Bob Matlosz
05-24-2004, 04:16 PM
Hi,
I am having a strange problem with my filter order. I have the order set
for:
USER
DOMAIN
GLOBAL
For most of the accounts this is the order it executes in:
5/24/2004 12:01:00 PM ID:2581 250 Recipient "example@testdomain.com" OK...
5/24/2004 12:01:00 PM ID:2581 DATA
5/24/2004 12:01:00 PM ID:2581 354 Ready
5/24/2004 12:01:01 PM ID:2581 0: ------ Beginning Filters ------
5/24/2004 12:01:01 PM ID:2581 0: Looking for Default user filters...
5/24/2004 12:01:01 PM ID:2581 0: Attempting to load D:Program FilesServer
Side SolutionseWallFiltersxxx.com
eneeDefault.mfr
5/24/2004 12:01:01 PM ID:2581 0: Filters don't exist
5/24/2004 12:01:01 PM ID:2581 0: Looking for Incoming user filters...
5/24/2004 12:01:01 PM ID:2581 0: Attempting to load D:Program FilesServer
Side SolutionseWallFiltersxxx.com
eneeIncoming.mfr
5/24/2004 12:01:01 PM ID:2581 0: Filters don't exist
5/24/2004 12:01:01 PM ID:2581 0: Looking for Default domain filters...
5/24/2004 12:01:01 PM ID:2581 0: Attempting to load D:Program FilesServer
Side SolutionseWallFiltersxxx.comDefault.mfr
5/24/2004 12:01:01 PM ID:2581 1: Filters loaded
5/24/2004 12:01:01 PM ID:2581 1: -> Processing filter 'Virus'
5/24/2004 12:01:01 PM ID:2581 1: Checking condition 'message has a virus'
5/24/2004 12:01:01 PM ID:2581 1: Running AVG Antivirus System
5/24/2004 12:01:01 PM ID:2581 2: Antivirus scan result: Message is clean.
5/24/2004 12:01:01 PM ID:2581 12: Looking for Incoming domain filters...
5/24/2004 12:01:01 PM ID:2581 12: Attempting to load D:Program FilesServer
Side SolutionseWallFiltersxxx.comIncoming.mfr
5/24/2004 12:01:01 PM ID:2581 13: Filters don't exist
5/24/2004 12:01:01 PM ID:2581 13: Looking for Global Default filters...
5/24/2004 12:01:01 PM ID:2581 13: Attempting to load D:Program FilesServer
Side SolutionseWallFilters[GlobalFilters]Default.mfr
5/24/2004 12:01:01 PM ID:2581 13: Filters loaded
5/24/2004 12:01:01 PM ID:2581 13: -> Processing filter 'Extensions'
5/24/2004 12:01:01 PM ID:2581 13: Checking condition 'parts headers matches
expression 'name="?[^
]+.(?i)(bat)[^w]+' or matches expression
'name="?[^
]+.(?i)(cmd)[^w]+'...'
5/24/2004 12:01:01 PM ID:2581 15: Checking condition 'header matches
expression 'name="?[^
]+.(?i)(bat)[^w]+' or matches expression
'name="?[^
]+.(?i)(cmd)[^w]+'...'
5/24/2004 12:01:01 PM ID:2581 28: -> Processing filter 'Domain Block'
5/24/2004 12:01:01 PM ID:2581 29: Checking condition 'From contains
'flowgo.com' or Y-MAIL-FROM contains 'flowgo.com''
5/24/2004 12:01:01 PM ID:2581 43: -> Processing filter 'Keyword'
5/24/2004 12:01:01 PM ID:2581 43: Checking condition 'body contains word
'p0rn' or contains word 'penis' or contains word 'porn'...'
5/24/2004 12:01:01 PM ID:2581 48: Checking condition 'header contains word
'p0rn' or contains word 'penis' or contains word 'porn'...'
5/24/2004 12:01:01 PM ID:2581 49: Checking condition 'Subject contains word
'p0rn' or Subject contains word 'penis' or Subject contains word 'porn'...'
5/24/2004 12:01:01 PM ID:2581 59: Looking for Global Incoming filters...
5/24/2004 12:01:01 PM ID:2581 59: Attempting to load D:Program FilesServer
Side SolutionseWallFilters[GlobalFilters]Incoming.mfr
5/24/2004 12:01:01 PM ID:2581 59: Filters don't exist
5/24/2004 12:01:01 PM ID:2581 59: ------ Ending Filters ------
5/24/2004 12:01:02 PM ID:2581 250 Message accepted for delivery.
5/24/2004 12:01:02 PM ID:2581 QUIT
5/24/2004 12:01:02 PM ID:2581 221 Aba he
5/24/2004 12:01:02 PM ID:2581 Disconnected
But some users this is what I am getting. Strange thing is other accounts in
the same domain work correctly.
5/24/2004 12:01:03 PM ID:2575 250 Recipient "test@testdomain.com" OK...
5/24/2004 12:01:03 PM ID:2575 DATA
5/24/2004 12:01:03 PM ID:2575 354 Ready
5/24/2004 12:01:03 PM ID:2575 0: ------ Beginning Filters ------
5/24/2004 12:01:03 PM ID:2575 0: Looking for Global Default filters...
5/24/2004 12:01:03 PM ID:2575 0: Attempting to load D:Program FilesServer
Side SolutionseWallFilters[GlobalFilters]Default.mfr
5/24/2004 12:01:03 PM ID:2575 1: Filters loaded
5/24/2004 12:01:03 PM ID:2575 1: -> Processing filter 'Extensions'
5/24/2004 12:01:03 PM ID:2575 1: Checking condition 'parts headers matches
expression 'name="?[^
]+.(?i)(bat)[^w]+' or matches expression
'name="?[^
]+.(?i)(cmd)[^w]+'...'
5/24/2004 12:01:03 PM ID:2575 2: Checking condition 'header matches
expression 'name="?[^
]+.(?i)(bat)[^w]+' or matches expression
'name="?[^
]+.(?i)(cmd)[^w]+'...'
5/24/2004 12:01:03 PM ID:2575 5: -> Processing filter 'Domain Block'
5/24/2004 12:01:03 PM ID:2575 6: Checking condition 'From contains
'flowgo.com' or Y-MAIL-FROM contains 'flowgo.com''
5/24/2004 12:01:03 PM ID:2575 21: -> Processing filter 'Keyword'
5/24/2004 12:01:03 PM ID:2575 21: Checking condition 'body contains word
'p0rn' or contains word 'penis' or contains word 'porn'...'
5/24/2004 12:01:03 PM ID:2575 22: Checking condition 'header contains word
'p0rn' or contains word 'penis' or contains word 'porn'...'
5/24/2004 12:01:03 PM ID:2575 23: Checking condition 'Subject contains word
'p0rn' or Subject contains word 'penis' or Subject contains word 'porn'...'
5/24/2004 12:01:03 PM ID:2575 37: ------ Ending Filters ------
Any ideas where to look first. I checked everything I could think of and
compared to working accounts and all looks the same.
Thanks,
Bob Matlosz
I am having a strange problem with my filter order. I have the order set
for:
USER
DOMAIN
GLOBAL
For most of the accounts this is the order it executes in:
5/24/2004 12:01:00 PM ID:2581 250 Recipient "example@testdomain.com" OK...
5/24/2004 12:01:00 PM ID:2581 DATA
5/24/2004 12:01:00 PM ID:2581 354 Ready
5/24/2004 12:01:01 PM ID:2581 0: ------ Beginning Filters ------
5/24/2004 12:01:01 PM ID:2581 0: Looking for Default user filters...
5/24/2004 12:01:01 PM ID:2581 0: Attempting to load D:Program FilesServer
Side SolutionseWallFiltersxxx.com
eneeDefault.mfr
5/24/2004 12:01:01 PM ID:2581 0: Filters don't exist
5/24/2004 12:01:01 PM ID:2581 0: Looking for Incoming user filters...
5/24/2004 12:01:01 PM ID:2581 0: Attempting to load D:Program FilesServer
Side SolutionseWallFiltersxxx.com
eneeIncoming.mfr
5/24/2004 12:01:01 PM ID:2581 0: Filters don't exist
5/24/2004 12:01:01 PM ID:2581 0: Looking for Default domain filters...
5/24/2004 12:01:01 PM ID:2581 0: Attempting to load D:Program FilesServer
Side SolutionseWallFiltersxxx.comDefault.mfr
5/24/2004 12:01:01 PM ID:2581 1: Filters loaded
5/24/2004 12:01:01 PM ID:2581 1: -> Processing filter 'Virus'
5/24/2004 12:01:01 PM ID:2581 1: Checking condition 'message has a virus'
5/24/2004 12:01:01 PM ID:2581 1: Running AVG Antivirus System
5/24/2004 12:01:01 PM ID:2581 2: Antivirus scan result: Message is clean.
5/24/2004 12:01:01 PM ID:2581 12: Looking for Incoming domain filters...
5/24/2004 12:01:01 PM ID:2581 12: Attempting to load D:Program FilesServer
Side SolutionseWallFiltersxxx.comIncoming.mfr
5/24/2004 12:01:01 PM ID:2581 13: Filters don't exist
5/24/2004 12:01:01 PM ID:2581 13: Looking for Global Default filters...
5/24/2004 12:01:01 PM ID:2581 13: Attempting to load D:Program FilesServer
Side SolutionseWallFilters[GlobalFilters]Default.mfr
5/24/2004 12:01:01 PM ID:2581 13: Filters loaded
5/24/2004 12:01:01 PM ID:2581 13: -> Processing filter 'Extensions'
5/24/2004 12:01:01 PM ID:2581 13: Checking condition 'parts headers matches
expression 'name="?[^
]+.(?i)(bat)[^w]+' or matches expression
'name="?[^
]+.(?i)(cmd)[^w]+'...'
5/24/2004 12:01:01 PM ID:2581 15: Checking condition 'header matches
expression 'name="?[^
]+.(?i)(bat)[^w]+' or matches expression
'name="?[^
]+.(?i)(cmd)[^w]+'...'
5/24/2004 12:01:01 PM ID:2581 28: -> Processing filter 'Domain Block'
5/24/2004 12:01:01 PM ID:2581 29: Checking condition 'From contains
'flowgo.com' or Y-MAIL-FROM contains 'flowgo.com''
5/24/2004 12:01:01 PM ID:2581 43: -> Processing filter 'Keyword'
5/24/2004 12:01:01 PM ID:2581 43: Checking condition 'body contains word
'p0rn' or contains word 'penis' or contains word 'porn'...'
5/24/2004 12:01:01 PM ID:2581 48: Checking condition 'header contains word
'p0rn' or contains word 'penis' or contains word 'porn'...'
5/24/2004 12:01:01 PM ID:2581 49: Checking condition 'Subject contains word
'p0rn' or Subject contains word 'penis' or Subject contains word 'porn'...'
5/24/2004 12:01:01 PM ID:2581 59: Looking for Global Incoming filters...
5/24/2004 12:01:01 PM ID:2581 59: Attempting to load D:Program FilesServer
Side SolutionseWallFilters[GlobalFilters]Incoming.mfr
5/24/2004 12:01:01 PM ID:2581 59: Filters don't exist
5/24/2004 12:01:01 PM ID:2581 59: ------ Ending Filters ------
5/24/2004 12:01:02 PM ID:2581 250 Message accepted for delivery.
5/24/2004 12:01:02 PM ID:2581 QUIT
5/24/2004 12:01:02 PM ID:2581 221 Aba he
5/24/2004 12:01:02 PM ID:2581 Disconnected
But some users this is what I am getting. Strange thing is other accounts in
the same domain work correctly.
5/24/2004 12:01:03 PM ID:2575 250 Recipient "test@testdomain.com" OK...
5/24/2004 12:01:03 PM ID:2575 DATA
5/24/2004 12:01:03 PM ID:2575 354 Ready
5/24/2004 12:01:03 PM ID:2575 0: ------ Beginning Filters ------
5/24/2004 12:01:03 PM ID:2575 0: Looking for Global Default filters...
5/24/2004 12:01:03 PM ID:2575 0: Attempting to load D:Program FilesServer
Side SolutionseWallFilters[GlobalFilters]Default.mfr
5/24/2004 12:01:03 PM ID:2575 1: Filters loaded
5/24/2004 12:01:03 PM ID:2575 1: -> Processing filter 'Extensions'
5/24/2004 12:01:03 PM ID:2575 1: Checking condition 'parts headers matches
expression 'name="?[^
]+.(?i)(bat)[^w]+' or matches expression
'name="?[^
]+.(?i)(cmd)[^w]+'...'
5/24/2004 12:01:03 PM ID:2575 2: Checking condition 'header matches
expression 'name="?[^
]+.(?i)(bat)[^w]+' or matches expression
'name="?[^
]+.(?i)(cmd)[^w]+'...'
5/24/2004 12:01:03 PM ID:2575 5: -> Processing filter 'Domain Block'
5/24/2004 12:01:03 PM ID:2575 6: Checking condition 'From contains
'flowgo.com' or Y-MAIL-FROM contains 'flowgo.com''
5/24/2004 12:01:03 PM ID:2575 21: -> Processing filter 'Keyword'
5/24/2004 12:01:03 PM ID:2575 21: Checking condition 'body contains word
'p0rn' or contains word 'penis' or contains word 'porn'...'
5/24/2004 12:01:03 PM ID:2575 22: Checking condition 'header contains word
'p0rn' or contains word 'penis' or contains word 'porn'...'
5/24/2004 12:01:03 PM ID:2575 23: Checking condition 'Subject contains word
'p0rn' or Subject contains word 'penis' or Subject contains word 'porn'...'
5/24/2004 12:01:03 PM ID:2575 37: ------ Ending Filters ------
Any ideas where to look first. I checked everything I could think of and
compared to working accounts and all looks the same.
Thanks,
Bob Matlosz