Spamassissin compleatly ballsed - what to do?

[Matt Kettler]

At 12:53 PM 11/9/2004, Colin Alston wrote:
>My spamassissin is compleatly stuffed.
>
>I dont really know when or how it happend, possibly someone did a
>package upgrade without informing me - these things happens.
>
>Now however I get some very strange behaviour in Mailscanner.
>
>Either this
>
>X-Slipgate-MailScanner: Found to be clean
>X-Slipgate-MailScanner-SpamCheck: spam, SpamAssassin (score=9.881,
>
>Why on earth is it marked "Found to be clean" with a SA score that is way
>over the mark limit?


because "Found to be clean" only means it has passed your virus tests, and
has nothing to do with the SpamAssassin.

Did you ever have all your spam declared as something other than "Found to
be clean"?

I've never seen MailScanner do that unless the message was infected AND
detected as spam.

>My High Scoring spam is set to 10.0 and Spam is set to 5.0, this should be
>marked as spam surely?

Yes, it should, and it is marked as spam.

"Found to be clean" has nothing to do with this. What's the nature of your
real problem?

The marking for spam is  "X-Slipgate-MailScanner-SpamCheck: spam," and any
subject tags you have. X-Slipgate-MailScanner: is not a spam indicating header.

>Or in the worst case I get this.
>
>X-Slipgate-MailScanner: Found to be clean
>X-Slipgate-MailScanner-SpamCheck: not spam, SpamAssassin (timed out)
>
>This system used to work great and I loved it till a few weeks ago! No
>config changes have been made to MailScanner, what could be causing this?

Timeouts are probably due to bayes automatic expiry.

  Check the archives for my posts on this, you'll want to set
"bayes_auto_expire 0" in your /etc/mail/spamassassin/local.cf and tell
MailScanner.conf to "Rebuild Bayes Every=86400". You might also want a
daily cron to run sa-learn --sync (SA 3.x) or sa-learn --force-expire (SA
2.x) as a safety net for expiry to run.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).