https://wiki.edge.arista.com/index.php?title=Spam_Blocker_Common_FAQs&feed=atom&action=historySpam Blocker Common FAQs - Revision history2024-03-28T15:36:07ZRevision history for this page on the wikiMediaWiki 1.41.0https://wiki.edge.arista.com/index.php?title=Spam_Blocker_Common_FAQs&diff=28317&oldid=prevGræmer: /* Why do emails with larger attachments sometimes not get delivered? */2022-05-03T18:33:22Z<p><span dir="auto"><span class="autocomment">Why do emails with larger attachments sometimes not get delivered?</span></span></p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 18:33, 3 May 2022</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l33">Line 33:</td>
<td colspan="2" class="diff-lineno">Line 33:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Why do emails with larger attachments sometimes not get delivered? ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Why do emails with larger attachments sometimes not get delivered? ===</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>While <del style="font-weight: bold; text-decoration: none;">Untangle </del>is scanning attachments your email server is still waiting for the message, which can trigger a timeout setting. If you're using Exchange, you can try increasing the '''ConnectionInactivityTimeout''' setting.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>While <ins style="font-weight: bold; text-decoration: none;">NG Firewall </ins>is scanning attachments your email server is still waiting for the message, which can trigger a timeout setting. If you're using Exchange, you can try increasing the '''ConnectionInactivityTimeout''' setting.</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div> </div></td><td colspan="2" class="diff-side-added"></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== What do the Event Log Actions for Spam Blocker mean? ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== What do the Event Log Actions for Spam Blocker mean? ===</div></td></tr>
</table>Græmerhttps://wiki.edge.arista.com/index.php?title=Spam_Blocker_Common_FAQs&diff=27792&oldid=prevBcarmichael: /* How can I tell why an email was scored the way it was? */2020-08-31T20:49:16Z<p><span dir="auto"><span class="autocomment">How can I tell why an email was scored the way it was?</span></span></p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 20:49, 31 August 2020</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l24">Line 24:</td>
<td colspan="2" class="diff-lineno">Line 24:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== How can I tell why an email was scored the way it was? ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== How can I tell why an email was scored the way it was? ===</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>You'll need to take a look at the scoring - you can turn on '''Add email headers''', which will write the spam tests into the headers, or take a closer look at '''/var/log/mail.info''' on the command line - when you have a list of tests, you can look up more information on them [<del style="font-weight: bold; text-decoration: none;">http</del>://spamassassin.apache.org/<del style="font-weight: bold; text-decoration: none;">tests_3_2_x</del>.html here].</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>You'll need to take a look at the scoring - you can turn on '''Add email headers''', which will write the spam tests into the headers, or take a closer look at '''/var/log/mail.info''' on the command line - when you have a list of tests, you can look up more information on them [<ins style="font-weight: bold; text-decoration: none;">https</ins>://spamassassin.apache.org/<ins style="font-weight: bold; text-decoration: none;">old/tests_3_3_x</ins>.html here].</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div> </div></td><td colspan="2" class="diff-side-added"></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== My CPU load is always above 7. I still need to test for spam. What do I do? ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== My CPU load is always above 7. I still need to test for spam. What do I do? ===</div></td></tr>
</table>Bcarmichaelhttps://wiki.edge.arista.com/index.php?title=Spam_Blocker_Common_FAQs&diff=2985&oldid=prevDmorris at 16:34, 24 December 20142014-12-24T16:34:42Z<p></p>
<p><b>New page</b></p><div>[[Category:FAQs]]<br />
<br />
<br />
=== What's the difference between Spam Blocker and Spam Blocker Lite? ===<br />
<br />
Both Spam Blocker and Spam Blocker Lite are based on the [http://spamassassin.apache.org/ SpamAssassin] project, however Spam Blocker also integrates a commercial spam engine to boost and improve detection rates.<br />
<br />
<br />
=== Why doesn't Spam Blocker block ''all'' spam? ===<br />
<br />
There are two main reasons why Spam Blocker might not block ''all'' your spam:<br />
<br />
* Spam Blocker is a player in an "arms race" against spammers - new techniques are found to get around filters, which are then updated to catch these new methods. No product can reliably block 100% of spam.<br />
* Field testing indicates that our pre-configured Spam Blocker settings, which are conservative in email as spam, are good fit for most organizations. Selecting a more aggressive scan strength setting from the drop-down menu in Spam Blocker is very easy if you'd like, just remember you may get more false positives.<br />
<br />
<br />
=== What should I set for strength? ===<br />
<br />
Spam Blocker identifies spam based on hundreds of characteristics. Some example characteristic are emails that begins with <tt>Dear</tt>, or emails sent with High Priority. Spam Blocker does not mark an email as spam simply because it is sent with high priority; each characteristic is weighted, producing an overall score. Spam Blocker uses this overall score to determine the probability that the email is spam. This overall score is compared to your Strength setting to determine if an email is considered spam.<br />
<br />
Spam Blocker's default Strength ('''Medium''') blocks most spam without interfering with legitimate email. If you increase the setting above '''Medium''', Spam Blocker becomes more strict thus catching more spam but also increasing the chance of incorrectly flagging legitimate email as spam (a "false positive"). If you want to catch more spam than is caught with '''Medium''' strength and users don't mind sifting through quarantined email to release legitimate email, you can increase your strength to a higher or custom setting. If your organization just wants to cut out most spam, but not have to deal with false positives, then '''Low''' may be a better setting. <br />
<br />
<br />
=== How can I tell why an email was scored the way it was? ===<br />
<br />
You'll need to take a look at the scoring - you can turn on '''Add email headers''', which will write the spam tests into the headers, or take a closer look at '''/var/log/mail.info''' on the command line - when you have a list of tests, you can look up more information on them [http://spamassassin.apache.org/tests_3_2_x.html here].<br />
<br />
<br />
=== My CPU load is always above 7. I still need to test for spam. What do I do? ===<br />
<br />
Raising the number will allow you to test for spam, but will likely also increase the CPU load. If your CPU load is that high, that's an indication that your hardware may not be robust enough for your site. If your user count increased since you installed your server, or the volume of the internet traffic has increased substantially, this could be a cause. You may also have been spending as little for hardware as you could get away with. Regardless, you probably also are being impacted in other areas without realizing it. You should determine exactly what the hardware specs are on your server to determine whether you should supplement the existing hardware or replace it with something more robust.<br />
<br />
<br />
=== Why do emails with larger attachments sometimes not get delivered? ===<br />
<br />
While Untangle is scanning attachments your email server is still waiting for the message, which can trigger a timeout setting. If you're using Exchange, you can try increasing the '''ConnectionInactivityTimeout''' setting.<br />
<br />
<br />
=== What do the Event Log Actions for Spam Blocker mean? ===<br />
<br />
* '''pass message''' - The message was determined to not be spam and was passed.<br />
* '''mark message''' - The message was determined to be spam and marked.<br />
* '''block message''' - The message was determined to be spam and blocked (silently dropped).<br />
* '''quarantine message''' - The message was determined to be spam and quarantined.<br />
* '''pass Safelist message''' - The message was passed because the sender was on the user's or global safe pass-list.<br />
* '''pass Oversize message''' - The message was passed without being scanned because it was over the spam size limit.<br />
* '''pass Outbound message''' - The message was passed without being scanned because it was outbound (WAN-bound).<br />
* '''block message (scan failure)''' - The message was blocked because the scan failed and ''Close connection on scan failure'' is enabled.<br />
* '''pass message (scan failure)''' - The message was blocked because the scan failed and ''Close connection on scan failure'' is disabled.</div>Dmorris