Spam Filter ISP Forums : Request: Max Mesage Size for Keyword Scan https://www.logsat.com/spamfilter/forums/ Sat, 13 Jun 2026 09:04:34 +0000 Tue, 06 Dec 2005 17:48:02 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=5399 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Request: Max Mesage Size for Keyword Scan : Well, at least it makes sense...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6909&title=request-max-mesage-size-for-keyword-scan#6909 Author: sgeorge
Subject: 5399
Posted: 06 December 2005 at 5:48pm

Well, at least it makes sense the way that you explain it.  I candefinitely live with that.  Thanks again.   ]]> Tue, 06 Dec 2005 17:48:02 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6909&title=request-max-mesage-size-for-keyword-scan#6909 <![CDATA[Request: Max Mesage Size for Keyword Scan : No problem for the help, we try...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6905&title=request-max-mesage-size-for-keyword-scan#6905 Author: LogSat
Subject: 5399
Posted: 06 December 2005 at 5:12pm

No problem for the help, we try to help everyone!

The same criteria applies for the RegEx Test tab, as it duplicates thefunctionality of the "real life" incoming emails. All text in the"large box" is treated as if it was an email's text, and is thusconverted to lower case for the search. That is why the "You" withcapital Y does not return a result.

And I apologize for the answer to the earlier question:

============
haveyou observed this as well:

a keyword of:
(subject:You)

...fails to match subjects with "You" or "you" in them
=============

as again the same answer also applies. The email is converted to lower case, so the upper case Y will not cause a match.
]]> Tue, 06 Dec 2005 17:12:27 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6905&title=request-max-mesage-size-for-keyword-scan#6905 <![CDATA[Request: Max Mesage Size for Keyword Scan : Actually, I&#039;m even finding...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6899&title=request-max-mesage-size-for-keyword-scan#6899 Author: sgeorge
Subject: 5399
Posted: 06 December 2005 at 11:07am

Actually, I'm even finding this oddity when I go to the "RegEx Test" tab.

For the RegEx Search String, I enter You (no quotes, no parens).  And in the large text box I enter the following two lines:

You
you

The search results in a "Not Found!" message.  Has this issue been encountered before?  I'm using version 2.3.6.473, unregistered.

Thanks for your help Roberto.  I honestly really appreciate so much assistance with software that I haven't even registered yet..

]]> Tue, 06 Dec 2005 11:07:49 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6899&title=request-max-mesage-size-for-keyword-scan#6899 <![CDATA[Request: Max Mesage Size for Keyword Scan : In theory it could happen if in...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6876&title=request-max-mesage-size-for-keyword-scan#6876 Author: LogSat
Subject: 5399
Posted: 04 December 2005 at 5:00pm

In theory it could happen if in the email's source the word "you" isencoded with a different charset. If you can post the original email'ssource code we can take a look. Please note that some email clientslike MS Outlook will completely change an email's source *and* headersso an analysis using those clients cannot be made.]]> Sun, 04 Dec 2005 17:00:43 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6876&title=request-max-mesage-size-for-keyword-scan#6876 <![CDATA[Request: Max Mesage Size for Keyword Scan : Thanks, it helps to know what&#039;s...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6875&title=request-max-mesage-size-for-keyword-scan#6875 Author: sgeorge
Subject: 5399
Posted: 04 December 2005 at 9:29am

Thanks, it helps to know what's going on.  In addition there beingno need for the (?i) switch for lower-case regular expressions, haveyou observed this as well:

a keyword of:
(subject:You)

...fails to match subjects with "You" or "you" in them.
]]> Sun, 04 Dec 2005 09:29:40 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6875&title=request-max-mesage-size-for-keyword-scan#6875 <![CDATA[Request: Max Mesage Size for Keyword Scan : sgeorge, You are correct in finding...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6871&title=request-max-mesage-size-for-keyword-scan#6871 Author: LogSat
Subject: 5399
Posted: 02 December 2005 at 5:24pm

sgeorge,

You are correct in finding a problem, we need to make the documentation more clear. SpamFilter, for perfromance reasons, converts all the email's text to lower case when performing text searches. This does not matter for non-regex searches, but as you discovered, it does make a difference for RegEx. If you enter a lower-case RegEx expressions, there will not be any need for the (?i) switch.

]]> Fri, 02 Dec 2005 17:24:20 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6871&title=request-max-mesage-size-for-keyword-scan#6871 <![CDATA[Request: Max Mesage Size for Keyword Scan : My apologies, I was certainly...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6862&title=request-max-mesage-size-for-keyword-scan#6862 Author: sgeorge
Subject: 5399
Posted: 02 December 2005 at 10:00am

My apologies, I was certainly wrong about the reason this email wasslipping through.  I was assuming that it was skipping the scan ofthe text portion of the email.

Instead, the problem was that I wasn't familiar enough withSpamFilter's behavior interpretation of RegEx.  I'm using version2.6.3.473, unregistered.  Could I list some test cases here andask someone to verify that this is normal behavior for SpamFilter?

Consider email 1 has the subject: You visit illegal websites

And email 2 has the subject: you visit illegal websites
(The only difference being that "y" is lower-case)

Case 1: emails 1 and 2 are received and scanned with the following black list keyword:
(subject:You.visit.illegal.websites)
Result: Neither email 1 nor email 2 is filtered

Case 2: emails 1 and 2 are received and scanned with the following black list keyword:
(subject:you.visit.illegal.websites)
(The only difference being that "y" is lower-case)
Result: Both email 1 and email 2 is filtered

Is this normal?  I've always used the (?i) control command toidentify case-insensitive expressions, but I'm now finding that a RegExrule with only lower-case letters and no (?i) command still matches anycase.  Any help would be appreciated.  Thanks!
]]> Fri, 02 Dec 2005 10:00:33 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6862&title=request-max-mesage-size-for-keyword-scan#6862 <![CDATA[Request: Max Mesage Size for Keyword Scan : Dan is correct. SpamFilter should...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6859&title=request-max-mesage-size-for-keyword-scan#6859 Author: LogSat
Subject: 5399
Posted: 01 December 2005 at 6:43pm

Dan is correct. SpamFilter should truncate the messsage text portion*after* the maximum msg size is reached, and only scan for keyword textin the firs nnn bytes of the email (in the first 64KB by default).]]> Thu, 01 Dec 2005 18:43:51 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6859&title=request-max-mesage-size-for-keyword-scan#6859 <![CDATA[Request: Max Mesage Size for Keyword Scan : Hmm ... Perhaps I misunderstood...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6852&title=request-max-mesage-size-for-keyword-scan#6852 Author: Desperado
Subject: 5399
Posted: 01 December 2005 at 10:54am

Hmm ... Perhaps I misunderstood the INI setting.  I *thought* it meant how deep into a message to scan .... *not* "do not scan if message is too large".

Minor Correction:

;Any emails whose text portion exceeds this number of KB will not be scanned for keywords and Bayes
;Higher values *may* catch more spam but will cause higher load on processor
MaxMsgSizeForKeywordScan=64

This should mean the an attachment will not effect the scanning ... just if the text size is over the limit.  das

Roberto ... Comments?



Edited by Desperado]]> Thu, 01 Dec 2005 10:54:46 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6852&title=request-max-mesage-size-for-keyword-scan#6852 <![CDATA[Request: Max Mesage Size for Keyword Scan : Hi, is it possible to have keywords...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6850&title=request-max-mesage-size-for-keyword-scan#6850 Author: sgeorge
Subject: 5399
Posted: 01 December 2005 at 9:19am

Hi, is it possible to have keywords still search subject messages when the message is too large for a keyword scan?

I receive messages with large attachments, and would block them withthis blacklist keyword, but the message is too large to initiate thesearch:

(subject:You.visit.illegal.websites)


]]> Thu, 01 Dec 2005 09:19:50 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5399&PID=6850&title=request-max-mesage-size-for-keyword-scan#6850