atifghaffar
Subject: 6306
Posted: 05 December 2007 at 2:58pm

Originally posted by LogSat LogSat wrote:

Atif,

As an FYI, there's a simple query you can execute that will give you the breakdown of the types of spam currently in the quarantined database. It is nowhere as detailed as the reports Sawmill provides, but could be useful for quick reports:

SELECT tblQuarantine.RejectID, tblRejectCodes.RejectDesc,
COUNT(tblQuarantine.RejectID) AS Total
FROM tblQuarantine INNER JOIN
tblRejectCodes ON tblQuarantine.RejectID =
tblRejectCodes.RejectID
GROUP BY tblQuarantine.RejectID, tblRejectCodes.RejectDesc
ORDER BY TOTAL DESC


Roberto, thanks, but please some consideration for us running a caseSensitive OS.

this should be

SELECT tblquarantine.rejectid, tblrejectcodes.rejectdesc,
COUNT(tblquarantine.rejectid) AS Total
FROM tblquarantine INNER JOIN
tblrejectcodes ON tblquarantine.rejectid =
tblrejectcodes.rejectid
GROUP BY tblquarantine.rejectid, tblrejectcodes.rejectdesc
ORDER BY TOTAL DESC
]]> Wed, 05 Dec 2007 14:58:45 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11269&title=not-impressed#11269 <![CDATA[Not impressed : You need to tune it properly for...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11246&title=not-impressed#11246 Author: Stupid
Subject: 6306
Posted: 03 December 2007 at 9:25am

You need to tune it properly for about a month before declare it's ineffective.

After that, you will find you will face a totally different problem, not with Sapmfilter, but with spam - what are you going to do with them?
]]> Mon, 03 Dec 2007 09:25:16 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11246&title=not-impressed#11246 <![CDATA[Not impressed : Atif, Bare in mind that the...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11239&title=not-impressed#11239 Author: Desperado
Subject: 6306
Posted: 30 November 2007 at 4:13pm

Atif,
 
Bare in mind that the SQL query is FAST.  The only issue is that if a customer has forced messages through or removed messages, those stats will not be included.  I do, however, rely on the SQL queries for most checking as it is WAY faster than parsing all the logs.
]]> Fri, 30 Nov 2007 16:13:26 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11239&title=not-impressed#11239 <![CDATA[Not impressed : Atif,As an FYI, there&#039;s a...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11238&title=not-impressed#11238 Author: LogSat
Subject: 6306
Posted: 30 November 2007 at 3:59pm

Atif,

As an FYI, there's a simple query you can execute that will give you the breakdown of the types of spam currently in the quarantined database. It is nowhere as detailed as the reports Sawmill provides, but could be useful for quick reports:

SELECT tblQuarantine.RejectID, tblRejectCodes.RejectDesc,
COUNT(tblQuarantine.RejectID) AS Total
FROM tblQuarantine INNER JOIN
tblRejectCodes ON tblQuarantine.RejectID =
tblRejectCodes.RejectID
GROUP BY tblQuarantine.RejectID, tblRejectCodes.RejectDesc
ORDER BY TOTAL DESC
]]> Fri, 30 Nov 2007 15:59:32 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11238&title=not-impressed#11238 <![CDATA[Not impressed : Atif, I use &#034;Sawmill&#034;...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11237&title=not-impressed#11237 Author: Desperado
Subject: 6306
Posted: 30 November 2007 at 3:37pm

Atif,
 
I use "Sawmill" by Flowerpower.  It is a generic log parsing program which I have written a custom "filter Plugin" for.  When shipped, Sawmill does support the LogSat format but does not have my latest filter.  I will be sending that to them.
]]> Fri, 30 Nov 2007 15:37:01 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6306&PID=11237&title=not-impressed#11237