Koozali.org: home of the SME Server

Legacy Forums => General Discussion (Legacy) => Topic started by: CKConsulting on May 11, 2005, 04:50:41 AM

Title: Can deleted spam be retrieved?
Post by: CKConsulting on May 11, 2005, 04:50:41 AM

I'm using Jesper Knudsen's install of the Spam Filter.
A user was complaining that he was not getting emails from a customer.  He asked if I could retrieve the email.  I didn't know the answer, so I'm asking everyone here.

The customer has now been added to WBL, but incase this comes up again can you?

Also,where can I find the spam logs?

Rick

Title: Can deleted spam be retrieved?
Post by: chris burnat on May 14, 2005, 04:00:52 AM

Rick, I cannot answer your first question.  About the logs, I   can tell you this:

(i) maillog records the handy work of spamfilter, complete with score for each email, here is an example:

May 14 10:29:27 mail spamd[20206]: connection from localhost [127.0.0.1] at port 33170
May 14 10:29:27 mail spamd[20206]: info: setuid to qmailq succeeded
May 14 10:29:27 mail spamd[20206]: processing message <99945761.54773@lumagpcbqsx@norikomail.com> for qmailq:404.
May 14 10:29:38 mail spamd[20206]: identified spam (39.4/5.0) for qmailq:404 in 10.9 seconds, 2210 bytes.
May 14 10:29:38 mail spamd[20206]: result: Y 39 - BAYES_99,COMPLETELY_FREE,DCC_CHECK,DIGEST_MULTIPLE,HELO_DYNAMIC_IPADDR,MIME_BOUND_DD_DIGITS,PYZOR_CHECK,RATWARE_RCVD_AT,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_SORBS_DUL,RCVD_IN_XBL,UNRESOLVED_TEMPLATE,URIBL_SBL,X_MESSAGE_INFO scantime=10.9,size=2210,mid=<99945761.54773@lumagpcbqsx@norikomail.com>,bayes=1,autolearn=spam

(ii) mail deleted  according to rbls can be tracked in smtpfront-qmail-current. Here is an example:
2005-05-14 09:40:27.931841500 tcpserver: status: 1/40
2005-05-14 09:40:27.932157500 tcpserver: pid 21101 from 24.130.186.220
2005-05-14 09:40:30.178367500 tcpserver: ok 21101 0:203.47.55.179:25 c-24-130-186-220.hsd1.ca.comcast.net:24.130.186.220::1134
2005-05-14 09:40:32.295577500 rblsmtpd: 24.130.186.220 pid 21101: 451 http://dsbl.org/listing?24.130.186.220
2005-05-14 09:40:33.127016500 tcpserver: end 21101 status 0
2005-05-14 09:40:33.127022500 tcpserver: status: 0/40

Hope it helps.
chris

Title: Can deleted spam be retrieved?
Post by: jfarschman on May 15, 2005, 05:08:30 PM

Rick,

  I would set the filter to not delete, but just mark the spam, then create a filter/rule in their email client to move the spam to a different directory.  I move mine to the trash directory.

  This should work for you.

Title: Can deleted spam be retrieved?
Post by: CKConsulting on May 16, 2005, 02:44:28 PM

Thanks for the info!

Rick