RE: Feature Pack 1 RELEASED!
- From: "Thomas W Shinder" <tshinder@xxxxxxxxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Wed, 8 Jan 2003 18:36:46 -0600
Hi Ed,
That would be great! I'm still curious about the possibility of a max
regkey size.
Thanks!
Tom
-----Original Message-----
From: Edward Sullivan [mailto:esullivan@xxxxxxx]
Sent: Wednesday, January 08, 2003 9:03 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Feature Pack 1 RELEASED!
http://www.ISAserver.org
Jim, here was my original message to the group. More below:
--------
"We are running ISA and IIS SMTP on our perimeter email
screener, and using the SMTP Filter to screen for:
* Attachment types (.exe, .pif, .com, .vbs, .bat, and
.scr)
* Domains which we receive spam from (about 100 in the
list)
* Spam keywords (126 keywords in the list)
Any message that meets SMTP filter criteria is forwarded to a
spam box on our primary Exchange Server.
This server is not our firewall - we are only using ISA for the
email filtering functionality. The server hardware is a Dell 2550 with
512MB of RAM, and a 2 GHZ XEON Processor. Dual NIC's, of course. To me,
this seems like a well-sized server for the application.
My question is this - I have noticed that certain keywords are
not being filtered, and that messages that contain keywords are not
being forwarded to our spam address, and are instead making it to our
users. Is there an effective limit to the number of keywords ISA can
handle, or is there a misconfiguration somewhere? Has anyone else seen
this behavior, and found a way to correct it? A bug in ISA perhaps?
(Heaven forbid!)"
--------
After working with Tom for awhile, both he and I (mostly he)
determined where in the registry the keyword, attachment type, and
domain keywords are stored in the registry. See this Q for details, and
make sure you use REGEDIT and not REGEDT32 to view the registry keys:
http://support.microsoft.com/default.aspx?scid=kb;en-us;305012
Tom's theory was that there was a limit to the max size that the
registry key could store, and once this max size was reached it might be
causing the domain and keyword filters to sporadically fail. Numerous
tests on my part yielded nothing promising, for example
"freddysfabulousfinds.com" would consistently fail both as a domain and
a filter keyword even after it was removed, re-added, coaxed, cursed at,
etc.
I have yet to determine if FP1 has corrected this issues, but
initial tests are promising. ("freddysfabulousfinds.com" is no longer
failing when tested as a SMTP filter keyword.) Once I know conclusively
if FP1 fixed the previous problems with the SMTP filter I will report
back to the group.
Ed Sullivan
Director of Information Services
esullivan@xxxxxxx <mailto:esullivan@xxxxxxx>
KMA Direct Communications
Confidential and Proprietary
Other related posts:
