Byteplant Forum

Home » CleanMail Support » CleanMail Server Talk » Is Filter Action sometimes ignored
Is Filter Action sometimes ignored [message #1416] Thu, 23 March 2006 00:04
Earl
Messages: 4
Registered: March 2006
Junior Member
I've been adjusting the order of the filters and decided to put the Spam Trap first. If I have a message that the spam trap returns accept/delete, it still gets forwarded to the next filter (attachment filter), which returns accept/deliver, but then the next line says "Incoming mail action: accept/delete".

From the log (date removed to make it format a little better):
16:52:04 Session 0: (Spam Trap) Learning message as spam
16:52:04 Session 0: (Spam Trap) Executing: sa\sa-learn.exe -c "sa\ruleset" --spam C:\WINDOWS\TEMP\SALearn0i.msg
16:52:23 Session 0: (Spam Trap) Command line exit code is 0
16:52:23 Session 0: (Spam Trap) Filter result is accept/delete
16:52:23 Session 0: (Attachment Filter) Filter result is accept/deliver
16:52:23 Session 0: Incoming mail action: accept/delete
16:52:24 Session 0: 250 OK
16:52:24 Session 0: QUIT

Why is the attachment filter running if the spam trap says to delete it?

Part II
Is there a prefered filter order? Why?

Thanks, Earl

Re: Is Filter Action sometimes ignored [message #1417 is a reply to message #1416] Mon, 03 April 2006 14:12 Go to previous message
support
Messages: 919
Registered: April 2004
Senior Member
This is working as intended. What happens is that the attachment filter scans mails "on-the fly", while the spam trap needs to collect each and every line of a message before it can begin to learn a message and finally delete it. Hence, both filters get to see the message, in the end it is deleted.

This almost answers Part II: Put those filters first, that best reduce the number of incoming messages at comparatively low cost (CPU/memory usage-wise).

We recommend the following filtering order:

1. attachment blocker
2. delay filter
3. 3rd party virus checker
4. spam trap, if configured
5. SpamAssassin

Where to put the virus checker is debatable, it depends on the scanner's performance. Some would put it last instead of third. Placing it third keeps the SpamAssassin database clear of virus and worm messages.



Customer Support
Byteplant GmbH
Re: Is Filter Action sometimes ignored [message #1418 is a reply to message #1417] Mon, 19 January 2009 18:57 Go to previous message
Jorge
Messages: 2
Registered: January 2009
Junior Member
I am afraid that the answer by Customer Service is either incorrect, or there is a bug in the software. I am using the very latest version as of this date, and I have the same exact issue. The messages sent to honeypot addresses are NOT deleted. They all get tested by the rest of the filters, and many of them end up in my inbox if the other filters fail to catch them.

There is a "Use filter output" option in the Spam Trap that supposedly allows you to set an action for positive matches, but unless I am doing something wrong, the option is useless. I try code 0, 1, etc. and the policy action is ignored. Running the test spam always yields no action.

Can someone PLEASE tell me how to properly configure the Spam Trap?

Beyond training the Bayes database I don't want any of those messages to go any further wasting resources, since they are 100% spam. They should be deleted immediately after training the Bayes db.

Thanks.
Previous Topic: Mail Storage Directory is incorrect
Next Topic: Question: SPF
Goto Forum:
  


Current Time: Sun Dec 04 17:12:39 CET 2016