Thomas,
i sent from my webmail (external, non-white, non-red) a pdf with same
(supposed) filename (çatı t-1.pdf). below full diagnostic sessionLog +
verbose attachment logging. it looks fine with filename with extended
chars, that's ok.
but now i'm confused. according to my setup (and what i used to see
without AFC since years) it should be
1. blocked with BadAttachment tag,
2. moved to discarded folder and
3. sent to ccSpam.
however it arrives with lowlimit tag (because of Bayes) to ccSpam only.
Not to the user (although lowlimit!!). but on the other hand, it was
copied to discarded folder too as i see it in file system. no trace
about an attachment in headers despite "SPAM FOUND bad attachment 'çatı
t-1.pdf'" log entry!!
*ASSP headers:*
X-Assp-Version: 2.5.6(17104) on blah...
X-Assp-ID: blah... id-66712-03431
X-Assp-Session: 5B1E9278 (mail 1)
X-Assp-Envelope-From: [email protected]
X-Assp-Original-Subject: çatı 2
X-Original-Authentication-Results: blah...; dkim=pass spf=pass
X-Assp-Detected-URI: fastmail.ca(3), messagingengine.com(2)
X-Assp-Message-Score: 45 (Bayesian Probability: 0.99994)
X-Assp-IP-Score: 45 (Bayesian Probability: 0.99994)
X-Assp-Spam-Prob: 0.99994
X-Assp-HMM-Spam-Prob: 0.99870
X-Assp-Tag: MessageLimit
X-Assp-Spam: YES (Probably)
X-Spam-Status: YES
X-Assp-Spam-Reason: MessageScore passed low limit
X-Assp-Message-Totalscore: 45
X-Assp-Spam-Level: **********
X-Assp-Intended-For: [email protected]
X-Assp-Copy-Spam: Yes
*loglines:*
16.04.2017 21:18:31 [Worker_1] 66.111.4.25 [SMTP Reply] 220 mail.domain.com
16.04.2017 21:18:32 [Worker_1] info: wrote 36 byte to server
16.04.2017 21:18:32 [Worker_1] 66.111.4.25 [SMTP Reply] 250 HELP
16.04.2017 21:18:32 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> info: found message size announcement: 423.02 kByte
16.04.2017 21:18:32 [Worker_1] info: wrote 43 byte to server
16.04.2017 21:18:32 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> [SMTP Reply] 250 OK
16.04.2017 21:18:32 [Worker_1] [email protected] matches [email protected]
in LocalAddresses_Flat
16.04.2017 21:18:33 [Worker_1] info: wrote 31 byte to server
16.04.2017 21:18:33 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] [SMTP Reply] 250 OK
16.04.2017 21:18:33 [Worker_1] Info: incoming mail detected
16.04.2017 21:18:33 [Worker_1] info: wrote 6 byte to server
16.04.2017 21:18:33 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] [SMTP Reply] 354 OK, send.
16.04.2017 21:18:34 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] DKIM-Signature found
16.04.2017 21:18:34 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] [scoring] DKIM signature
verified-OK - header-passed - sender policy is: neutral - author policy
is: neutral
16.04.2017 21:18:37 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] HMM-Check has given less than 6
results - using monitoring mode only
16.04.2017 21:18:37 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] HMM Check [monitoring] - Prob:
0.99870 => spam - answer/query relation: 9% of 11
16.04.2017 21:18:37 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] Bayesian Check [scoring] - Prob:
0.99994 => spam - answer/query relation: 50% of 14
16.04.2017 21:18:37 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] Message-Score: added 45 for
Bayesian Probability: 0.99994, total score for this message is now 45
16.04.2017 21:18:37 id-66712-03431 [Worker_1] [MessageLimit][lowlimit]
66.111.4.25 <[email protected]> to: [email protected] info: Maillog -
created file c:/assp/discarded/3431--1219548.eml
16.04.2017 21:18:37 id-66712-03431 [Worker_1] [MessageLimit][lowlimit]
66.111.4.25 <[email protected]> to: [email protected] [spam found] and
possibly passing because messagescore(45) low [çatı 2] ->
c:/assp/discarded/3431--1219548.eml
16.04.2017 21:18:37 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] spam found and passing [çatı 2]
-> c:/assp/discarded/3431--1219548.eml
16.04.2017 21:18:37 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] info: read and processed 8244
byte of DATA
16.04.2017 21:18:37 [Worker_1] to: [email protected] info: wrote 30 byte
to server
16.04.2017 21:18:37 [Worker_1] to: [email protected] info: wrote 30 byte
to server
(etc...)
16.04.2017 21:18:39 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] info: received the end of the DATA
16.04.2017 21:18:39 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] [Plugin] calling plugin ASSP_AFC
16.04.2017 21:18:39 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] info: block set to BlockExes (3)
- attachlog set to extAttachLog (7) - default
16.04.2017 21:18:39 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] info: attachment çatı t-1.pdf
found for Level-3
16.04.2017 21:18:39 [Worker_1] Info: notification message queued to sent
to [email protected]
16.04.2017 21:18:39 id-66712-03431 [Worker_1] [Attachment] 66.111.4.25
<[email protected]> to: [email protected] SPAM FOUND bad attachment 'çatı
t-1.pdf'
16.04.2017 21:18:39 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] Message-Score: added 35
(baValencePB) for bad attachment 'çatı t-1.pdf', total score for this
message is now 80
16.04.2017 21:18:39 id-66712-03431 [Worker_1] [Attachment] 66.111.4.25
<[email protected]> to: [email protected] info: Plugin ASSP_AFC has set
the collection parameter to '7' = discard folder & sendAllSpam
16.04.2017 21:18:40 id-66712-03431 [Worker_1] [Attachment] 66.111.4.25
<[email protected]> to: [email protected] mail blocked by Plugin ASSP_AFC
- reason BadAttachment - log is set to '7'
16.04.2017 21:18:40 id-66712-03431 [Worker_1] [Attachment] 66.111.4.25
<[email protected]> to: [email protected] info: logfile
c:/assp/discarded/3431--1219548.eml removed
16.04.2017 21:18:40 id-66712-03431 [Worker_1] [Attachment] 66.111.4.25
<[email protected]> to: [email protected] info: Maillog - created file
c:/assp/discarded/3431--1219548.eml
16.04.2017 21:18:40 id-66712-03431 [Worker_1] [Attachment] 66.111.4.25
<[email protected]> to: [email protected] [spam found] (BadAttachment)
[çatı 2] -> c:/assp/discarded/3431--1219548.eml;
16.04.2017 21:18:40 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] [SMTP Reply] 250 OK
16.04.2017 21:18:40 id-66712-03431 [Worker_1] [Attachment] 66.111.4.25
<[email protected]> to: [email protected] info: received and processed all
DATA
16.04.2017 21:18:40 [Worker_1] to: [email protected] info: wrote 6 byte to
server
16.04.2017 21:18:40 [Worker_1] 66.111.4.25 <[email protected]> to:
[email protected] info: message forwarded to [email protected]
16.04.2017 21:18:40 [Worker_1] to: [email protected] info: wrote 8192 byte
to server
16.04.2017 21:18:40 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] [SMTP Reply] 221
<HilalTrans.KillingFloor> closing transmission
16.04.2017 21:18:40 [Worker_1] to: [email protected] info: wrote 8192 byte
to server
16.04.2017 21:18:40 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] finished message - received DATA
size: 423.17 kByte - sent DATA size: 0 Byte
16.04.2017 21:18:40 id-66712-03431 [Worker_1] 66.111.4.25
<[email protected]> to: [email protected] disconnected: session:5B1E9278
66.111.4.25 - processing time 9 seconds
16.04.2017 21:18:40 [Worker_1] to: [email protected] info: wrote 8192 byte
to server
16.04.2017 21:18:40 [Worker_1] to: [email protected] info: wrote 8192 byte
to server
(etc...)
thanks for any clarification.
Katip
-------- Original Message --------
Subject: Re: [Assp-test] AFC plugin again
From: Thomas Eckardt <[email protected]>
To: ASSP development mailing list <[email protected]>
Date: Sun, 16 Apr 2017 08:58:00 +0200
Set 'SessionLog' to diagnostic and show the complete loglines for such
a mail.
15.04.2017 19:28:35 id-73707-03273 [Worker_1] [Attachment] 40.92.70.55
<[email protected]> to: [email protected] [spam found] (BadAttachment)
[çatı t-1];
this shows, that there is no logging level set for this mail -> result
is no collection
Thomas
Von: katip <[email protected]>
An: ASSP development mailing list <[email protected]>
Datum: 16.04.2017 04:15
Betreff: [Assp-test] AFC plugin again
------------------------------------------------------------------------
another AFC issue..
detection is ok. sender was external (not whitelisted) and pdf is set to
block. however message is totally lost after receipt, despite all
blocked attachment levels set to "discard folder & sendAllSpam"
15.04.2017 19:28:35 id-73707-03273 [Worker_1] [Attachment] 40.92.70.55
<[email protected]> to: [email protected] mail blocked by Plugin
ASSP_AFC - reason BadAttachment
15.04.2017 19:28:35 id-73707-03273 [Worker_1] [Attachment] 40.92.70.55
<[email protected]> to: [email protected] [spam found] (BadAttachment)
[çatı t-1];
15.04.2017 19:28:35 id-73707-03273 [Worker_1] 40.92.70.55
<[email protected]> to: [email protected] [SMTP Reply] 250 OK
15.04.2017 19:28:35 id-73707-03273 [Worker_1] 40.92.70.55
<[email protected]> to: [email protected] finished message - received
DATA size: 289.58 kByte - sent DATA size: 0 Byte
without AFC, collections to discard folder and CCspam are fine. fyi..
Katip
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential,
legally privileged and protected in law and are intended solely for
the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
