Thomas,
I think I found the original tagmode issue below:
In sub PBOK:
return 1 if $totalscore<$PenaltyLimit;
Should be:
return 1 if $totalscore<$PenaltyMessageLimit && $DoPenalty != 4;
Which allows PBOK check in getbody() to handle as thisIsSpam rather than
falling through and being handled by isnotspam.
Michael Thomas
Mathbox
978-687-3300
Toll Free: 1-877-MATHBOX (1-877-628-4269)
> -----Original Message-----
> From: Michael Thomas [mailto:mike@...]
> Sent: Thursday, October 28, 2010 4:05 AM
> To: 'ASSP development mailing list'
> Subject: [Assp-test] FW: Penalty Box - Message Scoring
>
>
> Thomas,
>
> While logging and comparing log to code, noted that
> $PenaltyLimit is used,
> but never defined and never assigned a value:
>
> sub PBOK - return 1 if $totalscore<$PenaltyLimit;
>
> sub PBExtremeOK - if ( $totalscore >= $PenaltyLimit && $totalscore <
> $PenaltyExtreme ) {
>
> sub cleanBlackPB - if ($tdif>$PenaltyDuration*60 &&
> $score<$PenaltyLimit ) {
>
> In all three cases, I believe $PenaltyLimit should be
> $PenaltyMessageLimit.
>
> Michael Thomas
> Mathbox
> 978-687-3300
> Toll Free: 1-877-MATHBOX (1-877-628-4269)
>
> > -----Original Message-----
> > From: Michael Thomas [mailto:mike@...]
> > Sent: Sunday, October 24, 2010 2:55 PM
> > To: 'ASSP development mailing list'
> > Subject: Re: [Assp-test] Penalty Box - Message Scoring
> >
> >
> > Thomas,
> >
> > For load balancing and redundancy, I have three virtual
> > incoming MX. Issue
> > shows on all three. Mx01 handles 70% of load, mx02 handles
> > 20% of load, and
> > mx03 handles 10% of load. So, I do not think it is load
> > factor. It does not
> > happen to every message. Most messages that score similarly
> > are tagged.
> >
> > At first, I thought it might be related to the fact that I
> disabled PB
> > Extreme, but after monitoring, I realized that it was not all
> > messages,
> > there were similar messages getting tagged.
> >
> > I will turn up logging to debug level and monitor.
> >
> > Michael Thomas
> > Mathbox
> > 978-687-3300
> > Toll Free: 1-877-MATHBOX (1-877-628-4269)
> >
> > > -----Original Message-----
> > > From: Thomas Eckardt [mailto:Thomas.Eckardt@...]
> > > Sent: Sunday, October 24, 2010 4:59 AM
> > > To: ASSP development mailing list
> > > Subject: Re: [Assp-test] Penalty Box - Message Scoring
> > >
> > > Hi Thomas,
> > >
> > > I'm unable to reproduce this behavior - it is
> reproduceable on your
> > > system?
> > >
> > > Thomas
> > >
> > >
> > >
> > >
> > > Von: "Michael Thomas" <mike@...>
> > > An: "'ASSP development mailing list'"
> > > <assp-test@...>
> > > Datum: 24.10.2010 03:59
> > > Betreff: [Assp-test] Penalty Box - Message Scoring
> > >
> > >
> > >
> > >
> > > Thomas,
> > >
> > > In the example below, the message exceeded the low limit,
> > > then exceeded
> > > the
> > > high limit. As you can see from the log, assp passed the
> > > message through
> > > to
> > > the SMTP. What I found interesting was that assp did not
> > > write any headers
> > > to the message. I thought that because assp was in Message
> > > Scoring Mode:
> > > tagging, that assp would tag. Apparently, because of the
> > score, assp
> > > wanted
> > > to move to blocking and because assp was in tagging, assp did
> > > nothing. Or
> > > do
> > > I misunderstand message scoring mode?
> > >
> > > On the final destination SMTP, if I find "X-Assp-Spam:
> YES" in the
> > > headers,
> > > I toss the message into the Junk folder. In this case there
> > > no headers at
> > > all.
> > >
> > > ASSP version 2.0.2(1.2.26)
> > > Do PenaltyBox - IP History: Monitor/MessageScoring
> > > Message Scoring Mode: tagging
> > > Low MessageLimit: 25
> > > High MessageLimit: 50
> > > Add IP/Message Scoring Header: Checked
> > > Extreme Scoring Threshold (PenaltyExtreme): 150
> > > PenaltyBox Extreme IP Profiling (DoPenaltyExtreme): disabled
> > >
> > >
> > > ================================
> > > 10-Oct-23 13:28:16 [Worker_4] Connected: 67.23.229.242:1221 >
> > > 208.69.48.42:25 > 208.69.48.46:25
> > > 10-Oct-23 13:28:20 54896-03236 [Worker_4] [DNSBL] 67.23.229.242
> > > <support@...> to: mailbox@...
> [scoring] DNSBL:
> > > neutral,
> > > 67.23.229.242 listed in bl.mathbox.net
> > > 10-Oct-23 13:28:20 54896-03236 [Worker_4] 67.23.229.242
> > > <support@...> to: mailbox@...
> > > Message-Score: added 25
> > > for DNSBL: neutral, 67.23.229.242 listed in bl.mathbox.net,
> > > total score
> > > for
> > > this message is now 25
> > > 10-Oct-23 13:28:20 54896-03236 [Worker_4] 67.23.229.242
> > > <support@...> to: mailbox@...
> > > Regex:InvalidPTRRe 'PB
> > > 15:
> > > for 67-23-229-242'
> > > 10-Oct-23 13:28:21 54896-03236 [Worker_4] 67.23.229.242
> > > <support@...> to: mailbox@...
> > > Message-Score: added 50
> > > for URIBL: neutral, phantasyleague.com listed in black.uribl.com
> > > uri.mathbox.net, total score for this message is now 75
> > > 10-Oct-23 13:28:21 54896-03236 [Worker_4]
> > > [MessageLimit][tagging][tagmode]
> > > 67.23.229.242 <support@...> to:
> > mailbox@... [spam
> > > found]
> > > and possibly passing because tagmode: mailbox@...,
> > > otherwise
> > > blocked (MessageScore 75, limit 50) [YourCashNow] ->
> > > C:/ASSP/spam/3236.eml
> > > 10-Oct-23 13:28:21 54896-03236 [Worker_4] [PenaltyBox]
> 67.23.229.242
> > > <support@...> to: mailbox@...
> > > [monitoring] totalscore
> > > for 67.23.229.242 is 75, last bad penalty was 'URIBLneutral'
> > > 10-Oct-23 13:28:21 54896-03236 [Worker_4] 67.23.229.242
> > > <support@...> to: mailbox@... spam found
> > > and passing
> > > ()
> > > [YourCashNow]
> > > 10-Oct-23 13:28:21 54896-03236 [Worker_4] [MessageOK]
> 67.23.229.242
> > > <support@...> to: mailbox@... message ok
> > > [YourCashNow]
> > > -> C:/ASSP/spam/3236.eml
> > > ================================
> > >
> > > Michael Thomas
> > > Mathbox
> > > 978-687-3300
> > > Toll Free: 1-877-MATHBOX (1-877-628-4269)
> > >
> > >
> > > --------------------------------------------------------------
> > > ----------------
> > > Nokia and AT&T present the 2010 Calling All
> > Innovators-North America
> > > contest
> > > Create new apps & games for the Nokia N8 for consumers in
> > > U.S. and Canada
> > > $10 million total in prizes - $4M cash, 500 devices,
> nearly $6M in
> > > marketing
> > > Develop with Nokia Qt SDK, Web Runtime, or Java and Publish
> > > to Ovi Store
> > > http://p.sf.net/sfu/nokia-dev2dev
> > > _______________________________________________
> > > Assp-test mailing list
> > > Assp-test@...
> > > https://lists.sourceforge.net/lists/listinfo/assp-test
> > >
> > >
> > >
> > >
> > > DISCLAIMER:
> > > *******************************************************
> > > This email and any files transmitted with it may be
> > > confidential, legally
> > > privileged and protected in law and are intended solely for
> > > the use of the
> > >
> > > individual to whom it is addressed.
> > > This email was multiple times scanned for viruses. There
> > should be no
> > > known virus in this email!
> > > *******************************************************
> > >
> > >
> > >
> >
> >
> > --------------------------------------------------------------
> > ----------------
> > Nokia and AT&T present the 2010 Calling All Innovators-North
> > America contest
> > Create new apps & games for the Nokia N8 for consumers in
> > U.S. and Canada
> > $10 million total in prizes - $4M cash, 500 devices, nearly
> > $6M in marketing
> > Develop with Nokia Qt SDK, Web Runtime, or Java and Publish
> > to Ovi Store
> > http://p.sf.net/sfu/nokia-dev2dev
> > _______________________________________________
> > Assp-test mailing list
> > Assp-test@...
> > https://lists.sourceforge.net/lists/listinfo/assp-test
> >
> >
>
>
> --------------------------------------------------------------
> ----------------
> Nokia and AT&T present the 2010 Calling All Innovators-North
> America contest
> Create new apps & games for the Nokia N8 for consumers in
> U.S. and Canada
> $10 million total in prizes - $4M cash, 500 devices, nearly
> $6M in marketing
> Develop with Nokia Qt SDK, Web Runtime, or Java and Publish
> to Ovi Store
> http://p.sf.net/sfu/nokia-dev2dev
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test
>
>
|