Different score with SpamAssassin Alone

[Stephen Swaney]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> Behalf Of Rick Cooper
> Sent: Saturday, February 07, 2004 7:31 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Different score with SpamAssassin Alone
>
> Hopefully someone will see/think something I have missed on this,
> it's driving me up the wall..
>
> I have been getting a lot of mail from the new SpamAssassin list
> dumped into my spam box even though I had the list whitelisted. I
> then wrote a custom rule that would look at the Return-path
> header (since the from address could be some other address with a
> cc to the list) and tested it with SA and all worked fine. But
> when it runs through MailScanner (and I restarted MS several
> times) it misses every single time. Below is a sample header
> section of the last message that got tagged spam. Rules that are
> in the same .cf file as the rule in question will have hits but
> the RC_SA_LIST has not hit once, spam or ham. And every time I
> run it on the same message in the SpamBox it gets dumped into (by
> MailScanner delete forward  spam) it will hit the RC_SA_LIST
> rule. (MailScanner Version 4.23-7 SA Version 2.63)
>

Where are you placing your rules? On a typical Linux system, by default,
SpamAssassin and MailScanner (configurable in the latest release) look for
flies that end in ".cf" in /etc/mail/spamassassin

You could also append the rules to
/etc/MailScanner/spam.assassin.prefs.conf.

Steve

Stephen Swaney
President
Fortress Systems Ltd.
Steve.Swaney at FSL.com

> Message header:
>
> Return-path:
> <spamassassin-users-return-012-MyUname=MyDomain.com at incubator.apa
> che.org>
> Envelope-to: SpamMailBox at MyDomain.com
> Delivery-date: Sat, 07 Feb 2004 16:44:24 -0500
> Received: from daedalus.apache.org ([208.185.179.12]
> helo=mail.apache.org)
>         by Mail.MyDomain.com with smtp (Exim 4.22)
>         id 1ApaFQ-0003Vn-MY
>         for MyUname at MyDomain.com; Sat, 07 Feb 2004 16:44:20 -0500
> Received: (qmail 68038 invoked by uid 500); 7 Feb 2004
> 21:44:06 -0000
> Mailing-List: contact
> spamassassin-users-help at incubator.apache.org; run by ezmlm
> Precedence: bulk
> list-help: <mailto:spamassassin-users-help at incubator.apache.org>
> list-unsubscribe:
> <mailto:spamassassin-users-unsubscribe at incubator.apache.org>
> list-post: <mailto:spamassassin-users at incubator.apache.org>
> List-Id: "SpamAssassin Users" <users at spamassassin.apache.org>
>
> Rule:
>
> header RC_SA_LIST Return-path =~
> /spamassassin-users-return-[0-9]{2,4}-MyUname=MyDomain\.com\@incu
> bator\.apache\.org/i
>
> Original Score from MailScanner (right out of the header)
>
> X-XXXXX-MailScanner-SpamCheck: spam, SpamAssassin (score=7.759,
> required 5,
>         AWL -5.91, CLICK_BELOW 0.00, FROM_HAS_MIXED_NUMS 0.30,
>         FVGT_TRIPWIRE_FC 0.08, FVGT_TRIPWIRE_LQ 0.08,
> FVGT_TRIPWIRE_LW 0.08,
>         FVGT_TRIPWIRE_QC 0.08, FVGT_TRIPWIRE_WC 0.08,
> FVGT_m_MULTI_ODD2 1.10,
>         FVGT_m_MULTI_ODD3 1.10, FVGT_m_MULTI_ODD4 1.10,
>         FVGT_m_MULTI_ODD5 1.10, HTML_40_50 0.47,
> HTML_LINK_CLICK_HERE 0.10,
>         HTML_MESSAGE 0.00, OACYS_m_MULTI_CONS4 3.00, RC_B_REGALIS
> 4.50,
>         b_OBFU_QnoU 0.50)
> X-DFW-MailScanner-SpamScore: sssssss
>
> Note that RC_B_REGALIS is in the same .cf file as RC_SA_LIST
>         ,
>
> Score running spamassassin directly:
> (with the -p option or not, I have local.cf linked to
> etc/spam.assassin.prefs.conf)
>
>
> X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
>         MyDomain.com
> X-Spam-Level:
> X-Spam-Status: No, hits=-106.3 required=5.0 tests=CLICK_BELOW,
>         FROM_HAS_MIXED_NUMS,FVGT_TRIPWIRE_FC,FVGT_TRIPWIRE_LQ,
>
> FVGT_TRIPWIRE_LW,FVGT_TRIPWIRE_QC,FVGT_TRIPWIRE_WC,FVGT_m_MULTI_O
> DD2,
>
> FVGT_m_MULTI_ODD3,FVGT_m_MULTI_ODD4,FVGT_m_MULTI_ODD5,HTML_40_50,
>
> HTML_LINK_CLICK_HERE,HTML_MESSAGE,OACYS_m_MULTI_CONS4,RC_B_REGALI
> S,
>         RC_SA_LIST,USER_IN_WHITELIST,b_OBFU_QnoU autolearn=no
> version=2.63
>         ^^^^^^^^^  ^^^^^^^^^^^^^^^^^
>  So when SA is called directly it hists the whitelist and the
> custome RC_SA_LIST rule, but both are missed when MailScanner is
> front-ending SA. I have not updated MailScanner as I don't want
> to have to repatch Exim.pm, or reapply the custom logging code to
> log the "To:" address(s), and truncate the SA return to 800
> chars,  as I have not created a patch for that as of yet.
>
> Any one have an idea?
>
> Thanks
>
>
>  Rick Cooper
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com