Print Page | Close Window

Blackhole on keywords

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6920
Printed Date: 27 December 2024 at 9:14am


Topic: Blackhole on keywords
Posted By: Bluefly
Subject: Blackhole on keywords
Date Posted: 01 March 2011 at 8:00pm
< ="-" ="text/; =utf-8">< name="ProgId" ="Word.">< name="Generator" ="Microsoft Word 12">< name="Originator" ="Microsoft Word 12"> 
I am having some problems getting the black list keyword filter to work. 
I currently have version 4.2.4.834 loaded using standard filters. 
I am trying to black hole emails with a subject keyword “VIGARRA”. 
I have ticked the box for matches to this filter NOT to be quarantined.

 

I have added the keyword to the black list keyword filter. The list appears to be loaded as follows:

 

01/24/11 15:36:41:665 -- (6076) Reloading file for tblBL_Keywords: Lists\BlackText.txt (118 bytes)

 

The format of the keyword filter is as follows:

 

Subject:VIGARRA::NULL

I have also  tried just using the word VIGARRA.

 

Emails with this subject keyword are being blocked for reasons other than black listed keywords, eg. IP in MAPS search etc. Consequently the emails are being quarantined. I do not want these emails added to quarantine… just flushed. We're getting '000s of these things each day and they're just clutter.

Can someone let me know what I'm doing wrong or if more information is requried.




Replies:
Posted By: LogSat
Date Posted: 02 March 2011 at 8:25am
Bluefly,

SpamFilter applies filters in a specific order, as documented here:
http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6726 - www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6726

As soon as a filter matches, to optimize performance, all other filters are skipped since the email has already been detected as spam. So in your example, as the "MAPS RBL" filter tags the email as spam, this filter acts before the blacklist keyword, causing the NULL option in the blacklist keyword to not being checked.

To remove all such emails (with the subject vigarra) you could schedule a query to run against the database to search for and delete such emails. 


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Bluefly
Date Posted: 03 March 2011 at 5:35pm
Thanks Roberto. You may have a good reason not to but I think it would be useful if the admin controlled filters took priority over the external ones. It would give the admin more granular control. Just a thought. 

Posted By: dotme
Date Posted: 22 March 2011 at 10:37am
I ran into this issue and ended up writing a routine that deleted quarantined items that matched the keywords. One user was getting hammered (10+ per second) with identical emails, and they had 30,000 quarantined emails by 8am.
 
The routine didn't take a super log time to write, and it worked.


Print Page | Close Window