Problem with Spamassassin v2.6.

[Plant, Dean]

Hi,

Currently using:

MailScanner 4.21-9
Redhat 8.0
Sendmail
Dcc
Razor
SpamAssassin

Problem:

Since upgrading to SpamAssassin v2.6 I have seen slight increase in the
amount of spam mail being missed. I have manually re-run a couple of
messages through spamassassin with debug on my main server and my backup
server (both running the same configuration) and found that they seem to be
giving quite different results from the bayesian detection.

2 samples of missed spam mail had the below results. The Main server also
has the message "X-Mail-Format-Warning: Bad RFC2822 header formatting in
ÃÃ^QÃ" at the start of the debug output, the backup server did not. Would it
be best for me to remove the bayesian database and start from scratch or is
there a better way to proceed.

Thanks

Dean Plant

Test Results.

Main server Mail1

Content analysis details:   (2.2 points, 5.0 required)

 pts rule name              description
---- ----------------------
--------------------------------------------------
 1.0 FROM_ENDS_IN_NUMS      From: ends in numbers
-4.9 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
                            [score: 0.0000]
 1.9 MIME_QP_DEFICIENT      RAW: Deficient quoted-printable encoding in body
 4.1 HEAD_ILLEGAL_CHARS     Header contains too many raw illegal characters
 0.1 CLICK_BELOW            Asks you to click below
 0.0 UPPERCASE_25_50        message body is 25-50% uppercase

Backup Server Mail1


Content analysis details:   (12.5 points, 5.0 required)

 pts rule name              description
---- ----------------------
--------------------------------------------------
 1.0 FROM_ENDS_IN_NUMS      From: ends in numbers
 5.4 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                            [score: 1.0000]
 1.9 MIME_QP_DEFICIENT      RAW: Deficient quoted-printable encoding in body
 4.1 HEAD_ILLEGAL_CHARS     Header contains too many raw illegal characters
 0.1 CLICK_BELOW            Asks you to click below
 0.0 UPPERCASE_25_50        message body is 25-50% uppercase

Main server Mail2


Content analysis details:   (1.5 points, 5.0 required)

 pts rule name              description
---- ----------------------
--------------------------------------------------
 0.2 NO_REAL_NAME           From: does not include a real name
 0.1 HTML_LINK_CLICK_HERE   BODY: HTML link text says "click here"
 0.2 HTML_TAG_BALANCE_A     BODY: HTML has excess "a" close tags
 0.1 HTML_MESSAGE           BODY: HTML included in message
-4.9 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
                            [score: 0.0000]
 1.6 LINK_TO_NO_SCHEME      BODY: Contains link without http:// prefix
 4.1 HEAD_ILLEGAL_CHARS     Header contains too many raw illegal characters
 0.1 CLICK_BELOW            Asks you to click below


Backup server Mail2

Content analysis details:   (11.8 points, 5.0 required)

 pts rule name              description
---- ----------------------
--------------------------------------------------
 0.2 NO_REAL_NAME           From: does not include a real name
 0.1 HTML_LINK_CLICK_HERE   BODY: HTML link text says "click here"
 0.2 HTML_TAG_BALANCE_A     BODY: HTML has excess "a" close tags
 0.1 HTML_MESSAGE           BODY: HTML included in message
 5.4 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                            [score: 1.0000]
 1.6 LINK_TO_NO_SCHEME      BODY: Contains link without http:// prefix
 4.1 HEAD_ILLEGAL_CHARS     Header contains too many raw illegal characters
 0.1 CLICK_BELOW            Asks you to click below



--
Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury, Bracknell,
Berkshire. RG12 8FZ

The information contained in this e-mail and any attachments is confidential to
Roke Manor Research Ltd and must not be passed to any third party without
permission. This communication is for information only and shall not create or
change any contractual relationship.