GFI
English Deutsch Français Italiano Nederlands Español
Forums  Register  Login  My Profile  Inbox  Address Book  My Subscription  My Forums 

Member List  Search  FAQ  Ticket List  Log Out

 

Feature Request Module Identification

 
Logged in as: Guest
Users viewing this topic: none
  Printable Version
All Forums >> [Content Security] >> GFI MailEssentials for Exchange/SMTP >> Feature Request Module Identification Page: [1]
Login
Message << Older Topic   Newer Topic >>
Feature Request Module Identification - 17.Sep.2008 9:26:24 AM   
mharri

 

Posts: 40
Joined: 15.Nov.2006
Status: offline
As a feature request, I would like to see Mail Essentials be able to tag each blocked email with a tag identifying which module blocked it. 

For instance, if a particular email is blocked due to header checking there should be a way to identify which module did it. 

If an individual sets a particular module to dump into a spam folder, they can then later go back to help identify which module is grabbing legitimate emails more easily.  This should be a feature that you can either turn on and off based on the particular module.  Thank you.
Post #: 1
RE: Feature Request Module Identification - 17.Sep.2008 9:29:44 AM   
Michael Alexieff

 

Posts: 80
Joined: 8.Sep.2008
Status: offline
What actions are you taking when GFI MailEssentials finds a piece of spam?

_____________________________

Regards,
Michael Alexieff - Technical Support Representative
GFI Software - www.gfi.com

(in reply to mharri)
Post #: 2
RE: Feature Request Module Identification - 17.Sep.2008 9:35:27 AM   
mharri

 

Posts: 40
Joined: 15.Nov.2006
Status: offline
Currently I have most modules set to delete.  However we are sometimes getting false positives that I have found when I direct a module to dump into a folder. 

The problem then becomes identifying which module is grabbing the legitimate items.  I thought by having a tag option built into Mail Essentials that it would help to identify which module is grabbing the legitimate email.  I could either turn it off, dial it down or continue to monitor the traffic being captured by that particular module.  Thanks.

(in reply to Michael Alexieff)
Post #: 3
RE: Feature Request Module Identification - 17.Sep.2008 9:44:37 AM   
Michael Alexieff

 

Posts: 80
Joined: 8.Sep.2008
Status: offline
There is a registry entry you can change that when moved specified folder in the inbox that it will tag the reason why it was moved there. Check out the following Knowledge base article on how to enable this, http://kbase.gfi.com/showarticle.asp?id=KBID001892

_____________________________

Regards,
Michael Alexieff - Technical Support Representative
GFI Software - www.gfi.com

(in reply to mharri)
Post #: 4
RE: Feature Request Module Identification - 17.Sep.2008 12:32:53 PM   
SoCal_HEMIHead

 

Posts: 18
Joined: 14.Aug.2008
Status: offline
You can also search the log files for each module to locate the blocked message.  That's what I do.

(in reply to Michael Alexieff)
Post #: 5
RE: Feature Request Module Identification - 18.Sep.2008 12:31:11 PM   
RSP

 

Posts: 453
Joined: 31.Oct.2006
From: UK
Status: offline
At the risk of being flamed for liking the Rules Manager again...

Set the modules to tag the spam slightly differently. eg: [SPAM-Header], [SPAM-Keyword] etc.
Then use the rulemgmt.exe to set a rule up on each mailbox to move "[SPAM-" into the user's spam folder.

I've always found it works a treat, and when users complain, it's very easy to get them to read out the Subject to determine how a message was caught.

I also find the log files (in the Logs directory) useful like SoCal_HEMIHead, although these can get quite large. A copy of tail.exe helps here, which only shows the last few lines of a file.

(in reply to SoCal_HEMIHead)
Post #: 6
RE: Feature Request Module Identification - 19.Sep.2008 8:56:23 AM   
joestern

 

Posts: 238
Joined: 18.Sep.2003
From: Philadelphia, PA
Status: offline
Another thing that makes spam-reason diagnosis easier is to use separate logs for each antispam component. Emails removed by the DNS blacklist module go in the DNSBlacklist.log file, Emails embargoed by the Bayesian filter go in Bayesian.log, etc.

I use Agent Ransack to search the logs directory for the affected mail, and it will check all the logs at once.

- Joe

(in reply to RSP)
Post #: 7
RE: Feature Request Module Identification - 19.Sep.2008 1:37:20 PM   
vizeroth

 

Posts: 7
Joined: 1.Aug.2008
Status: offline
It should also be noted that you can move the individual log files to create archives, and ME just generates a new file in place of the old one (alternatively you could rename the log file, but I move them to an archive folder and add the date range of the logs they contain to the filename). If you do this often enough (or schedule a task to do it for you), the log files should be at a pretty reasonable size, depending on the number of messages you catch in a particular filter in a given period of time.

(in reply to joestern)
Post #: 8
Page:   [1]
All Forums >> [Content Security] >> GFI MailEssentials for Exchange/SMTP >> Feature Request Module Identification Page: [1]
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts


   © 2008. All rights reserved. GFI Software Home Products Download Trials Support Ordering Site Map About Us Contact us
GFI solutions: Exchange anti spam filter - exchange anti virus - isa server - network vulnerability scanner - event log management - USB security software - exchange archiving - fax server software