Page 1 of 2 12 LastLast
Results 1 to 10 of 16
  1. #1
    Untanglit
    Join Date
    Jan 2008
    Posts
    18

    Default Spam Filter not scoring

    Recent emails are listed in the Spam Blocker event log but they all have a Spam Score of zero (even blatant replica watches and enlargement medication messages). The last Spam event is at approx 16:00 GMT yesterday.

    I've compared the message headers before and after and the X-Spam entries are no longer present (see below).

    I have power cycled all the active applications and plan to reboot the machine once the office is closed. Is there anything I should look out for before/during/after a reboot that might help diagnose/solve this issue?


    I'm using Build: 8.1.1~svn20110217r28510release8.1-1lenny. I have not made any recent config or network changes.



    Header Excerpt Yesterday
    Code:
    X-OriginalArrivalTime: 06 Jun 2011 12:19:07.0318 (UTC) FILETIME=[EEB57560:01CC2443]
    X-spam-status: No, score=-2.5 required=5.0 tests=HTML_MESSAGE,BAYES_00,MIME_QP_LONG_LINE,AWL
    X-Spam-Flag: NO
    
    ------_=_NextPart_001_01CC2443.EE540197

    Header Excerpt Today
    Code:
    X-OriginalArrivalTime: 07 Jun 2011 11:47:56.0228 (UTC) FILETIME=[BDDD8840:01CC2508]
    
    ------_=_NextPart_001_01CC2508.BDC84F2D

  2. #2
    Untangle Ninja raditude's Avatar
    Join Date
    Jan 2009
    Location
    Eugene, OR
    Posts
    1,143

    Default

    The times I have seen a situation like this (spam scoring 0), is a user had added an entry to the safelist. Not saying this is your issue, but I would look through all user safe lists as well as the systemwide one.

  3. #3
    Untanglit
    Join Date
    Jan 2008
    Posts
    18

    Default

    Thanks. I've checked through the Safelists but couldn't see any unusual entries.

    The majority of messages in the event log say 'Pass Message'. There are only a few that say 'Safelist Message' and these are from genuine safelist entries.

  4. #4
    Untangle Ninja raditude's Avatar
    Join Date
    Jan 2009
    Location
    Eugene, OR
    Posts
    1,143

    Default

    Could be encrypted TLS or SSL, we have also had that problem. If you search the forum for SSL emails, there was just a thread a couple weeks ago about it. The problem is if it is encrypted UT can not see it, thus it passes it to your mail server, and if your mail server accepts encrypted emails, thus you can end up getting spam.

  5. #5
    Untanglit
    Join Date
    Jan 2008
    Posts
    18

    Default

    For anyone interested (or having similar problems) a reboot fixed my issue. All messages now have X-spam headers and are being scored, passed, marked, quarantined and dropped appropriately.

    Don't know what caused the scoring to stop so I'll be keeping an eye on it in case it fails again.

  6. #6
    Untangle Junkie dmorris's Avatar
    Join Date
    Nov 2006
    Location
    San Carlos, CA
    Posts
    17,747

    Default

    Can you post a screenshot of the eventlog showing one of the messages?
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

  7. #7
    Untanglit
    Join Date
    Jan 2008
    Posts
    18

    Default

    They have dropped out of the event log as it only shows 40 pages (we get a lot of spam - perhaps the volume is part of the problem). Unless there's a way to access events further back in time I can't get a screenshot.

    However it was quite simple so I can describe it. Every single message between 16:00 Monday and 17:00 Tuesday (which was when I rebooted) had an action of 'Pass Message' and a Spam Score of 0. Before and after these times the messages had a mixture of actions and scores as would be expected.

    Not sure how much use they are use but I can give screenshots of the graphical reports from the 2 days which gives an indication of what happened. Between the fail and the reboot all messages were deemed clean.

    Monday


    Tuesday

  8. #8
    Master Untangler
    Join Date
    Dec 2008
    Location
    Dallas, TX
    Posts
    337

    Default

    I had a system with similar, sporadic problems - except it *blocked* all email and all messages received a score of 0. I think it also failed "open" one time and allowed all messages through.
    http://forums.untangle.com/spam-bloc...score-0-a.html

    This is a system that received *lots* of spam. This went on for a while - would work for 2 or 3 months and then fail. Box was in place 18 months or so.
    http://forums.untangle.com/spam-bloc...while-hot.html

    Last time the box failed the database would not restart. Support connected and told me the hard drive was probably bad. I replaced the entire box and then did some testing on the hard drive. I could not find any disk testing tools, including the manufacturers test, that indicated there was a problem with the hard drive.

    So the answer to the problem was........we don't really know. 8-(

  9. #9
    Master Untangler wharfratjoe's Avatar
    Join Date
    Dec 2008
    Location
    Southern California
    Posts
    431

    Default

    it seems this problem may be only in Build: 8.1.1. I am seeing this same issue.

    I do not recall seeing this issue in earlier versions of 8.x or even in 7.x

  10. #10
    Untangle Junkie dmorris's Avatar
    Join Date
    Nov 2006
    Location
    San Carlos, CA
    Posts
    17,747

    Default

    Quote Originally Posted by synner View Post
    They have dropped out of the event log as it only shows 40 pages (we get a lot of spam - perhaps the volume is part of the problem). Unless there's a way to access events further back in time I can't get a screenshot.

    However it was quite simple so I can describe it. Every single message between 16:00 Monday and 17:00 Tuesday (which was when I rebooted) had an action of 'Pass Message' and a Spam Score of 0. Before and after these times the messages had a mixture of actions and scores as would be expected.

    Not sure how much use they are use but I can give screenshots of the graphical reports from the 2 days which gives an indication of what happened. Between the fail and the reboot all messages were deemed clean.

    Monday


    Tuesday
    Can you post a screenshot of your spam blocker settings?
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2