Mail Scanner and Spam Assassin report generation

[Gib Gilbertson Jr.]

  At 12:52 PM 3/26/2004 -0600, you wrote:
>Thanks for the suggestion.  I don't know if I can risk making that large
>of a change on this box though.  It processes around 110,000 messages a
>day currently and they would kill me if there was any issues where it
>effected their current mail flow reliability.  And mixing up mail
>processing to achive that at the moment wories me.
>
>All I need to do is pass the report argument that Spam Assassin gives when
>it runs into the forwarded message.
>
>Another reason ws need the failure report in the body of the message is
>because outlook here does NOT forward message headers when you forward the
>message.  So if a users gets a message that failed the Spam Assassin
>rules, they can't forward the message to a help desk.  Since all the
>usefull headers are gone then.

----
I tend to agree it would be nice to have the option to put the spam
assassin report in the body of the message. I have lots of accounts using
Outlook or Outlook Express and explaining how to get the headers for a
message can be a real pain with some of them. For analytical purposes it
would be nice to have the report in the body of the message, or added to
the subject line of any mail that is tagged as spam?

gib
----



>On Fri, 26 Mar 2004, John Rudd wrote:
>
> > You could always run SA independently of MS.  I do that at home.  MS
> > does my virus scanning, filename checking, dangerous content checking,
> > etc.  Then procmail does my SA work.
> >
> > You could even do both, I think (SA via MS, SA via procmail).  That way
> > you could just turn off the procmail side once you're done with your
> > temporary situation.
> >
> > On Mar 26, 2004, at 9:21 AM, brichter wrote:
> >
> > > Darn, so I loose that functionality of Spam Assassin by using Mail
> > > Scanner?
> > >
> > > I understand the point of adding the details to the headers, it makes
> > > it
> > > easier when implementing for us since the reason it failed is in plain
> > > text in the message that failed. When end users call our help desk,
> > > they
> > > don't have to understand what a message header is, or the person on the
> > > other end does not need to guide them through anything to find out
> > > details..  It's only an issue for us now since we
> > > originally ONLY had Spam Assassin in place, and Spam Assassin on it's
> > > own
> > > passes that info in the BODY of the message which is configurable.
> > >
> > > Now we have Mail Scanner
> > > also. Is there a simple way I could patch Mail Scanner to take that, or
> > > is it not that simple of a thing?
> > >
> > > I only need it while I implement a scoring of 5.0 to see if we get any
> > > false positives.  When we finish if 5.0 works we will go back to
> > > deleting
> > > automatically anything that meets the minimum spam score.
> > >
> > > I understand it's redundant, but to properly interface with Spam
> > > Assassin,
> > > shouldnt you at least have the option to pass all possible Spam
> > > Assassin
> > > details through?
> > >
> > > Thanks
> > >
> > >
> > > On Fri, 26 Mar 2004, Julian Field wrote:
> > >
> > >> All the SpamAssassin output that is added to the message by
> > >> MailScanner is
> > >> added in the headers. It doesn't stomp over the message body adding
> > >> huge
> > >> reports that mean very little to most recipients, I didn't think it
> > >> was
> > >> worth it (and still don't :-)
> > >>
> > >> At 15:40 26/03/2004, you wrote:
> > >>> Mail Scanner version: mailscanner-4.25-14
> > >>> Spam Assassin version: 2.63
> > >>>
> > >>> Question,
> > >>>
> > >>> When we first setup Spam Assassin in our enviornment way back,
> > >>> before we
> > >>> automatically purged messages marked as spam, for the first couple of
> > >>> weeks we allowed the messages to be delivered and allowed SPAM
> > >>> Assassin to
> > >>> add it's text to the body of the orginal message indicating this
> > >>> could be
> > >>> Spam and if it was not to contact our help desk etc.. (To see if we
> > >>> had
> > >>> many false positives)  And at that time a score of 5.0 was too low.
> > >>> So we
> > >>> went with 7.0 which wound up working well.  And after we found Mail
> > >>> Scanner after that point we started deleting all SPAM with a 7.0 or
> > >>> more
> > >>> score.
> > >>>
> > >>> Now we are going to try lowering our score back down to 5.0 and
> > >>> figured we
> > >>> would DELETE automatically anything over 7.0 (treat that as HIGH
> > >>> scoring
> > >>> spam) and anything 5.0 - 6.99 would be normal spam and we could
> > >>> deliver it
> > >>> and have people let us know if we still get any false positives.  The
> > >>> problem is I cannot for the life of me get the additional Spam
> > >>> Assasin
> > >>> report appended to the original message after it's detected as Spam.
> > >>>
> > >>> If I run the Spam Assasin 2.63 exe in test mode against a test
> > >>> message it
> > >>> puts the report in.
> > >>>
> > >>> If I send a message through the server so Mail Scanner then
> > >>> processes it,
> > >>> it detects it as Spam properly, and modifies the subject line like I
> > >>> have
> > >>> defined in the Mail Scanner conf.
> > >>>
> > >>> But it does not add this in: (I have tried listing this in
> > >>> /etc/mail/spamassassin/local.cf and in the spam assassin prefs in
> > >>> Mailscanner without either working)
> > >>>
> > >>> clear_report_template
> > >>> report -------------------- Start SpamAssassin results
> > >>> ----------------------
> > >>> report This email facility identified this email as potential
> > >>> report spam or content objectionable.  Email of this type is detected
> > >>> report through a series of checks against the original message
> > >>> content.
> > >>> report The "rules" on which the Spam determination was made are
> > >>> included,
> > >>> report as well as the original message.
> > >>> report
> > >>> report If, in your opinion, this message is not Spam or content
> > >>> report objectionable, please forward the message to the help desk for
> > >>> report further evaluation.
> > >>> report
> > >>> report If for business reasons you need to receive messages that
> > >>> would be
> > >>> report considered Spam, Junk Mail, or contain offensive content,
> > >>> please
> > >>> report notify us and we will exempt you from ANY Spam/content
> > >>> report filtering.
> > >>> report
> > >>> report Content analysis details:   (_HITS_ hits, _REQD_ required)
> > >>> report _SUMMARY_
> > >>> report ------ End of SpamAssassin results, Original message follows
> > >>> --------
> > >>>
> > >>> This report IS appended to the test message if I pipe it through
> > >>> spamassassin with -t (it picks it up in /etc/mail/spamassin/local.cf
> > >>>
> > >>> Thanks for any tips on this.
> > >>
> > >> --
> > >> Julian Field
> > >> www.MailScanner.info
> > >> MailScanner thanks transtec Computers for their support
> > >>
> > >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> > >>
> >


      Gib Gilbertson Jr.
     Tierramiga Info Systems
      619-287-8647 Support
      http://www.tmisnet.com
      San Diego's "Friendly ISP"