Different score with SpamAssassin Alone

Sun Feb 8 01:51:00 GMT 2004

All of the .cf files are in /etc/mail/spamassassin, and reading
below note that :
RC_B_REGALIS is in the same .cf file as RC_SA_LIST and
RC_B_REGALIS hit with MS. The only difference is that
RC_B_REGALIS is not a negative score. Two rules same file, one is
ignored when MS runs and neither is ignored when spamassassin is
run alone, even with a command of
spamassassin -p /opt/MailScanner/etc/spam.assassin.prefs.conf
(which is redundant since SA will pick up the
/etc/mail/spamassasin/local.cf link to
/opt/MailScanner/etc/spam.assassin.prefs.conf)

Rick

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Stephen Swaney
> Sent: Saturday, February 07, 2004 7:49 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Different score with SpamAssassin Alone
>
>
> > -----Original Message-----
> > From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> > Behalf Of Rick Cooper
> > Sent: Saturday, February 07, 2004 7:31 PM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Different score with SpamAssassin Alone
> >
> > Hopefully someone will see/think something I have
> missed on this,
> > it's driving me up the wall..
> >
> > I have been getting a lot of mail from the new
> SpamAssassin list
> > dumped into my spam box even though I had the list
> whitelisted. I
> > then wrote a custom rule that would look at the Return-path
> > header (since the from address could be some other
> address with a
> > cc to the list) and tested it with SA and all worked
> fine. But
> > when it runs through MailScanner (and I restarted MS several
> > times) it misses every single time. Below is a sample header
> > section of the last message that got tagged spam.
> Rules that are
> > in the same .cf file as the rule in question will
> have hits but
> > the RC_SA_LIST has not hit once, spam or ham. And
> every time I
> > run it on the same message in the SpamBox it gets
> dumped into (by
> > MailScanner delete forward  spam) it will hit the RC_SA_LIST
> > rule. (MailScanner Version 4.23-7 SA Version 2.63)
> >
>
> Where are you placing your rules? On a typical Linux
> system, by default,
> SpamAssassin and MailScanner (configurable in the
> latest release) look for
> flies that end in ".cf" in /etc/mail/spamassassin
>
> You could also append the rules to
> /etc/MailScanner/spam.assassin.prefs.conf.
>
> Steve
>
> Stephen Swaney
> President
> Fortress Systems Ltd.
> Steve.Swaney at FSL.com
>
> > Message header:
> >
> > Return-path:
> >
> <spamassassin-users-return-012-MyUname=MyDomain.com at inc
> ubator.apa
> > che.org>
> > Envelope-to: SpamMailBox at MyDomain.com
> > Delivery-date: Sat, 07 Feb 2004 16:44:24 -0500
> > Received: from daedalus.apache.org ([208.185.179.12]
> > helo=mail.apache.org)
> >         by Mail.MyDomain.com with smtp (Exim 4.22)
> >         id 1ApaFQ-0003Vn-MY
> >         for MyUname at MyDomain.com; Sat, 07 Feb 2004
> 16:44:20 -0500
> > Received: (qmail 68038 invoked by uid 500); 7 Feb 2004
> > 21:44:06 -0000
> > Mailing-List: contact
> > spamassassin-users-help at incubator.apache.org; run by ezmlm
> > Precedence: bulk
> > list-help:
> <mailto:spamassassin-users-help at incubator.apache.org>
> > list-unsubscribe:
> > <mailto:spamassassin-users-unsubscribe at incubator.apache.org>
> > list-post: <mailto:spamassassin-users at incubator.apache.org>
> > List-Id: "SpamAssassin Users" <users at spamassassin.apache.org>
> >
> > Rule:
> >
> > header RC_SA_LIST Return-path =~
> >
> /spamassassin-users-return-[0-9]{2,4}-MyUname=MyDomain\
> .com\@incu
> > bator\.apache\.org/i
> >
> > Original Score from MailScanner (right out of the header)
> >
> > X-XXXXX-MailScanner-SpamCheck: spam, SpamAssassin
> (score=7.759,
> > required 5,
> >         AWL -5.91, CLICK_BELOW 0.00,
> FROM_HAS_MIXED_NUMS 0.30,
> >         FVGT_TRIPWIRE_FC 0.08, FVGT_TRIPWIRE_LQ 0.08,
> > FVGT_TRIPWIRE_LW 0.08,
> >         FVGT_TRIPWIRE_QC 0.08, FVGT_TRIPWIRE_WC 0.08,
> > FVGT_m_MULTI_ODD2 1.10,
> >         FVGT_m_MULTI_ODD3 1.10, FVGT_m_MULTI_ODD4 1.10,
> >         FVGT_m_MULTI_ODD5 1.10, HTML_40_50 0.47,
> > HTML_LINK_CLICK_HERE 0.10,
> >         HTML_MESSAGE 0.00, OACYS_m_MULTI_CONS4 3.00,
> RC_B_REGALIS
> > 4.50,
> >         b_OBFU_QnoU 0.50)
> > X-DFW-MailScanner-SpamScore: sssssss
> >
> > Note that RC_B_REGALIS is in the same .cf file as RC_SA_LIST
> >         ,
> >
> > Score running spamassassin directly:
> > (with the -p option or not, I have local.cf linked to
> > etc/spam.assassin.prefs.conf)
> >
> >
> > X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
> >         MyDomain.com
> > X-Spam-Level:
> > X-Spam-Status: No, hits=-106.3 required=5.0
> tests=CLICK_BELOW,
> >
> FROM_HAS_MIXED_NUMS,FVGT_TRIPWIRE_FC,FVGT_TRIPWIRE_LQ,
> >
> >
> FVGT_TRIPWIRE_LW,FVGT_TRIPWIRE_QC,FVGT_TRIPWIRE_WC,FVGT
> _m_MULTI_O
> > DD2,
> >
> >
> FVGT_m_MULTI_ODD3,FVGT_m_MULTI_ODD4,FVGT_m_MULTI_ODD5,H
> TML_40_50,
> >
> >
> HTML_LINK_CLICK_HERE,HTML_MESSAGE,OACYS_m_MULTI_CONS4,R
> C_B_REGALI
> > S,
> >         RC_SA_LIST,USER_IN_WHITELIST,b_OBFU_QnoU autolearn=no
> > version=2.63
> >         ^^^^^^^^^  ^^^^^^^^^^^^^^^^^
> >  So when SA is called directly it hists the whitelist and the
> > custome RC_SA_LIST rule, but both are missed when
> MailScanner is
> > front-ending SA. I have not updated MailScanner as I
> don't want
> > to have to repatch Exim.pm, or reapply the custom
> logging code to
> > log the "To:" address(s), and truncate the SA return to 800
> > chars,  as I have not created a patch for that as of yet.
> >
> > Any one have an idea?
> >
> > Thanks
> >
> >
> >  Rick Cooper
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean.
> >
> > Fortress Systems Ltd.
> > www.fsl.com
> >
>
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
>