your mail

[Kris Zabriskie]

Mike,
Once I turned on the logging, I found out that I was VERY mistaken.
SpamAssassin is taking a lot of spam out of circulation, which is great!
Thanks for your help!


----- Original Message -----
From: "mikea" <mikea at MIKEA.ATH.CX>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Tuesday, May 27, 2003 5:26 PM
Subject: Re: your mail


> On Tue, May 27, 2003 at 05:10:28PM -0400, Kris Zabriskie wrote:
> > Is there an easy way to determine how much spam SpamAssasin is
filtering?  I
> > am running MS and SA, but I think MS is the only thing catching spam/
>
> You should be seeing things like this in your mail log
> (var/log/maillog, most likely, if you're running sendmail)
> when SpamAssassin runs:
>
> : May 27 16:16:51 isdmonitor MailScanner[25847]: New Batch: Scanning 1
> :       messages, 9692 bytes
> : May 27 16:16:51 isdmonitor MailScanner[25847]: Spam Checks: Starting
> : May 27 16:16:57 isdmonitor MailScanner[25847]: Virus and Content
> :       Scanning: Starting
> : May 27 16:16:57 isdmonitor sendmail[27645]: h4RLGuZZ027645:
> :       from=<new-offers-cijj at sky389.com>, size=2066, class=0, nrcpts=1,
> :       msgid=<1054088385.3119 at 64.119.218.140.nnt6us.com>, proto=ESMTP,
> :       daemon=MTA, relay=odot.okladot.state.ok.us [192.149.244.18]
> : May 27 16:16:57 isdmonitor sendmail[27645]: h4RLGuZZ027645:
> :       to=<dbrown at fd9ns01.okladot.state.ok.us>, delay=00:00:00,
mailer=relay,
> :       pri=30600, stat=queued
> : May 27 16:17:00 isdmonitor MailScanner[25847]: Message
> :       h4RLGuZZ027645 from 192.149.244.18 (new-offers-cijj at sky389.com)
> :       to fd9ns01.okladot.state.ok.us is spam, SpamAssassin (score=13.2,
> :       required 5, BAYES_80, CLICK_BELOW, DATE_IN_FUTURE_06_12,
> :       EXCUSE_1, EXCUSE_19, EXCUSE_3, FORGED_MUA_OUTLOOK, HTML_70_80,
> :       HTML_IMAGE_ONLY_04, HTML_LINK_CLICK_HERE, HTML_WEB_BUGS,
> :       MIME_HEADER_CTYPE_ONLY, MIME_HTML_ONLY, NORMAL_HTTP_TO_IP, OFFER,
> :       OFFERS_ETC, RECEIVE_OFFER)
> : May 27 16:17:00 isdmonitor MailScanner[25847]: Spam Checks: Found 1
> :       spam messages
> : May 27 16:17:00 isdmonitor MailScanner[25847]:
> :       Spam Actions: message h4RLGuZZ027645 actions are
> :       forward,mike.andrews/odot at isdmonitor.okladot.state.ok.us
>
> At the least, you should see the "Virus and Content Scanning:
> Starting" line to indicate that SA is really being called.
>
> If you're not seeing those, then either you're not seeing anything
> that SpamAssassin thinks is spam -- and you're incredibly lucky,
> _OR_ SpamAssassin isn't being started.
>
> --
> Mike Andrews
> mikea at mikea.ath.cx
> Tired old sysadmin since 1964
>