Community Discussions and Support
killed by filtering rule. ????

Thanks.. Working now !!

I use SMTP  blacklists to tag emails, Content control and SpamHalter.
I think it was logging emails caught be Content Control in the syslog !!

<P>Thanks.. Working now !!</P> <P>I use SMTP  blacklists to tag emails, Content control and SpamHalter. I think it was logging emails caught be Content Control in the syslog !!</P>

Sorry to ask this again !!

My Mercury Core Process shows lots of entries like this:

13:06:10: Job MG0006AD:  * killed by filtering rule.
13:20:08: Job MG0006B0:  * killed by filtering rule.
13:21:46: Job MG0006B1:  * killed by filtering rule.
13:23:58: Job MG0006B2:  * killed by filtering rule.
13:39:34: Job MG0006B3:  * killed by filtering rule.
13:46:21: Job MG0006B6:  * killed by filtering rule.
13:46:21: Job MG0006B5:  * killed by filtering rule.

I would like to be able to track down what each message was and why / what killed it !!

My filtering rules only move mail, they don't delete any.. So what is causing this ?? 

I have the following daemons installed:
SpamWall & SpamHalter

Any advice !! Thanks

<P>Sorry to ask this again !!</P> <P>My Mercury Core Process shows lots of entries like this:</P> <P>13:06:10: Job MG0006AD:  * killed by filtering rule. 13:20:08: Job MG0006B0:  * killed by filtering rule. 13:21:46: Job MG0006B1:  * killed by filtering rule. 13:23:58: Job MG0006B2:  * killed by filtering rule. 13:39:34: Job MG0006B3:  * killed by filtering rule. 13:46:21: Job MG0006B6:  * killed by filtering rule. 13:46:21: Job MG0006B5:  * killed by filtering rule. I would like to be able to track down what each message was and why / what killed it !!</P> <P>My filtering rules only move mail, they don't delete any.. So what is causing this ?? </P> <P>I have the following daemons installed: SpamWall & SpamHalter</P> <P>Any advice !! Thanks </P>

GrayWall only works on SMTP transactions and should leave no trace in the core window. The only messages that are deleted by SpamHalter itself are corrections sent to the spam and nospam accounts. You could check the SpamHalter log file and see if there are matches.

/Rolf 

<p>GrayWall only works on SMTP transactions and should leave no trace in the core window. The only messages that are deleted by SpamHalter itself are corrections sent to the spam and nospam accounts. You could check the SpamHalter log file and see if there are matches.</p><p>/Rolf </p>

[quote user="tomt"]My filtering rules only move mail, they don't delete any.. So what is causing this ??[/quote]

'Move' and 'Delete' both have the effect of stopping message filtering from that point.  Core calls this 'killed'

[quote]I have the following daemons installed:
SpamWall & SpamHalter[/quote]

Is that Clamwall?

<P>[quote user="tomt"]My filtering rules only move mail, they don't delete any.. So what is causing this ??[/quote]</P> <P>'Move' and 'Delete' both have the effect of stopping message filtering from that point.  Core calls this 'killed'</P> <P>[quote]I have the following daemons installed: SpamWall & SpamHalter[/quote]</P> <P>Is that Clamwall?</P>

For all of my rules that Delete or Move, I have a supplemental rule with the same trigger (or an "Always" if the Move/Del is in a subroutine) to 'Log a console message" to explain what just happened.

This doesn't get logged to a file (maybe it could be an option in future?) but does show what is happening in real time.

It won't help with "Killed by Daemon" messages, but there area lot less places to look for a misbehaving daemon than a rule.[:)]

 

<p>For all of my rules that Delete or Move, I have a supplemental rule with the same trigger (or an "Always" if the Move/Del is in a subroutine) to 'Log a console message" to explain what just happened.</p><p>This doesn't get logged to a file (maybe it could be an option in future?) but does show what is happening in real time.</p><p>It won't help with "Killed by Daemon" messages, but there area lot less places to look for a misbehaving daemon than a rule.[:)]</p><p> </p>

Thanks
I'll see if I can add that !
 

<p>Thanks I'll see if I can add that !  </p>

Not to sure how to do this.

Here is a section of my Global Filter:

Mercury Global Rules
If header "S" contains "[** SPAM **]" Move "SPAM"

If expression both matches "X-Blocked:*" Dialog "X-Blocked moved to mail-BLOCKED"
If expression both matches "X-Blocked:*" Move "BLOCKED"
Disabled If expression both matches "X-Blocked:*" Move "@C:\\Mail\\BLOCKED"
If expression both matches "X-Blocked:*" Exit ""

If attachment ExtnPart lists "exe, com, bat, png" Dialog "Banned Attachment moved to Bad"
If attachment ExtnPart lists "exe, com, bat, png" Move "bad"

In system messages I see the odd entry like:

May 2,23:23:44 X-Blocked moved to mail-BLOCKED

But this doesn't say for which email !!

Am I doing this wrong ? 

THANKS 

 

 

 

 

Not to sure how to do this.<p>Here is a section of my Global Filter:</p><p>Mercury Global Rules If header "S" contains "[** SPAM **]" Move "SPAM"</p><p>If expression both matches "X-Blocked:*" Dialog "X-Blocked moved to mail-BLOCKED" If expression both matches "X-Blocked:*" Move "BLOCKED" Disabled If expression both matches "X-Blocked:*" Move "@C:\\Mail\\BLOCKED" If expression both matches "X-Blocked:*" Exit "" </p><p>If attachment ExtnPart lists "exe, com, bat, png" Dialog "Banned Attachment moved to Bad" If attachment ExtnPart lists "exe, com, bat, png" Move "bad" </p><p>In system messages I see the odd entry like:</p><p>May 2,23:23:44 X-Blocked moved to mail-BLOCKED</p><p>But this doesn't say for which email !!</p><p>Am I doing this wrong ? </p><p>THANKS </p><p> </p><p> </p><p> </p><p> </p>

Yes that looks right. You don't get any more detail than that.

The timestamps help a bit for id'ing a particular mail (my throughput is not huge so it works OK). 

Having the ~R,~S type substitutions available to filter rules would be a nice feature for the future. [:)] 

 

To avoid running the same tests twice (or more), I generally run the test, then call a label with all the actions required

like so.. 

[quote] 

If expression headers matches "X-SPAMWALL: SPAM detected!" Call "SPAMWALL_HIT"

... 

Label "SPAMWALL_HIT"
Always Dialog "SPAMWALL HIT - moved to Blackhole"
Always Move "blackhole"
Always Return ""
[/quote] 

<p>Yes that looks right. You don't get any more detail than that.</p><p>The timestamps help a bit for id'ing a particular mail (my throughput is not huge so it works OK). </p><p>Having the ~R,~S type substitutions available to filter rules would be a nice feature for the future. [:)] </p><p> </p><p>To avoid running the same tests twice (or more), I generally run the test, then call a label with all the actions required</p><p>like so.. </p><p>[quote] </p><p>If expression headers matches "X-SPAMWALL: SPAM detected!" Call "SPAMWALL_HIT"</p><p>... </p><p>Label "SPAMWALL_HIT" Always Dialog "SPAMWALL HIT - moved to Blackhole" Always Move "blackhole" Always Return "" [/quote] </p>

Thanks
I've now set this up and will see how it goes ! 

Are System Messages saved in a file ?? So I can view them remotely ?? Like I do with other logs !!

Thanks 

 

<p>Thanks I've now set this up and will see how it goes ! </p><p>Are System Messages saved in a file ?? So I can view them remotely ?? Like I do with other logs !!</p><p>Thanks </p><p> </p>

Slight issue !!

New Global Rules:

Mercury Global Rules
If header "S" contains "[** SPAM **]" Call "SPAM"
#
If expression both matches "X-Blocked:*" Call "X-BLOCKED"
#
If expression both matches "X-Whitelisted:*" Dialog "Whitelisted"
If expression both matches "X-Whitelisted:*" Exit ""
#
If attachment ExtnPart lists "exe, com, bat, png" Call "BANNED"
#
Label "SPAM"
Always Dialog "SPAMHALTER - moved to SPAM"
Always Move "spam"
Always Return ""
#
Label "X-BLOCKED"
Always Dialog "X-BLOCKED - moved to BLOCKED"
Always Move "blocked"
Always Return ""
#
Label "BANNED"
Always Dialog "BANNED ATTACHMENT - moved to BANNED"
Always Move "banned"
Always Return ""
#

2 issues !!

1. All email is being routed by the SPAM Rule.. Genuine email is being sent to the SPAM email address.

2. No entries appear on the System Log File - Previously if an email was moved to SPAM to would show:

I 20080505 1222 MG00095B info@heller-leder.com          SPAM                            3943
I 20080505 1236 MG00095D tania@barco.com                SPAM                            5881

Any Idea how to fix these 2 issues ??

Thanks


 

<p>Slight issue !! New Global Rules:</p><p>Mercury Global Rules If header "S" contains "[** SPAM **]" Call "SPAM" # If expression both matches "X-Blocked:*" Call "X-BLOCKED" # If expression both matches "X-Whitelisted:*" Dialog "Whitelisted" If expression both matches "X-Whitelisted:*" Exit "" # If attachment ExtnPart lists "exe, com, bat, png" Call "BANNED" # Label "SPAM" Always Dialog "SPAMHALTER - moved to SPAM" Always Move "spam" Always Return "" # Label "X-BLOCKED" Always Dialog "X-BLOCKED - moved to BLOCKED" Always Move "blocked" Always Return "" # Label "BANNED" Always Dialog "BANNED ATTACHMENT - moved to BANNED" Always Move "banned" Always Return "" #</p><p>2 issues !!</p><p>1. All email is being routed by the SPAM Rule.. Genuine email is being sent to the SPAM email address. </p><p>2. No entries appear on the System Log File - Previously if an email was moved to SPAM to would show:</p><p>I 20080505 1222 MG00095B info@heller-leder.com          SPAM                            3943 I 20080505 1236 MG00095D tania@barco.com                SPAM                            5881</p><p>Any Idea how to fix these 2 issues ??</p><p>Thanks  </p>

Adding always exit from rule processing before the labels might help! :)

/Rolf 

<p>Adding always exit from rule processing before the labels might help! :)</p><p>/Rolf </p>

1. As Rolf said ...

[quote] 

Rules... 

Always Exit ""

Labels...

[/quote] 

2. Killed messages don't show in the syslog, so I don't know how you were getting these before, I never have. 

3. System Messages are not logged to a file, only visible in the console.

<p>1. As Rolf said ...</p><p>[quote] </p><p>Rules... </p><p>Always Exit "" </p><p>Labels...</p><p>[/quote] </p><p>2. Killed messages don't show in the syslog, so I don't know how you were getting these before, I never have. </p><p>3. System Messages are not logged to a file, only visible in the console. </p>
live preview
enter atleast 10 characters
WARNING: You mentioned %MENTIONS%, but they cannot see this message and will not be notified
Saving...
Saved
With selected deselect posts show selected posts
All posts under this topic will be deleted ?
Pending draft ... Click to resume editing
Discard draft