LogSat Software

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   < ="-" ="text/; =utf-8">< name="ProgId" ="Word.">< name="Generator" ="Microsoft Word 12">< name="Originator" ="Microsoft Word 12">

I am having some problems getting the black list keyword filter to work. 
I currently have version 4.2.4.834 loaded using standard filters. 
I am trying to black hole emails with a subject keyword “VIGARRA”. 
I have ticked the box for matches to this filter NOT to be quarantined. 

I have added the keyword to the
black list keyword filter. The list appears to be loaded as follows:

01/24/11 15:36:41:665 -- (6076) Reloading
file for tblBL_Keywords: Lists\BlackText.txt (118 bytes)

The format of the keyword filter
is as follows: 

Subject:VIGARRA::NULL
I have also  tried just using the word VIGARRA. 

Emails with this subject keyword
are being blocked for reasons other than black listed keywords, eg. IP in MAPS
search etc. Consequently the emails are being quarantined. I do not want these
emails added to quarantine… just flushed. We're getting '000s of these things each day and they're just clutter. 
Can someone let me know what I'm doing wrong or if more information is requried. 

Author	Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic
Bluefly Members Profile Send Private Message Find Members Posts Add to Buddy List Newbie Joined: 01 March 2011 Status: Offline Points: 17	Post Options Post Reply Quote Bluefly Report Post Thanks(0) Quote Reply Topic: Blackhole on keywords Posted: 01 March 2011 at 8:00pm
	< ="-" ="text/; =utf-8">< name="ProgId" ="Word.">< name="Generator" ="Microsoft Word 12">< name="Originator" ="Microsoft Word 12"> I am having some problems getting the black list keyword filter to work. I currently have version 4.2.4.834 loaded using standard filters. I am trying to black hole emails with a subject keyword “VIGARRA”. I have ticked the box for matches to this filter NOT to be quarantined. I have added the keyword to the black list keyword filter. The list appears to be loaded as follows: 01/24/11 15:36:41:665 -- (6076) Reloading file for tblBL_Keywords: Lists\BlackText.txt (118 bytes) The format of the keyword filter is as follows: Subject:VIGARRA::NULL I have also tried just using the word VIGARRA. Emails with this subject keyword are being blocked for reasons other than black listed keywords, eg. IP in MAPS search etc. Consequently the emails are being quarantined. I do not want these emails added to quarantine… just flushed. We're getting '000s of these things each day and they're just clutter. Can someone let me know what I'm doing wrong or if more information is requried.

LogSat Members Profile Send Private Message Find Members Posts Add to Buddy List Admin Group Joined: 25 January 2005 Location: United States Status: Offline Points: 4104	Post Options Post Reply Quote LogSat Report Post Thanks(0) Quote Reply Posted: 02 March 2011 at 8:25am
	Bluefly, SpamFilter applies filters in a specific order, as documented here: www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6726 As soon as a filter matches, to optimize performance, all other filters are skipped since the email has already been detected as spam. So in your example, as the "MAPS RBL" filter tags the email as spam, this filter acts before the blacklist keyword, causing the NULL option in the blacklist keyword to not being checked. To remove all such emails (with the subject vigarra) you could schedule a query to run against the database to search for and delete such emails.
	Roberto Franceschetti LogSat Software Spam Filter ISP

Bluefly Members Profile Send Private Message Find Members Posts Add to Buddy List Newbie Joined: 01 March 2011 Status: Offline Points: 17	Post Options Post Reply Quote Bluefly Report Post Thanks(0) Quote Reply Posted: 03 March 2011 at 5:35pm
	Thanks Roberto. You may have a good reason not to but I think it would be useful if the admin controlled filters took priority over the external ones. It would give the admin more granular control. Just a thought.

dotme Members Profile Send Private Message Find Members Posts Add to Buddy List Newbie Joined: 27 October 2008 Status: Offline Points: 20	Post Options Post Reply Quote dotme Report Post Thanks(0) Quote Reply Posted: 22 March 2011 at 10:37am
	I ran into this issue and ended up writing a routine that deleted quarantined items that matched the keywords. One user was getting hammered (10+ per second) with identical emails, and they had 30,000 quarantined emails by 8am. The routine didn't take a super log time to write, and it worked.

LogSat Software

Site Navigation[Skip]

Spam Filter ISP Support Forum

Blackhole on keywords