Spam Email are not Blocked or Tagged
|
Logged in as: Guest
|
|
Users viewing this topic:
none
|
|
Login  | |
|
Spam Email are not Blocked or Tagged - 14.Aug.2008 1:25:33 PM
|
|
|
qawit
Posts: 1
Joined: 14.Aug.2008
Status: offline
|
Recently our ME12 installation(3 year old) has not been blocking SPAM for users on EXCHANGE 2000. We have completed all Knowledge Base maintenance to no result. My fear is possible corrupt Anti-Spam database since just about all functions of logging and reporting has stopped. Any advise.
|
|
|
|
|
RE: Spam Email are not Blocked or Tagged - 14.Aug.2008 8:48:09 PM
|
|
|
John Letourneau
Posts: 1089
Joined: 28.Apr.2008
From: Clayton, NC
Status: offline
|
qawit,
If you look in the GFI Monitor do you see "Item Processed OK" or "Item Processing Unsuccessful"?
_____________________________
Regards,
John Letourneau - Senior Technical Support Representative
GFI Software - www.gfi.com
|
|
|
|
|
RE: Spam Email are not Blocked or Tagged - 18.Aug.2008 1:36:40 PM
|
|
|
nintenDRU
Posts: 12
Joined: 23.Jan.2007
From: Long Beach, CA
Status: offline
|
I am having the same issue myself, all of a sudden "none" of the junk email is being tagged with the [SPAM] in the subject line. It has been happening off anf on for the last couple of weeks. Before if I just rebooted the server it would start to work again but not today. I have also checked that both my backup and AV software is excluding the ..program file\common file\gfi... directory
Please advise.
Andrew
quote:
ORIGINAL: John Letourneau
qawit,
If you look in the GFI Monitor do you see "Item Processed OK" or "Item Processing Unsuccessful"?
|
|
|
|
|
RE: Spam Email are not Blocked or Tagged - 20.Aug.2008 9:54:12 AM
|
|
|
John Letourneau
Posts: 1089
Joined: 28.Apr.2008
From: Clayton, NC
Status: offline
|
nintenDRU,
If you look in the monitor do you see "Item Processed OK" or "Item Processing Unsuccessful"?
_____________________________
Regards,
John Letourneau - Senior Technical Support Representative
GFI Software - www.gfi.com
|
|
|
|
|
RE: Spam Email are not Blocked or Tagged - 20.Aug.2008 1:24:31 PM
|
|
|
nintenDRU
Posts: 12
Joined: 23.Jan.2007
From: Long Beach, CA
Status: offline
|
It looks like it resolved itself. My server was crashing from another issue and once I got it back up and it got caught up to real time email it seems to be working just fine.
|
|
|
|
|
RE: Spam Email are not Blocked or Tagged - 25.Aug.2008 5:14:00 PM
|
|
|
xia
Posts: 4
Joined: 25.Aug.2008
Status: offline
|
I am having issues with emails not getting blocked as well. I re-ordered the modules to block the Custom Blacklist first. Then I added an address like olduser@mydomain.com in order to block any mail sent to an old address at our domain but emails sent to the defunct email address still get through. To make matters worse, I added something very specific to keyword blocking list, like "viagra", and now emails to the olduser@domain.com that contain "viagra" in the subject get through. There's 2 failed spam blocking modules. What gives? Bayesian filters are useless as i work for multi-language international company and it generates way too many false positives. Directory harvesting filter aso appear to fail, as I get emails from one employee to another get caught in filters despite lack of keywords or other triggers. Picking up these false positives and putting them in the exchange pick-up folder doesn't work either since GFI re-filters it so the only way to bypass the filtering is adding the To: or From: to whitelist, and then it pops warning when you do that, blah blah. Is the trial version bugged and non-functional is some way? This is the worst trial run of any product i've seen in awhile. Much as I hate vanilla Exchange spam filtering, it beats this experience so far. And before you ask, yes, i looked in the Monitor and yes it shows items processed "ok". I even rebooted the server today for giggles. Emails still sail right through filters like they aren't there. Except the forum validation email, it filtered that one, of course. =/
|
|
|
|
|
RE: Spam Email are not Blocked or Tagged - 26.Aug.2008 9:15:02 AM
|
|
|
John Letourneau
Posts: 1089
Joined: 28.Apr.2008
From: Clayton, NC
Status: offline
|
xia,
What build of GFI MailEssentials 12 are you running? If you are on the latest build can you copy the message ID of a recent spam message that made it to your inbox, preferably a viagra one, and then attempt to find the message in ase_action.gfi_log.txt or ase_action.gfi_log.bak? This log is located in ..\Program Files\GFI\MailEssentials\DebugLogs.
_____________________________
Regards,
John Letourneau - Senior Technical Support Representative
GFI Software - www.gfi.com
|
|
|
|
|
RE: Spam Email are not Blocked or Tagged - 26.Aug.2008 10:57:48 AM
|
|
|
xia
Posts: 4
Joined: 25.Aug.2008
Status: offline
|
quote:
ORIGINAL: John Letourneau
xia,
What build of GFI MailEssentials 12 are you running? If you are on the latest build can you copy the message ID of a recent spam message that made it to your inbox, preferably a viagra one, and then attempt to find the message in ase_action.gfi_log.txt or ase_action.gfi_log.bak? This log is located in ..\Program Files\GFI\MailEssentials\DebugLogs.
Build 20080623
Another quick question while i dig into log files for a spam that made it through... does GFI filter first, or does Exchange IMF and filtering rules apply first? Most of the spam mails i see in my spam folder are ARCH* labelled which leads me to believe Excange is still handlin most/all of the filtering, but i do see some GFI formated names in there. Should Exchange's filters be turned off?
|
|
|
|
|
RE: Spam Email are not Blocked or Tagged - 26.Aug.2008 12:03:43 PM
|
|
|
krazyz28
Posts: 3
Joined: 31.Mar.2008
Status: offline
|
quote:
ORIGINAL: xia
I am having issues with emails not getting blocked as well. I re-ordered the modules to block the Custom Blacklist first. Then I added an address like olduser@mydomain.com in order to block any mail sent to an old address at our domain but emails sent to the defunct email address still get through. To make matters worse, I added something very specific to keyword blocking list, like "viagra", and now emails to the olduser@domain.com that contain "viagra" in the subject get through. There's 2 failed spam blocking modules. What gives? Bayesian filters are useless as i work for multi-language international company and it generates way too many false positives. Directory harvesting filter aso appear to fail, as I get emails from one employee to another get caught in filters despite lack of keywords or other triggers. Picking up these false positives and putting them in the exchange pick-up folder doesn't work either since GFI re-filters it so the only way to bypass the filtering is adding the To: or From: to whitelist, and then it pops warning when you do that, blah blah. Is the trial version bugged and non-functional is some way? This is the worst trial run of any product i've seen in awhile. Much as I hate vanilla Exchange spam filtering, it beats this experience so far. And before you ask, yes, i looked in the Monitor and yes it shows items processed "ok". I even rebooted the server today for giggles. Emails still sail right through filters like they aren't there. Except the forum validation email, it filtered that one, of course. =/
I have recently noticed the same issue with my custom blacklist not blocking e-mails being sent to addresses on that list. I was going through the New Senders log and noticed e-mails destined for old employees that are currently on the Custom Blacklist as a Check MIME TO: address making it through. The Custom Blacklist is module priority 1 on my server. I have also noticed a bunch of e-mails making it through that the Keyword Checking list should be blocking.
And I am also on Build 20080623.
I just installed ME12_PATCH_20080813_01.zip that is supposed to fix something with the Auto Whitelist. I will post back if that fixes my problem.
< Message edited by krazyz28 -- 26.Aug.2008 12:06:48 PM >
|
|
|
|
|
RE: Spam Email are not Blocked or Tagged - 26.Aug.2008 12:41:16 PM
|
|
|
xia
Posts: 4
Joined: 25.Aug.2008
Status: offline
|
quote:
ORIGINAL: xia
... Should Exchange's filters be turned off? ...
To answer my own question, yes, it appears that Exchage filters first. I left IMF running (so anything getting through might be flagged at client level and routed to spam/junk mail at least) but changed the "block" action to "No Action", which seems silly to me but hey, everythign passes through to GFI now which so far seems to be filtering ok. It's heavly reliant on block list services like backscatterer and sorbs, but that's a global hurdle suppose. All i can do at this point is slowly build a custom keyword list to try to delete the obvious spam and hope my users aren't stupid enough to email the word "pen!s" as a subject to each other. Also, director harvesting isn't very intelligent, it will pass emails through to a disabled account when using Active Directory. (Yes, why would I do it that way? we have users that come and go with jobs, it's easier to just disable accounts rather than recreate them if they're rehired for another job later. Work-around I guess is to remove smtp entry for that account, but that's a pain.)
|
|
|
|
|
RE: Spam Email are not Blocked or Tagged - 26.Aug.2008 5:39:36 PM
|
|
|
xia
Posts: 4
Joined: 25.Aug.2008
Status: offline
|
Another issue, not sure if it's related: inbound email generates out of office response (i can see the outbound Out of Office mail), but the original email itself is flagged and deleted before reaching user's inbox. Is this known quirk of Exchange? Ideally i would love to turn off Out of Office replies as they're nothing but trouble, but as many administrators know, the business for better or worse, drives the policies.
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
|
Printable Version
