SpamAssassin marks ALL mail as spam

Michael H. Warfield mhw at WITTSEND.COM
Mon Jan 7 21:30:54 GMT 2002


On Mon, Jan 07, 2002 at 06:31:07PM +0000, Julian Field wrote:
> At 14:54 07/01/2002, you wrote:
> >At 14:48 07/01/2002, you wrote:
> >>Was there a fix to this?  I am also having the same problem running
> >>Mailscanner, SpamAssassin 1.5, and Vipul's Razor.  Any suggestions?
> >
> >Not yet. I am going to need login and root access on someone's box to try
> >to diagnose this one. I can't reproduce it myself here at all :-(

> I have found a solution to this problem that works where I have so far
> tried it. If you want to try it out tonight, comment out line 49 of
> sendmail.pl (the line that calls "compile_now()"). It will cause a slight
> performance hit, but that's fine if it fixes a reliability issue.

        Since I can work as well from the office or the house to either
location, I didn't have to wait till tonight...  :-)

        This is a major improvement.  So far, I've only seen one "anomoly".
I saw a message tagged as spam by MailScanner and the spamcheck was
SpamAssassin but the subsequent run by SpamAssassin had tagged the
message with -2 (yes, that's negative two) hits with a threshold of 6
(what I have in my preferences).  I've been expecting a few discrepancies
because the system global preference is 5.  It was the -2 hits that caught
my attention.  Oh, and it was not spam...  The SpamAssassin reports and
check headers are nice for evaluating why something was (or was not)
tagged to fine tune performance.  Unfortunately, since the procmail
run did NOT tag it as spam, I don't have the verbose report of the
individual tests to see what test generated the negative bias.  What
did come out in the headers was this:

X-Mailscanner: Found to be clean
X-Mailscanner-Spamcheck: SpamAssassin
X-Spam-Status: No, hits=-2 required=6 tests=SUBJ_HAS_Q_MARK,
    BALANCE_FOR_LONG,BALANCE_FOR_LONG,MAILTO_LINK

        The "SUBJ_HAS_Q_MARK" is bogus because it's triggering on the
modified {SPAM?} insertion in the subject (I think I'll change that just
to avoid that collision).

        So far, outside of that one anomoly (and it's the only message
I have seen with a negative hits) the spamassassin results from MailScanner
and the spamassassin results from procmail are in complete agreement.

> If you try out this fix, please tell me whether it works for you or not!

        So far, seems to be working with the one noted anomoly that I'm
going to investigate further.  Looks like, with this and the crashing
fix, you're two for two on the day.  :-)

> The fix for this will be included in release 3.02-1, which I intend putting
> together tomorrow if I get time.
> --
> Julian Field                Teaching Systems Manager
> jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
> Tel. 023 8059 2817          University of Southampton
>                             Southampton SO17 1BJ

        Mike
--
 Michael H. Warfield    |  (770) 985-6132   |  mhw at WittsEnd.com
  /\/\|=mhw=|\/\/       |  (678) 463-0932   |  http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!



More information about the MailScanner mailing list