procmail
[Top] [All Lists]

Re: spam filter

2000-10-27 08:40:06
On Thu, 26 Oct 2000, Professional Software Engineering wrote:

Perhaps you could:
         A. enable verbose logging (verbose=ON)

Already was.


         B. excerpt what is in the log for the area around this filter

Following are two examples from the .procmail.log. The first one I
couldn't tie to any "From" or "Subject" lines in the log after searching
_way_ back and _way_ forward:

il: Assigning "INCLUDERC=/home/holtzm/Procmail/spamtrap.rc"
procmail: Match on
! 
"(^((Original-)?(Resent-)?(To|Cc|Bcc)|(X-Envelope|Apparently(-Resent)?)-To):(.*[^-a-zA-Z0-9_.])?)holtzm(_at_)primenet(_dot_)com

From atbs18a(_at_)greatmeat(_dot_)nx  Thu Oct 26 12:46:43 2000
 Subject: Farm Fresh Pork Right To You
  Folder: /var/spool/mail/holtzm
4545
procmail: Notified comsat: "holtzm(_at_)1149327:/var/spool/mail/holtzm"

         C. simply describe what the filter appears to be doing 
                 

Nothing at all. All spam messages show up in INBOX.


         D. provide the headers from a sample message which you THINK should
                 have been filtered, but was not.

You asked for it:

Return-Path: <atbs18a(_at_)greatmeat(_dot_)nx>
Received: from localhost (localhost [127.0.0.1])
        by localhost.localdomain (8.9.3/8.9.3) with ESMTP id MAA01206
        for <holtzm(_at_)localhost>; Thu, 26 Oct 2000 12:46:22 -0700
From: atbs18a(_at_)greatmeat(_dot_)nx
Received: from pop.primenet.com
        by localhost with POP3 (fetchmail-5.0.0)
        for holtzm(_at_)localhost (single-drop); Thu, 26 Oct 2000 12:46:43
-0700 (MST)
Received: from smtp04.primenet.com (smtp04.primenet.com [206.165.6.134])
        by primenet.com (8.8.8/8.8.5) with ESMTP id MAA11227;
        Thu, 26 Oct 2000 12:06:37 -0700 (MST)
Received: (from daemon(_at_)localhost)
        by smtp04.primenet.com (8.9.3/8.9.3) id MAA19418;
        Thu, 26 Oct 2000 12:03:26 -0700 (MST)
Received: from vesna.s-ssts.ms.edus.si(193.2.128.2)
 via SMTP by smtp04.primenet.com, id smtpdAAAoka4FL; Thu Oct 26 12:03:16
2000
Received: from 199.35.202.9 (chn-sc8-09.ix.netcom.com [199.35.202.9])
        by vesna.s-ssts.ms.edus.si (8.8.5/8.8.5/04.04.1997) with SMTP id
VAA12444;
        Thu, 26 Oct 2000 21:05:34 +0200
Message-ID: <00003a8562c8$000000b2$00001426@>
To: <atbs18a(_at_)greatmeat(_dot_)nx>
Subject: Farm Fresh Pork Right To You
Date: Fri, 27 Oct 2000 11:44:53 -0700
X-Priority: 3
X-MSMail-Priority: Normal
X-UIDL: 8830e473ac3ff42ee83bfe1d7165904b

Buy Wonderful, Healthy Pork Products Direct from the Farm

The rest is snipped.


         E. Keep in mind that the order in which this filter appears in
                 relation to other filters can have a distinct impact.

The spam filter is last in my .procmailrc file

Note that performing these actions and contemplating them in solitude 
before posting them to the list will often lead to divine enlightenment.

I have contemplated this in solitude so much I feel like a monk. I'm even
getting a tonsure. Still no enlightenment, divine or otherwise! Hell, I've
even RTFMed! 
 
Two obvious possibilities immediatley jump to mind:

         1. you may not have write permissions to /home/holtzm/mail 

drwx------   3 holtzm   holtzm       1024 Oct 26 14:40 mail

                 (BTW, using something relative to your
                 homedir, or using $MAILDIR directly is generally easier to
                 manage, esp. when it comes time to relocate the filters to
                 a new account.)

True, but a minor issue at this point.

         2. ^TO_ matches a variety of headers -- including X-Envelope-To:
                 and Apparently-To (among others) -- i.e. BCC's, where your
                 server identifies them on reception.  If these elements exist
                 in your message headers, you can expect this (due to the
                 inverted condition), to be skipping those messages.  No
                 surprise there.

I noticed one of the headers shows "for <holtzm(_at_)localhost>". Would this
qualify?
 

Not that it matters much for the purposes of your matching or not in this 
case, but you should get in the habit of escaping the dot in the hostname 
portion (and in fact, any dots you expect to match AS dots):
         primenet\.com

Noted. Thanks for you're reply.

-- 
Bob Holtzman
"If you think you're getting free lunch
 ......check the price of the beer!"



_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>