[rt-users] Search for dead tickets fails?

[Bruce Campbell]

On Thu, 9 Jan 2003, Seth Cohn, EFN General Manager wrote:

> On Thu, 9 Jan 2003, Bruce Campbell wrote:
>
> > > I agree with that.  I'm working on a spamfiltering tool to kill spam
> > > tickets (based on the autoresponse bounce) and I did a search and noticed
> > > 'hey, wait a sec...."
> >
> > Oooh, thats nifty, but wouldn't the bounce take a long time occasionally?
>
> Agreed.  it's not the best solution, _but_ short of spamfiltering the
> queue mail before it gets to RT, it's a good attempt.

Run the mail through a spam filter, then have Rt (or RT's procmailrc) do
stuff basic on your spamfilter's headers.

Eg, all mail here passes through SpamAssassin, then our installation of RT
essentially does:

	If got SpamAssassin 4 stars or more ; then
		If got '^\s*Received:' in the body ; then
			Mark as Spam Complaint
			Bounce to Autoresponder
		else
			Mark as Spam
		fi
		Mark as Resolved
	else
		Other stuff, such as sending autoack
	fi

> > ( eg, the sending domain exists, but isn't responding on port 25.  Your
> >   local MTA would then wait a default of 8 hours before returning a
> >   warning message.
>
> True.  Same for spam with a valid return address (or one that doesn't
> generate a bounce at least).

Although this could be reduced by tweaking your MTA to return a warning to
RT comparitively quickly.

-- 
                             Bruce Campbell                            RIPE
                   Systems/Network Engineer                             NCC
                 www.ripe.net - PGP562C8B1B             Operations/Security