Print Page | Close Window

keyword filtering question

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5823
Printed Date: 27 December 2024 at 1:48pm


Topic: keyword filtering question
Posted By: aaron
Subject: keyword filtering question
Date Posted: 10 October 2006 at 4:23pm

I have a question about the filtering order (at http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5171 - http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID= 5171 ) and the keyword filtering.

Our users routinely get spammed with emails containing exactly the same subjects.  This causes users to not check their qurantine as often because they get the same spam messages every day and they overshadow any false positives in the quarantine.  I have some  regex blacklisted keywords, such as

((?i)Subject:.all.love.enhancers.on.one.portal)::NULL
((?i)Subject:.our.store.is.your.cureall)::NULL

and those seem to work (in the RegEx Test tab at least), the problem is that keyword filtering is so low in the filtering order that these messages have already been quarantined due to another reason, so they do not get delivered to NULL.

Is there a way to keep messages with specified subjects from being quarantined even though keyword checking is nearly at the bottom of the filter order?


Replies:
Posted By: aaron
Date Posted: 13 October 2006 at 9:07pm
do other people not have similar problems?  if i was able to block a few specific subjects, i would probably cut my quarantine in half.

Posted By: Thing
Date Posted: 26 October 2006 at 3:53pm
Yes, My RegEx made to send certain Subject lines to null work fine in the RegEx test, but not in production. If fact it is not even blocking them at all.

Posted By: kspare
Date Posted: 27 October 2006 at 1:21am
What database are you running? For certian things like that we just write some jobs in sql that will delete things like this automatically.

Posted By: Thing
Date Posted: 27 October 2006 at 3:33pm
Yea I already resort to using stored jobs in SQL to handle this. I just thought I would reply to let him know he is not the only one having this problem.

Posted By: aaron
Date Posted: 28 October 2006 at 9:27am
automatic sql queries to remove those are a good work-around, thanks for the comments fellas


Print Page | Close Window