efa-project.org

Is it normal to get the blacklisted emails in the daily report?

Possibly, I will need to check the SQL query.

Can you tell mw what file it is? the filename. I can look at it and may be able to change it. If I get lucky, Ill post the change for all to reference.

Here you go:

/usr/local/bin/mailwatch/tools/Cron_jobs/quarantine_report.php

Well, I removed the entries from here:

CASE
WHEN a.virusinfected>0 THEN 'Virus'
WHEN a.nameinfected>0 THEN 'Bad Content'
WHEN a.otherinfected>0 THEN 'Infected'
WHEN a.ishighspam>0 THEN 'Spam'
WHEN a.issaspam>0 THEN 'Spam'
WHEN a.isrblspam>0 THEN 'Spam'
WHEN a.spamblacklisted>0 THEN 'Blacklisted'
WHEN a.isspam THEN 'Spam'
WHEN a.ismcp>0 THEN 'Policy'
WHEN a.ishighmcp>0 THEN 'Policy'
WHEN a.issamcp>0 THEN 'Policy'
WHEN a.mcpblacklisted>0 THEN 'Policy'
WHEN a.isspam>0 THEN 'Spam'
ELSE 'UNKNOWN'
END AS reason

But that did not work. an I think I may know why. The blacklisted emails are also considered spam and high spam when you look at the message property page. So the blacklisted message will still be pulled into the report because of that spam attribute. Am I on the right track?

Yes, you are in the right place.