Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - No 557 This email is rejected if keyword
  FAQ FAQ  Forum Search   Register Register  Login Login

No 557 This email is rejected if keyword
 Post Reply Post Reply
Author
  Topic Search Topic Search  Topic Options Topic Options
Koenraad View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Koenraad Quote  Post ReplyReply Direct Link To This Post Topic: No 557 This email is rejected if keyword
    Posted: 09 March 2005 at 5:53am

The system those not send a "557 This email is rejected  "if keyword is found still email is quarantined, what could be the problem

 

03/09/05 11:50:51:517 -- (2976) Connection from: 195.238.3.234  -  Originating country : Belgium
03/09/05 11:50:51:658 -- (2976) Resolving 195.238.3.234 - outmx007.isp.belgacom.be
03/09/05 11:50:51:704 -- (2976) viasoc.be is a domain, searching for SPF record
03/09/05 11:50:51:720 -- (2976) - SPF analysis for viasoc.be done: - none
03/09/05 11:50:51:720 -- (2976) Mail from: Tania.DeBuck@viasoc.be
03/09/05 11:50:52:297 -- (2976) - MAPS search done...
03/09/05 11:50:52:297 -- (2976) RCPT TO: koenraad@khd.be accepted
03/09/05 11:50:52:562 -- (2976) String matching error for (from 195.238.3.234 by  (logsat software smtp server) wed, 9 mar 2005 11:50:52 +0100 from outmx007.isp.belgacom.be (localhost [127.0.0.1]) by outmx007.isp.belgacom.be (8.12.11/8.12.11/skynet-out-2.22) with esmtp id j29aqyng008146 for <koenraad@khd.be>; wed --and-- (valtrex|zyrtec|\bhgh\b|ambien\b|flonase|allegra|didrex|reno va\b|bontril|nexium)[\w\-_.]*\.[a-z]{2,}     # Fourth drug super regexp) : TRegExpr(comp): ParseReg Unmatched () (pos 78)
03/09/05 11:50:52:734 -- (2976) Found Keywords: [naakte meisjes]
03/09/05 11:50:52:734 -- (2976) EMail from Tania.DeBuck@viasoc.be to koenraad@khd.be matches content filter rules - rejected.
03/09/05 11:50:52:936 -- (2976) EMail from Tania.DeBuck@viasoc.be to koenraad@khd.be was received and quarantined. Size: 9 KB, 9216 bytes
03/09/05 11:50:52:936 -- (2976) Disconnect
03/09/05 11:50:53:014 -- (4056) Connection from: 195.238.3.234  -  Originating country : Belgium
03/09/05 11:50:53:201 -- (4056) Resolving 195.238.3.234 - outmx007.isp.belgacom.be
03/09/05 11:50:53:279 -- (4056) isp.belgacom.be is a domain, searching for SPF record
03/09/05 11:50:53:295 -- (4056) - SPF analysis for isp.belgacom.be done: - none
03/09/05 11:50:53:295 -- (4056) Mail from:
03/09/05 11:50:53:981 -- (4056) - MAPS search done...
03/09/05 11:50:53:981 -- (4056) RCPT TO: Tania.DeBuck@viasoc.be accepted
03/09/05 11:50:54:449 -- (4056) String matching error for (from 195.238.3.234 by  (logsat software smtp server) wed, 9 mar 2005 11:50:54 +0100 from localhost (localhost) by outmx007.isp.belgacom.be (8.12.11/8.12.11/skynet-out-2.22) id j29aqgjs008215; wed, 9 mar 2005 11:52:44 +0100 (envelope-from <mailer-daemon>)  --and-- (valtrex|zyrtec|\bhgh\b|ambien\b|flonase|allegra|didrex|reno va\b|bontril|nexium)[\w\-_.]*\.[a-z]{2,}     # Fourth drug super regexp) : TRegExpr(comp): ParseReg Unmatched () (pos 78)
03/09/05 11:50:55:540 -- (4056) Found Keywords: [naakte meisjes]
03/09/05 11:50:55:556 -- (4056) EMail from  to Tania.DeBuck@viasoc.be matches content filter rules - rejected.
03/09/05 11:50:55:758 -- (4056) EMail from  to Tania.DeBuck@viasoc.be was received and quarantined. Size: 12 KB, 12288 bytes
03/09/05 11:50:55:758 -- (4056) Disconnect
Back to Top
mikek View Drop Down
Senior Member
Senior Member
Avatar

Joined: 22 February 2005
Location: Switzerland
Status: Offline
Points: 133 		Post Options Post Options   Thanks (0) Thanks(0)   Quote mikek Quote  Post ReplyReply Direct Link To This Post Posted: 09 March 2005 at 6:10am

looks like there is an error in your regex:

TRegExpr(comp): ParseReg Unmatched ()

Back to Top
JimMeredith View Drop Down
Newbie
Newbie


Joined: 27 January 2005
Location: United States
Status: Offline
Points: 28 		Post Options Post Options   Thanks (0) Thanks(0)   Quote JimMeredith Quote  Post ReplyReply Direct Link To This Post Posted: 09 March 2005 at 12:39pm

Koenraad,

To add to what Mikek correctly pointed out, it also appears that you are using comments -- "# Fourth drug super regexp" -- in your expressions.  Comments are not allowed in LogSat's RegExp implementation at the present time.  See this article for more information.

You stated that SpamFilter is not sending the "557 This email is rejected" response.  Roberto will need to respond to this specific issue -- but it would still be a good idea to remove the comments and make sure that the RegExp is functioning properly.  If your RegEx syntax is correct, you should not be seeing "String matching error" messages in your log file.

Jim
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104 		Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 09 March 2005 at 4:11pm
Koenraad,

As Mikek and Jim pointed out, comments are not allowed in neither the keyword list file nor any of the other black/white list files. SpamFilter will perform literal string matches to any line in those files.

Going back to your question, even with the error apparently SpamFilter was able to self-recover and block the email successfully. In regards to your quote "The system those not send a "557 This email is rejected  "if keyword is found still email is quarantined, what could be the problem", do you have a telnet trace or any other trace to show us so we can see what is happening? All rejects should cause an error code to be sent, unless you have settings in place to accept emails or to not generate NDR (non-deliverable notices).
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.160 seconds.

Copyright (c)2002-2021 LogSat Software LLC - Sales: sales@LogSat.com
Contact Us