Quarantine Report Tagging all Non-Spam as "Unknown"
Posted: 25 Jun 2016 23:46
I have posted previously and the suggestion fix unfortunately just semi hid the issue.
As per /viewtopic.php?t=931, the quarantine report is showing anything that is not spam as "UNKNOWN", as per the quarantine_report.php
CASE
WHEN a.virusinfected>0 THEN 'Virus'
WHEN a.nameinfected>0 THEN 'Bad Content'
WHEN a.otherinfected>0 THEN 'Infected'
WHEN a.ishighspam>0 THEN 'Spam'
WHEN a.issaspam>0 THEN 'Spam'
WHEN a.isrblspam>0 THEN 'Spam'
WHEN a.spamblacklisted>0 THEN 'Blacklisted'
WHEN a.isspam THEN 'Spam'
WHEN a.ismcp>0 THEN 'Policy'
WHEN a.ishighmcp>0 THEN 'Policy'
WHEN a.issamcp>0 THEN 'Policy'
WHEN a.mcpblacklisted>0 THEN 'Policy'
WHEN a.isspam>0 THEN 'Spam'
ELSE 'UNKNOWN'
END AS reason
The issue is, Bad Content emails are also being tagged as "UNKNOWN" so using the fix from /viewtopic.php?t=931 to hide the "UNKNOWN" isn't really a fix, the quarantine_report.php is not reading the definitions from the database for the emails correctly and my users are not being sent reports including "Bad Content", which they need (we block word/excel documents as part of bad content rules, to much word macros virus's and illiterate users who open documents first ask questions later). And they need to see the legit emails that come in and get grabbed to liaise with the end users to fix it.
This started happening after a 3.0.1.1 upgrade, unfortunately it has been a week so i don't want to roll back and would prefer to find a fix for the report.
As per /viewtopic.php?t=931, the quarantine report is showing anything that is not spam as "UNKNOWN", as per the quarantine_report.php
CASE
WHEN a.virusinfected>0 THEN 'Virus'
WHEN a.nameinfected>0 THEN 'Bad Content'
WHEN a.otherinfected>0 THEN 'Infected'
WHEN a.ishighspam>0 THEN 'Spam'
WHEN a.issaspam>0 THEN 'Spam'
WHEN a.isrblspam>0 THEN 'Spam'
WHEN a.spamblacklisted>0 THEN 'Blacklisted'
WHEN a.isspam THEN 'Spam'
WHEN a.ismcp>0 THEN 'Policy'
WHEN a.ishighmcp>0 THEN 'Policy'
WHEN a.issamcp>0 THEN 'Policy'
WHEN a.mcpblacklisted>0 THEN 'Policy'
WHEN a.isspam>0 THEN 'Spam'
ELSE 'UNKNOWN'
END AS reason
The issue is, Bad Content emails are also being tagged as "UNKNOWN" so using the fix from /viewtopic.php?t=931 to hide the "UNKNOWN" isn't really a fix, the quarantine_report.php is not reading the definitions from the database for the emails correctly and my users are not being sent reports including "Bad Content", which they need (we block word/excel documents as part of bad content rules, to much word macros virus's and illiterate users who open documents first ask questions later). And they need to see the legit emails that come in and get grabbed to liaise with the end users to fix it.
This started happening after a 3.0.1.1 upgrade, unfortunately it has been a week so i don't want to roll back and would prefer to find a fix for the report.