邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: 垃圾邮件不能过滤了？？？－在线急等！ [打印本页]
作者: zkhzf    时间: 2008-7-2 14:53
标题: 垃圾邮件不能过滤了？？？－在线急等！
不久前将“启发式”中垃圾邮件的条件值由5改为10后，结果所有的垃圾邮件都没有过滤掉，都收进来了，每天几百封。将值由10改回5，甚至2也没有作用，好像是antispam没有工作了，查看antispam的log文件，里面也是一片空白。不知什么原因。
作者: zkhzf    时间: 2008-7-2 14:56

启发式的设置如图
作者: zkhzf    时间: 2008-7-2 14:57
作者: wxhsh    时间: 2008-7-2 14:59
标题: 回复 3楼 的帖子
第二个值将0改为默认的12
作者: zkhzf    时间: 2008-7-2 15:12
已经改成12了，需不需要重启MD？
作者: wxhsh    时间: 2008-7-2 15:13
标题: 回复 5楼 的帖子
理论上应该不需要。
作者: zkhzf    时间: 2008-7-2 15:17
大概要多长时间才能看出效果来？
作者: wxhsh    时间: 2008-7-2 15:17
标题: 回复 7楼 的帖子
即时生效的。
作者: zkhzf    时间: 2008-7-2 15:22


现在看来好像还是没有过滤掉。是不是要第二天早上才能看出来？
作者: gallop    时间: 2008-7-2 15:22
标题: 回复
自己收发几封测试邮件就可以看出它的启用情况了
还可以参考SMTP（IN)日志中的描述
作者: zkhzf    时间: 2008-7-2 15:31
这是从smtp（入）日志中节选下来的一段，应该怎么判断垃圾邮件过滤器是否工作了？

Wed 2008-07-02 15:28:09: ----------
Wed 2008-07-02 15:28:15: Session 1167; child 2; thread 2596
Wed 2008-07-02 15:28:15: ?? SMTP ???? [192.168.16.68:1311]
Wed 2008-07-02 15:28:15: --> 220 szluckystar.com ESMTP MDaemon 9.6.6; Wed, 02 Jul 2008 15:28:15 +0800
Wed 2008-07-02 15:28:15: <-- HELO mold05
Wed 2008-07-02 15:28:15: --> 250 szluckystar.com Hello mold05, pleased to meet you
Wed 2008-07-02 15:28:15: <-- MAIL FROM: <yan@szluckystar.com>
Wed 2008-07-02 15:28:15: --> 250 <yan@szluckystar.com>, Sender ok
Wed 2008-07-02 15:28:15: <-- RCPT TO: <pmc-13@season-electric.com>
Wed 2008-07-02 15:28:15: --> 250 <pmc-13@season-electric.com>, Recipient ok
Wed 2008-07-02 15:28:15: <-- Data
Wed 2008-07-02 15:28:15: Creating temp file (SMTP): e:\mdaemon\temp\md50000000292.tmp
Wed 2008-07-02 15:28:15: --> 354 Enter mail, end with <CRLF>.<CRLF>
Wed 2008-07-02 15:28:15: Message size: 5806 bytes
Wed 2008-07-02 15:28:15: Passing message through AntiVirus (Size: 5806)...
Wed 2008-07-02 15:28:15: *  ????(?????)
Wed 2008-07-02 15:28:15: ---- End AntiVirus results
Wed 2008-07-02 15:28:15: ???? successful:e:\mdaemon\inbound\md50000524645.msg
Wed 2008-07-02 15:28:15: --> 250 Ok, message saved <Message-ID: 200807021526105485019@szluckystar.com>
Wed 2008-07-02 15:28:15: <-- QUIT
Wed 2008-07-02 15:28:15: --> 221 See ya in cyberspace
Wed 2008-07-02 15:28:15: SMTP ????(?/???:5907/356)
Wed 2008-07-02 15:28:15: ----------
作者: wxhsh    时间: 2008-7-2 15:42
值调整后把以下两个勾勾上：
作者: zkhzf    时间: 2008-7-2 16:00
特别感谢wxhsh对此问题的关注！
作者: zkhzf    时间: 2008-7-2 16:04
现已按照wxhsh的提示设置了相关的参数。
现在从antispam日志来看，好像没有什么作用，这是今天该日志的所有内容：


START Event Log / MDaemon PRO v9.6.6, AntiSpam log information
-------------------------------------------------------------------------------
Event Time/Date             Event Description
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Server Shutdown  Wed, 02 Jul 2008 11:43:41 +0800
-------------------------------------------------------------------------------

START Event Log / MDaemon PRO v9.6.6, AntiSpam log information
-------------------------------------------------------------------------------
Event Time/Date             Event Description
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Server Shutdown  Wed, 02 Jul 2008 13:35:08 +0800
-------------------------------------------------------------------------------

START Event Log / MDaemon PRO v9.6.6, AntiSpam log information
-------------------------------------------------------------------------------
Event Time/Date             Event Description
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Server Shutdown  Wed, 02 Jul 2008 15:04:18 +0800
-------------------------------------------------------------------------------

START Event Log / MDaemon PRO v9.6.6, AntiSpam log information
-------------------------------------------------------------------------------
Event Time/Date             Event Description
-------------------------------------------------------------------------------
作者: wxhsh    时间: 2008-7-2 16:10
标题: 回复 14楼 的帖子
此日志只记录拒绝的邮件日志，不过观察下来好象是无效，可能SA引擎出故障了，先重启下再看吧。
作者: zkhzf    时间: 2008-7-2 16:43
重启了，感觉好像还是没有工作一样。
看看我的这些设置有没有错。






作者: gallop    时间: 2008-7-2 23:59
标题: 给点小提议
1.你可以在内容过滤器中，添加适合自己的规则，对不同的垃圾邮件作出不同的处理。
2.在地址址抑制中，添加要过滤的邮件地址。
3.在IP屏蔽中，添加已知的垃圾邮件IP（可以通过nslookup命令查出域名对应的IP）
可以减少一部分垃圾邮件
作者: zkhzf    时间: 2008-7-3 08:40
对gallop的建议表示感谢。

我的黑名单里的地址大概有好几百个，这样设置的话，工作量还是比较大的。
作者: zkhzf    时间: 2008-7-3 08:42
这是昨天晚上的antispam日志：

START Event Log / MDaemon PRO v9.6.6, AntiSpam log information
-------------------------------------------------------------------------------
Event Time/Date             Event Description
-------------------------------------------------------------------------------
Wed 2008-07-02 19:37:40: Spam Filter processing e:\mdaemon\remoteq\md75000095512.msg...
Wed 2008-07-02 19:37:40: * Message return-path: Ivank@gimelli.com.hk
Wed 2008-07-02 19:37:40: * Message from: MDaemon@szluckystar.com
Wed 2008-07-02 19:37:40: * Message to: Ivank@gimelli.com.hk
Wed 2008-07-02 19:37:40: * Message subject: Warning: Wangpp@szluckystar.com - User unknown!
Wed 2008-07-02 19:37:40: * Message ID: <MDAEMON0009200807021937.AA3739265@szluckystar.com>
Wed 2008-07-02 19:39:14: Start SpamAssassin results
Wed 2008-07-02 19:39:14: 100.20 points, 5.00 required
Wed 2008-07-02 19:39:14: =?ISO-8859-1?Q?
Wed 2008-07-02 19:39:14: *  100 USER_IN_BLACKLIST From: address is in the blacklist
Wed 2008-07-02 19:39:14: *  0.2 CN_BODY_48 BODY: Body contains "=d3=ca=bc=fe"?=
Wed 2008-07-02 19:39:14: End SpamAssassin results
Wed 2008-07-02 19:39:14: ----------
Wed 2008-07-02 19:37:40: Spam Filter processing e:\mdaemon\remoteq\md75000095513.msg...
Wed 2008-07-02 19:37:40: * Message return-path: Ivank@gimelli.com.hk
Wed 2008-07-02 19:37:40: * Message from: MDaemon@szluckystar.com
Wed 2008-07-02 19:37:40: * Message to: Ivank@gimelli.com.hk
Wed 2008-07-02 19:37:40: * Message subject: Warning: Wangpp@szluckystar.com - User unknown!
Wed 2008-07-02 19:37:40: * Message ID: <MDAEMON0010200807021937.AA3739359@szluckystar.com>
Wed 2008-07-02 19:39:14: Start SpamAssassin results
Wed 2008-07-02 19:39:14: 100.20 points, 5.00 required
Wed 2008-07-02 19:39:14: =?ISO-8859-1?Q?
Wed 2008-07-02 19:39:14: *  100 USER_IN_BLACKLIST From: address is in the blacklist
Wed 2008-07-02 19:39:14: *  0.2 CN_BODY_48 BODY: Body contains "=d3=ca=bc=fe"?=
Wed 2008-07-02 19:39:14: End SpamAssassin results
Wed 2008-07-02 19:39:14: ----------
Wed 2008-07-02 19:43:53: Spam Filter processing e:\mdaemon\remoteq\md75000095515.msg...
Wed 2008-07-02 19:43:53: * Message return-path: Ivank@gimelli.com.hk
Wed 2008-07-02 19:43:53: * Message from: MDaemon@szluckystar.com
Wed 2008-07-02 19:43:53: * Message to: Ivank@gimelli.com.hk
Wed 2008-07-02 19:43:53: * Message subject: Warning: Wangpp@szluckystar.com - User unknown!
Wed 2008-07-02 19:43:53: * Message ID: <MDAEMON0011200807021943.AA4352125@szluckystar.com>
Wed 2008-07-02 19:43:53: Start SpamAssassin results
Wed 2008-07-02 19:43:53: 100.20 points, 5.00 required
Wed 2008-07-02 19:43:53: =?ISO-8859-1?Q?
Wed 2008-07-02 19:43:53: *  100 USER_IN_BLACKLIST From: address is in the blacklist
Wed 2008-07-02 19:43:53: *  0.2 CN_BODY_48 BODY: Body contains "=d3=ca=bc=fe"?=
Wed 2008-07-02 19:43:53: End SpamAssassin results
Wed 2008-07-02 19:43:53: ----------
Wed 2008-07-02 19:43:53: Spam Filter processing e:\mdaemon\remoteq\md75000095516.msg...
Wed 2008-07-02 19:43:53: * Message return-path: Ivank@gimelli.com.hk
Wed 2008-07-02 19:43:53: * Message from: MDaemon@szluckystar.com
Wed 2008-07-02 19:43:53: * Message to: Ivank@gimelli.com.hk
Wed 2008-07-02 19:43:53: * Message subject: Warning: Wangpp@szluckystar.com - User unknown!
Wed 2008-07-02 19:43:53: * Message ID: <MDAEMON0012200807021943.AA4352187@szluckystar.com>
Wed 2008-07-02 19:43:53: Start SpamAssassin results
Wed 2008-07-02 19:43:53: 100.20 points, 5.00 required
Wed 2008-07-02 19:43:53: =?ISO-8859-1?Q?
Wed 2008-07-02 19:43:53: *  100 USER_IN_BLACKLIST From: address is in the blacklist
Wed 2008-07-02 19:43:53: *  0.2 CN_BODY_48 BODY: Body contains "=d3=ca=bc=fe"?=
Wed 2008-07-02 19:43:53: End SpamAssassin results
Wed 2008-07-02 19:43:53: ----------
作者: wxhsh    时间: 2008-7-3 09:13
标题: 回复 19楼 的帖子
不是已经生效了吗？不过你设的50K保守了点，如果硬件配置还可以，一般设200K。
作者: zkhzf    时间: 2008-7-3 10:03
上面的日志好像说的是发送到了一个未知的帐号，那个帐号是已经删除了的。
作者: wxhsh    时间: 2008-7-3 11:05
标题: 回复 21楼 的帖子
这是正常的日志，如果设置了未知用户返回发件人。不过奇怪的是，系统帐号发信是跳过SA的。
作者: zkhzf    时间: 2008-7-3 13:40
现在好像有些效果了。
但是日志文件记录的都是那个未知帐号的记录。
作者: zkhzf    时间: 2008-7-8 09:09
运行了几天，好像效果不是很明显。还是有很多垃圾邮件。
这是昨天的日志

START Event Log / MDaemon PRO v9.6.6, AntiSpam log information
-------------------------------------------------------------------------------
Event Time/Date             Event Description
-------------------------------------------------------------------------------
Mon 2008-07-07 00:01:06: Performing Bayesian learning
Mon 2008-07-07 00:01:06: *  Learning from Spam folder: E:\MDaemon\Public Folders\Bayesian Learning.IMAP\Spam.IMAP
Mon 2008-07-07 00:01:06: *  Learned tokens from 0 message(s) (0 message(s) examined)
Mon 2008-07-07 00:01:06: *  Learning from Ham folder: E:\MDaemon\Public Folders\Bayesian Learning.IMAP\Non-Spam.IMAP
Mon 2008-07-07 00:01:06: *  Learned tokens from 0 message(s) (0 message(s) examined)
Mon 2008-07-07 00:01:06: --- End Bayesian learning results
Mon 2008-07-07 00:01:06: ----------
Mon 2008-07-07 13:21:44: Spam Filter processing e:\mdaemon\remoteq\md50000096486.msg...
Mon 2008-07-07 13:21:44: * Message return-path: jimmylo@luckystar.com.hk
Mon 2008-07-07 13:21:44: * Message from: jimmylo@luckystar.com.hk
Mon 2008-07-07 13:21:44: * Message to: johnny@red50hk.com
Mon 2008-07-07 13:21:44: * Message subject: Re: Quotation request for lunch box
Mon 2008-07-07 13:21:44: * Message ID: <200807071312361099004@luckystar.com.hk>
Mon 2008-07-07 13:21:47: Start SpamAssassin results
Mon 2008-07-07 13:21:47: 99.70 points, 5.00 required
Mon 2008-07-07 13:21:47: *  100 USER_IN_BLACKLIST From: address is in the blacklist
Mon 2008-07-07 13:21:47: *  0.0 HTML_MESSAGE BODY: HTML included in message
Mon 2008-07-07 13:21:47: * -2.4 BAYES_05 BODY: Bayesian spam probability is 1 to 5%
Mon 2008-07-07 13:21:47: *      [score: 0.0288]
Mon 2008-07-07 13:21:47: *  0.2 MIME_BASE64_NO_NAME RAW: base64 attachment does not have a file name
Mon 2008-07-07 13:21:47: *  1.9 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding
Mon 2008-07-07 13:21:47: End SpamAssassin results
Mon 2008-07-07 13:21:47: ----------
Mon 2008-07-07 14:33:07: Spam Filter processing e:\mdaemon\remoteq\md50000096515.msg...
Mon 2008-07-07 14:33:07: * Message return-path: junewu@luckystar.com.hk
Mon 2008-07-07 14:33:07: * Message from: junewu@luckystar.com.hk
Mon 2008-07-07 14:33:07: * Message to: so.pinki@sea.sojitz.com
Mon 2008-07-07 14:33:07: * Message subject: Re:  OUTSTANDING BALANCE - LUCKY STAR
Mon 2008-07-07 14:33:07: * Message ID: <200807071431295038819@luckystar.com.hk>
Mon 2008-07-07 14:33:08: Start SpamAssassin results
Mon 2008-07-07 14:33:08: 95.60 points, 5.00 required
Mon 2008-07-07 14:33:08: =?ISO-8859-1?Q?
Mon 2008-07-07 14:33:08: *  100 USER_IN_BLACKLIST From: address is in the blacklist
Mon 2008-07-07 14:33:08: *  0.0 CN_BODY_2 BODY: Body contains "=d3=d0=cf=de=b9=ab=cb=be"
Mon 2008-07-07 14:33:08: *  0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
Mon 2008-07-07 14:33:08: * -4.7 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
Mon 2008-07-07 14:33:08: *      [score: 0.0000]
Mon 2008-07-07 14:33:08: *  0.0 HTML_MESSAGE BODY: HTML included in message
Mon 2008-07-07 14:33:08: *  0.2 HTML_FONT_FACE_BAD BODY: HTML font face is not a word?=
Mon 2008-07-07 14:33:08: End SpamAssassin results
Mon 2008-07-07 14:33:08: ----------
作者: zkhzf    时间: 2008-7-15 15:00
还是不行啊。
垃圾邮件的条件值已经调节到0.5了。
作者: alux    时间: 2008-7-23 08:11
重装一下MD吧.
作者: parenth    时间: 2010-6-1 15:52
我也出现了这个问题。
全部日志只有这些：


START Event Log / MDaemon PRO v10.0.5, AntiSpam log information
-------------------------------------------------------------------------------
Event Time/Date             Event Description
-------------------------------------------------------------------------------
Tue 2010-06-01 00:02:07: Performing Bayesian learning
Tue 2010-06-01 00:02:07: *  Learning from Spam folder: E:\MDaemon\Public Folders\Bayesian Learning.IMAP\Spam.IMAP
Tue 2010-06-01 00:02:07: *  Learned tokens from 95 message(s) (95 message(s) examined)
Tue 2010-06-01 00:02:07: *  Learning from Ham folder: E:\MDaemon\Public Folders\Bayesian Learning.IMAP\Non-Spam.IMAP
Tue 2010-06-01 00:02:07: *  Learned tokens from 378 message(s) (392 message(s) examined)
Tue 2010-06-01 00:02:07: *  End Bayesian learning results
Tue 2010-06-01 00:02:07: ----
作者: parenth    时间: 2010-6-1 15:53
楼主是怎么解决的啊！



欢迎光临 邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.net/) Powered by Discuz! X3.2