What is the AIG filter and why is it deleting mail
Question asked by Brian Covington - 10/3/2014 at 2:33 PM
A client complained that they were not receiving an email.  Below is the relevant log that shows "(Deleted) Filter: AIG" for that particular email.  What is that?  The only standout in the logs is the BAYESIANFILTERING that failed.  I have assigned Bayesian Filtering a weight of 10 and none of the thresholds are set to delete.  10-Ignore; 20-prefix; 30-prefix.  I also checked and the client has not overwritten that.
So, I guess my questions are, what is AIG and based on the logs, why was the email deleted.  
Appreciate any help.  Thank!

[2014.10.02] 21:02:20 [15789] Spam check results: [_REVERSEDNSLOOKUP: passed], [_BAYESIANFILTERING: failed], [_COMMTOUCH: 0,Unknown], [_SPF: Pass], [_DK: None], [_DKIM: None], [BARRACUDA - BRBL: passed], [HOSTKARMA - BLACKLIST: passed], [HOSTKARMA - BROWNLIST: passed], [HOSTKARMA - WHITELIST: passed], [HOSTKARMA - YELLOWLIST: passed], [SORBS - ABUSE: passed], [SORBS - DYNAMIC IP: passed], [SORBS - PROXY: passed], [SORBS - SMTP: passed], [SORBS - SOCKS: passed], [SPAMHAUS - CBL: passed], [SPAMHAUS - CSS: passed], [SPAMHAUS - PBL: passed], [SPAMHAUS - PBL2: passed], [SPAMHAUS - SBL: passed], [SURBL - ABUSE BUSTER: passed], [SURBL - JWSPAMSPY: passed], [SURBL - MALWARE: passed], [SURBL - PHISHING: passed], [SURBL - SPAMASSASSAIN: passed], [SURBL - SPAMCOP: passed], [UCEPROTECT LEVEL 1: passed], [UCEPROTECT LEVEL 2: passed], [UCEPROTECT LEVEL 3: passed], [URIBL - BLACK: passed], [URIBL - GREY: passed], [URIBL - MULTI: passed], [URIBL - RED: passed], [VIRUS RBL - MSRBL: passed]
[2014.10.02] 21:02:22 [15789] Starting local delivery to xxxxx@xxxxx.org
[2014.10.02] 21:02:22 [15789] Skipping spam filtering: Trusted Sender (user level)
[2014.10.02] 21:02:22 [15789] Delivery for xxx@xxx.com to xxxxx@xxxxx.org has completed (Deleted) Filter: AIG

2 Replies

Reply to Thread
Joe Wolf Replied
It looks to me like the user, domain, or system has a content filter named "AIG" which was triggered by the message and the action was set to Delete the message.

There is nothing in SmarterMail named "AIG" that I know of. Look for a content filter.
Brian Covington Replied
That was it exactly.  Thank you.  The client was trying to block spam and "AIG" was on the list.  Mystery solved.  Thanks again.

Reply to Thread