FAQSearchLoginRegister
It is currently Tue Oct 17, 2017 1:53 am

All times are UTC - 7 hours [ DST ]




Post new topic Reply to topic  [ 31 posts ]  Go to page 1, 2  Next
 Notify Administrator of RBL "HIT" 
Author Message

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Notify Administrator of RBL "HIT"
Is it possible to notify Administrator of RBL hit when RBL hits are scored along with other heuristics?

Could support send me a modification to do this?

Thank you so much! (I am using 3.6)


Tue Feb 12, 2008 7:58 am
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
I should have mentioned this before.

The reason I would like this functionality is to see how effective some of my RBL lists are for my organizations needs. If there is some other way to know, please let me know.


Tue Feb 12, 2008 8:05 am
Profile E-mail

Joined: Tue Apr 10, 2007 6:46 am
Posts: 260
Location: Germany
Post Re: Notify Administrator of RBL "HIT"
Hello,

just take a look at statistics and you know how many RBL hits you have.

regs Frank

_________________
If you find a rule that works --> share it !


Wed Feb 13, 2008 1:30 am
Profile

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
Where do I find these statistics?
Are they list specific?

Thanks


Wed Feb 13, 2008 5:11 am
Profile E-mail

Joined: Tue Apr 10, 2007 6:46 am
Posts: 260
Location: Germany
Post Re: Notify Administrator of RBL "HIT"
Hello,

use GWAVA Configuration --> go to logging --> enable logging --> define a sheduled output and you get every day your statistics !

regs Frank

_________________
If you find a rule that works --> share it !


Wed Feb 13, 2008 6:19 am
Profile

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
Frank--
I'm not sure how to configure that to see all of my RBL hits and what lists hit...
Any chance support can send me an update to notify admin on rbl HIT as opposed to the available rbl BLOCK?
Thanks!


Thu Feb 14, 2008 4:23 pm
Profile E-mail

Joined: Tue Apr 10, 2007 6:46 am
Posts: 260
Location: Germany
Post Re: Notify Administrator of RBL "HIT"
Hello,

you can define an administrators mail-address: GWAVA configuration --> notify options --> Administrators Internet e-mail address: e.g. postmaster@mydomain.com

Then go to RBL/SURBL and mark checkbox "Notify administrator of RBL-Block"

Now every time a RBL hit is triggered you get a notification ! But there is no way, to see, which RBL-list triggered the block.

If you do RBL-blocking at the GWIA, you won't receive notification, but if you browse the log-file, you will see which IP-Addresses had been blocked and you will also see which RBL-list caused the blocking. What you want actually is a notification off all RBL-blockings along with the information, which RBL-list triggered it, but I think there is no way to do this. Hope this helps.

regs Frank

_________________
If you find a rule that works --> share it !


Fri Feb 15, 2008 3:40 am
Profile

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
bensem, with that setup, you are notified of rbl blocks (meaning it will never tell you anything unless gwava is configured to block on hits-- if you score on hits, there is no notifcation, in fact, the stats suggest 0 rbl hits even during hits that result in scoring).
if you are blocking RBLs and have notifications setup-- it does let you know what list had the hit.

i am hoping to receive this same notification while scoring on RBL hits, not blocking on RBL hits.

forgive me if i am incorrect on this. i appreciate all of the help.

i also think there is no current way to do this, but i've seen support
(hello world? maybe) post up patches to make certain things happen that couldn't happen before for people.


Fri Feb 15, 2008 6:41 am
Profile E-mail

Joined: Thu Feb 14, 2008 5:12 pm
Posts: 165
Post Re: Notify Administrator of RBL "HIT"
in your support logs, (if you want to look through all that code) you can view which RBL site has the sender/ip listed that triggered the block.

however, i don't think that we have a defined "list" showing which RBL list blocked "x" many emails. Sorry.


Fri Feb 15, 2008 10:45 am
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
ian, where do i find these support logs/where do i enable them?

i guess my main question is if someone can send me a file to edit my gwava to send admin the same notification e-mail that is sent when you have gwava configured to block rbl hits and notify the administrator. i am hoping for this to occur when you are adding a score to rbl hits rather than blocking them...

in the notification e-mail it says whatever e-mail was blocked because it was listed in whatever rbl list.

does that make sense?
i'm not necessarily hoping for the ability to see how many hits each list is getting.


Fri Feb 15, 2008 10:51 am
Profile E-mail

Joined: Thu Feb 14, 2008 5:12 pm
Posts: 165
Post Re: Notify Administrator of RBL "HIT"
I'm assuming you're running gwava3, since that's where this message is posted.

your logs (although huge, and hard to figure out) are going to be in the ../dom/gwava/logs folder

You're going to have to search for the correct log using the "date modified" option.

:) best of luck.


Fri Feb 15, 2008 11:11 am
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
the logs in \gwava\log\ does not have the information i am hoping for.
if you are scoring on RBL (not blocking) those log files never mention RBL (at least not with how i have my gwava configured).

i'm not sure if i've made my question clear enough.

i'll post up more in a bit once i can access one of my servers (hopefully later today)...
thanks though!


Fri Feb 15, 2008 11:16 am
Profile E-mail

Joined: Thu Feb 14, 2008 5:12 pm
Posts: 165
Post Re: Notify Administrator of RBL "HIT"
if you are logging in "verbose logging" then you should see your RBL hits.

I took the example below from another gwava3 server:

--- Thu Feb 7 14:55:07 2008 RBL lookup: 88.236.244.89.bl.spamcop.net
--- Thu Feb 7 14:55:07 2008 RBL lookup: 47.16.235.212.bl.spamcop.net
--- Thu Feb 7 14:55:07 2008 RBL hit on server: bl.spamcop.net
--- Thu Feb 7 14:55:07 2008 RBL hit result: 127.0.0.2
--- Thu Feb 7 14:55:07 2008 RBL block on IP address 89.244.236.88


Fri Feb 15, 2008 11:34 am
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
ah ha!
:oops:
i'll try that out in a bit.
thanks.

:D


Fri Feb 15, 2008 11:37 am
Profile E-mail

Joined: Thu Feb 14, 2008 5:12 pm
Posts: 165
Post Re: Notify Administrator of RBL "HIT"
I hope that's that you're looking for.

if you need anything else, just ask.


Fri Feb 15, 2008 11:38 am
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
I do not receive messages similar to:
--- Thu Feb 7 14:55:07 2008 RBL hit on server: bl.spamcop.net
--- Thu Feb 7 14:55:07 2008 RBL hit result: 127.0.0.2

However, I do receive messages similar to:
--- Thu Feb 7 14:55:07 2008 RBL lookup: 88.236.244.89.bl.spamcop.net
--- Thu Feb 7 14:55:07 2008 RBL block on IP address 89.244.236.88


So, I am still stuck. :(
On the example you used, is that gwava3 server blocking on RBL hit? or scoring?


Fri Feb 15, 2008 11:57 am
Profile E-mail

Joined: Thu Feb 14, 2008 5:12 pm
Posts: 165
Post Re: Notify Administrator of RBL "HIT"
it wouldn't matter if it's on scoring or not... because when it comes down to it - it's on an RBL list.

are you on verbose logging?


Fri Feb 15, 2008 12:04 pm
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
yes i am (i wasn't before today).

just checked the logs, and i'm seeing:
RBL lookup:
RBL block
RBL pass

but never:
RBL hit on server: x


Fri Feb 15, 2008 12:10 pm
Profile E-mail

Joined: Thu Feb 14, 2008 5:12 pm
Posts: 165
Post Re: Notify Administrator of RBL "HIT"
edited out.


Last edited by ianp@gwava on Fri Feb 15, 2008 12:21 pm, edited 1 time in total.

Fri Feb 15, 2008 12:12 pm
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
ygm


Fri Feb 15, 2008 12:20 pm
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
When I have block on RBL and notify administrator on, I receive an e-mail similar to the one below:
Subject: GWAVA Admin Notification (RBL block)


A message was blocked by GWAVA
Content protection for Novell GroupWise
--------------------------------------------------------------------------------

GWAVA Agent: MTA
GWAVA Server: SERVERNAME - NetWare (No Profile)
The message was blocked for the following reason(s):
• RBL block
The message contained the following information:

Subject:
Re:LRL-817

From:
spam@spam.spam

Recipients(s):
x@x.x.x.x
[No Cc Addresses]
[No Bc Addresses]

The following information details the events that prevented delivery of this message:


Event Details
RBL block This message was rejected by an RBL server.
The IP address of the blocked message is:
123.12.123.123 which the
LIST.DSBL.ORG RBL Server flagged.

MTA (No Profile) • SERVERNAME • NetWare
Current GWAVA Statistics
(system version 221 / program version 3.60.0)
--------------------------------------------------------------------------------

GWAVA Location: \\SERVERNAME\SYS\GWDOMAIN\GWAVA
--------------------------------------------------------------------------------

Date: 2/15/2008 - 13:41:25
Description Today Cumulative
Total messages processed 23771 343285
Virus infections detected 0 0
Oversize messages 0 1
Oversize attachments 0 0
Blocked attachments 4 193
Messages blocked by address (From,To) 6 (6, 0) 92 (92, 0)
Content filtered messages (Sub,Msg,Att) 0 (0, 0, 0) 0 (0, 0, 0)
RBL blocks 1 9
SURBL blocks 12618 175662
Fingerprint detections 0 0
Spam 2695 34002



http://www.gwava.com • About GWAVA • Powered by GWAVA

--------------------------------------------------------------------------------
Copyright@2005. Beginfinite, Inc. All rights reserved. Content may not be reproduced without permission.


Last edited by pro956 on Fri Feb 15, 2008 12:48 pm, edited 1 time in total.

Fri Feb 15, 2008 12:47 pm
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
I am hoping for that same e-mail notification (or something similar to it) to be sent when I am scoring on RBL hits.


Fri Feb 15, 2008 12:48 pm
Profile E-mail

Joined: Thu Feb 14, 2008 5:12 pm
Posts: 165
Post Re: Notify Administrator of RBL "HIT"
down at the bottom of your list, I see that you only have 19 (I think) blocks via RBL.

is that correct? or am I reading it wrong?


Fri Feb 15, 2008 12:51 pm
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
i turned on RBL blocking for approx 1 minute until i received a e-mail notification and then set it back score on rbl hit.
i received 4 blocks, but the one i posted was the 1st one. i believe the 19 is rbl blocks total.

i do not want to block on rbl hits (that's why it is at 19). i've had plenty of rbl hits...


Fri Feb 15, 2008 12:57 pm
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
fyi,
if i turn on even logging for rbl, nothing happens while i'm scoring on RBL hits.
when i set gwava to block on RBL hits, the .rbl log started to fill up with information including what list the hit occurred on.

however, i need something similar to occur-- in the event log or an e-mail similar to the one i posted up earlier, when i am scoring on rbl hits.

thanks again for the help and attention.


Fri Feb 15, 2008 1:05 pm
Profile E-mail

Joined: Thu Feb 14, 2008 5:12 pm
Posts: 165
Post Re: Notify Administrator of RBL "HIT"
at this point in time... we're thinking that you might not be able to get the information you want unless you have it on RBL block.

However, we are trying to find out if this is possible... maybe by the end of the day, we'll have something for you.


Fri Feb 15, 2008 1:44 pm
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
thanks ianp,
if you are too busy today, feel free to push this back in the list!


Fri Feb 15, 2008 1:46 pm
Profile E-mail

Joined: Thu Feb 14, 2008 5:12 pm
Posts: 165
Post Re: Notify Administrator of RBL "HIT"
I'm wondering exactly what you need this for?

are you trying to figure out which RBL lists are most effective for your system?


Fri Feb 15, 2008 1:48 pm
Profile E-mail

Joined: Mon Jan 07, 2008 3:12 pm
Posts: 45
Post Re: Notify Administrator of RBL "HIT"
that amongst a few other things...


Fri Feb 15, 2008 1:56 pm
Profile E-mail

Joined: Thu Mar 11, 2010 11:38 am
Posts: 245
Post Re: Notify Administrator of RBL "HIT"
GWAVA 3 is rather archaic compared to today's standards. If you're on 3 I'd recommend making some server space and downloading the GWAVA appliance, very easy to install. Would definitely recommend NOT moving your settings over.

There is an option in GWAVA 6 where you can notify the admin or any other email recipient of an RBL hit. There is also fairly detailed information in the support log as to if an IP hit on a particular RBL list, so you don't have to disable all but one list to see what's happening.


Tue Jul 02, 2013 9:47 am
Profile E-mail
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 31 posts ]  Go to page 1, 2  Next

All times are UTC - 7 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © phpBB Group.
Designed by Vjacheslav Trushkin for Free Forums/DivisionCore.