MCP logging action question

[Julian Field]

On 18 May 2005, at 10:57, Quentin Campbell wrote:

> Am using MCP facility for first time to deal with "German" spam from
> Sober.Q worm.
>
> In MailScanner.conf have:
>
> MCP Checks = yes
>
> # Do the spam checks first, or the MCP checks first?
> # This cannot be the filename of a ruleset, only a fixed value.
> First Check = mcp
>
> # The rest of these options are clones of the equivalent spam options
> MCP Required SpamAssassin Score = 1
> MCP High SpamAssassin Score = 10
> MCP Error Score = 1
>
> MCP Header = X-%org-name%-MailScanner-MCPCheck:
> Non MCP Actions = deliver
> MCP Actions = deliver

I suspect you mean "delete" and not "deliver".

> High Scoring MCP Actions = delete
> Bounce MCP As Attachment = no
>
> MCP Modify Subject = yes
> MCP Subject Text = {MCP?}
> High Scoring MCP Modify Subject = yes
> High Scoring MCP Subject Text = {MCP?!}
>
> Is Definitely MCP = no
> Is Definitely Not MCP = no
> Definite MCP Is High Scoring = no
> Always Include MCP Report = yes
> Detailed MCP Report = yes
> Include Scores In MCP Report = yes
> Log MCP = yes
>
> I am seeing as expected in the logs:
>
> May 18 10:43:24 cheviot8 MailScanner[1518]: Message j4I9gwgT004139
> from
> 128.240.233.53 (xxx at hotmail.com) to maildb.ncl.ac.uk is MCP, MCP-
> Checker
> (score=10, required 1, PROLO_GMCP24 10.00)
>
> BUT I am not seeing in the logs the expected
>
> ...MCP Actions: message j4I9gwgT004139 actions are delete
>
> although the message does not appear to be delivered according to the
> logs.
>
> I am running MS 4.41.3-1.
>
> NOTE: I am doing the Sober.Q filtering with MCP rather than normal
> spam
> filtering because we whitelist from spam tagging some domains from
> which
> the Sober.Q messages apparently originate.
>
>
>
> Quentin
> ---
> PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>                            University of Newcastle,
>                            Newcastle upon Tyne,
> FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
> ----------------------------------------------------------------------
> --
> "Any opinion expressed above is mine. The University can get its own."
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!