Today we had someone send out a message with an attachment (250k) to a large group of recipients.  Many of those messages bounced back, and were quarantined (empty e-mail from). 

I released the messages from quarantine to be forwarded to the user (so he could clean up his mailing list), and noticed that the Activity window in SpamFilterISP wasn't showing very many messages being added into the corpus database (the 'Time to add Msg to...' messages became very few and far apart - also the time increased significantly - from an average of 9-16ms to 17000-25000), and the corpus.ini file wasn't reflecting new good or bad messages being added to the corpus (I upgraded to the beta this morning - and have been keeping a close eye on the statistics as well as all messages being quarantined).

Is it possible that the attachment body is being scanned on flase positive messages for tokens?  I looked in the /corpus/queue folder, and there are currently 215 files in there ranging from 0 bytes to 273K (the approx size of the encoded message that bounced back).

-Ric

Ric,

We jsut released a new beta build today, you may want to upgrade. The prvious betas have issues that could cause the Bayesian filter to stop adding new incoming emails to the corpus database. There should never be more than 1-2-3 files in the corpus\queue directory, since it's a staging area for incoming messages, which should get processed in a matter of milliseconds. If you have that many files in there, that's a sign that new emails are not added to the corpus. Restarting SpamFilter usually restarts the process.

Roberto F.
LogSat Software