Where did my spam go...

[Julian Field]

At 22:09 28/10/2002, you wrote:
>Not that I mind too much but my spam is disappearing.  I'm using
>MailScanner 4.03-1 right now but have noticed this for a while now.  I'm
>also using SpamAssassin.
>
>If I have "Spam Actions" set to deliver, I get the mail marked properly
>as spam.  If I set the action to striphtml I never receive the mail.
>
>Required SpamAssassin Score = 5
>High SpamAssassin Score = 20
>Spam Actions = striphtml
>High Scoring Spam Actions = store

"striphtml" doesn't automatically imply "deliver" (as you might want to
just forward it elsewhere, for example). Does it work if you set
         Spam Actions = striphtml deliver
?


>Here is an example from my logs.  This spam scored 6.4 and was not
>delivered anywhere and is not in
>/var/spool/MailScanner/quarantine/DATE/spam.  I see no other reference
>to the sendmail ID anywhere else in my logs.
>
>-------------start of log---------------------------
>Oct 27 06:57:54 bongo sendmail[6057]: g9RCvNAH006057:
>from=<wommaster123 at mandic.com.br>, size=1928, class=0, nrcpts=1,
>msgid=<200210271257.g9RCvNAH006057 at bongo.MYDOMAIN.com>, proto=SMTP,
>daemon=MTA, relay=host-202.153.250.196-personal-broadband.mweb.net.id
>[202.153.250.196] (may be forged)
>Oct 27 06:57:55 bongo MailScanner[1884]: New Batch: Scanning 1 messages,
>2581 bytes
>Oct 27 06:57:55 bongo MailScanner[1884]: Spam Checks: Starting
>Oct 27 06:57:56 bongo MailScanner[1884]: RBL checks: g9RCvNAH006057
>found in Infinite-Monkeys
>Oct 27 06:57:57 bongo MailScanner[1884]: Message g9RCvNAH006057 from
>202.153.250.196 (mandic.com.br)  is spam according to Infinite-Monkeys,
>SpamAssassin (score=6.4, required 5, CTYPE_JUST_HTML, FROM_ENDS_IN_NUMS,
>HTML_50_70, HTML_FONT_FACE_ODD, HTML_WITH_BGCOLOR, LINES_OF_YELLING,
>MAILTO_LINK, MAY_BE_FORGED, MSG_ID_ADDED_BY_MTA_2, SPAM_PHRASE_05_08,
>TO_MALFORMED, TRACKER_ID, USER_AGENT_OE)
>Oct 27 06:57:58 bongo MailScanner[1884]: Spam Checks: Found 1 spam
>messages
>Oct 27 06:58:00 bongo MailScanner[1884]: Spam Actions: message
>g9RCvNAH006057 actions are striphtml
>-------------end of log---------------------------
>
>Anybody have ideas where to look?
>
>Joel

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ