Spam Filter ISP Forums : False Positives - what to do https://www.logsat.com/spamfilter/forums/ Sat, 10 Oct 2026 18:51:25 +0000 Sun, 07 Feb 2010 04:37:52 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6797 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[False Positives - what to do : Thank you Roberto I will...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6797&PID=13430&title=false-positives-what-to-do#13430 Author: MBor
Subject: 6797
Posted: 07 February 2010 at 4:37am

Thank you Roberto
 
I will monitor the spam situation after this change.
 
Kind Regards
]]> Sun, 07 Feb 2010 04:37:52 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6797&PID=13430&title=false-positives-what-to-do#13430 <![CDATA[False Positives - what to do : Mads,I would recommend bringing...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6797&PID=13429&title=false-positives-what-to-do#13429 Author: LogSat
Subject: 6797
Posted: 06 February 2010 at 10:18am

Mads,

I would recommend bringing back the SFDB value down to 3, and unchecking the "Do not quarantine" box as to continue having messages quarantined rather than simply being rejected. In regards to the "Attachments", I'm not sure of what setting you had for the attachment rejection, so I'm unsure on what to recommend there, as it is going to be specific to the kind of spam you were experiencing.
]]> Sat, 06 Feb 2010 10:18:08 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6797&PID=13429&title=false-positives-what-to-do#13429 <![CDATA[False Positives - what to do : Hello Roberto I have...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6797&PID=13423&title=false-positives-what-to-do#13423 Author: MBor
Subject: 6797
Posted: 04 February 2010 at 5:43am

Hello Roberto

 

I have positive feedback from our customers. E-mail with attached PDF documents no longer gets filtered by "keywords".

 

SpamPDFMaxPagesToScan=0 made the difference

 
Should I change back the settings I made before changing the SpamFilter.ini?

 

I experimented with:

1) Increased the SFDB Network Reliability threshold from 3 to 20

2) At the same time I have marked the "Do not quarantine" checkbox

3) In the Custom domain Filter tab, I have unchecked the "Attachments" for all mail domains

- should I re-enable checking attachments or is that overridden by the (above) SpamFilter.ini settings?

 

Kind regards

]]> Thu, 04 Feb 2010 05:43:13 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6797&PID=13423&title=false-positives-what-to-do#13423 <![CDATA[False Positives - what to do : Mads,We received your logs and...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6797&PID=13420&title=false-positives-what-to-do#13420 Author: LogSat
Subject: 6797
Posted: 03 February 2010 at 11:25pm

Mads,

We received your logs and replied to the other thread you mentioned. The solution for the crash mentioned there involves disabling the filter that scans thru PDF files. Newer versions of SpamFilter in fact do not employ this filter anymore due to its unreliability. Please see the other thread as to how to disable it in the older v3.x.
]]> Wed, 03 Feb 2010 23:25:15 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6797&PID=13420&title=false-positives-what-to-do#13420 <![CDATA[False Positives - what to do : Hello Forum I have started...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6797&PID=13418&title=false-positives-what-to-do#13418 Author: MBor
Subject: 6797
Posted: 03 February 2010 at 11:34am

Hello Forum

I have started another thread: Upgrading from 3.x to 4.x for better stability but one subject from that discussion is better suited to be in a new thread. 
 
We have increased difficulties to get our SpamFilter (3.5.4.692) to work right.  More and more we find that "This email is rejected. It contains keywords rejected by the antispam content filter". 

 

I believe we get more and more false positives.  Today I tracked an e-mail through SpamFilter and (an edited version of) the logfile reveals what happens.

 

02-03-10 15:54 -- (2684) Mail from: ZZ@somecompany.dk

02-03-10 15:54 -- (2684) - MAPS search done...

02-03-10 15:54 -- (2684) RCPT TO: AA@othercompany.dk accepted

02-03-10 15:54 -- (2684) Scanning PDF for spam:daglig_forward.pdf

02-03-10 15:54 -- (2684) Detected spam signature in attached PDF

02-03-10 15:54 -- (2684) Starting quarantine procedures

02-03-10 15:54 -- (2684) Created thread (3908) to add email to quarantine

02-03-10 15:54 -- (2684) Blacklist cache - Added 1xx.1xx.xxx.xxx to limbo

02-03-10 15:54 -- (2684) SFDB - Added 1xx.1xx.xxx.xxx - Response: Error=0

02-03-10 15:54 -- (2684) Disconnect

 

The attached document is not spam.  The sender ZZ can e-mail this attachment to all but our customer AA (which we host in our mail hotel). Further more the senders IP is added to SFDB and therefore blocked for 24 hours.  I asked ZZ to send an e-mail without attachment to AA and of course this came back to ZZ with an error.  Unfortunately I cannot get the "X-Rejection-Reason" from the header. 

 

Now that I have had time to look into SFDB I can see that our threshold was set to 3.  I have now increased it to 20.  At the same time i have marked the "Do not quarantine" checkbox and therefore I hope I can get less rejection.

 

The question is: is this a stupid setting?

 

Kind Regards

 

]]> Wed, 03 Feb 2010 11:34:58 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6797&PID=13418&title=false-positives-what-to-do#13418