I don't fully understand how to change the way MailScanner handles spam. How can I change MailSc

David Curtis DCurtis at SBSCHOOLS.NET
Tue Feb 8 16:35:02 GMT 2005 

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Here is what I found in the log. Again I don't see MailScanner doing a spamassassin check on this message.
Feb  7 17:34:20 spamfilter postfix/smtpd[32477]: connect from alias-2.c10-ave-mta3.cnet.com[206.16.1.191]
Feb  7 17:34:20 spamfilter postfix/smtpd[32477]: 5538716F5CD: client=alias-2.c10-ave-mta3.cnet.com[206.16.1.191]
Feb  7 17:34:21 spamfilter postfix/cleanup[32039]: 5538716F5CD: hold: header Received: from alias-2.c10-ave-mta3.cnet.com (alias-2.
Feb  7 17:34:21 spamfilter postfix/cleanup[32039]: 5538716F5CD: message-id=<13092019.1107815659270.JavaMail.accucast at 206.16.1.189> 
Feb  7 17:34:22 spamfilter MailScanner[28181]: New Batch: Scanning 1 messages, 5541 bytes 
Feb  7 17:34:22 spamfilter MailScanner[28181]: MCP Checks: Starting 
Feb  7 17:34:22 spamfilter MailScanner[28181]: MCP Checks completed at 5541 bytes per second
Feb  7 17:34:22 spamfilter MailScanner[28181]: Spam Checks: Starting 
Feb  7 17:34:26 spamfilter postfix/smtpd[32477]: disconnect from alias-2.c10-ave-mta3.cnet.com[206.16.1.191]
Feb  7 17:34:40 spamfilter MailScanner[28181]: Message 5538716F5CD.EF267 from 206.16.1.191 (cnet_networks_#3.140018.34363630353131.
Feb  7 17:34:40 spamfilter MailScanner[28181]: Spam Checks: Found 1 spam messages 
Feb  7 17:34:40 spamfilter MailScanner[28181]: Spam Actions: message 5538716F5CD.EF267 actions are forward,spam at test.com 
Feb  7 17:34:40 spamfilter MailScanner[28181]: Spam Checks completed at 307 bytes per second 
Feb  7 17:34:41 spamfilter MailScanner[28181]: Virus and Content Scanning: Starting 
Feb  7 17:34:42 spamfilter MailScanner[28181]: Filename Checks: Allowing 5538716F5CD.EF267 msg-28181-86.txt
Feb  7 17:34:42 spamfilter MailScanner[28181]: Virus Scanning completed at 2770 bytes per second 
Feb  7 17:34:42 spamfilter MailScanner[28181]: Requeue: 5538716F5CD.EF267 to F2CDC16F6B8 
Feb  7 17:34:42 spamfilter postfix/nqmgr[28160]: F2CDC16F6B8: from=<cnet_networks_#3.140018.34363630353131.b at newsletters.online.com 
Feb  7 17:34:42 spamfilter MailScanner[28181]: Uninfected: Delivered 1 messages 
Feb  7 17:34:42 spamfilter MailScanner[28181]: Virus Processing completed at 5541 bytes per second
Feb  7 17:34:42 spamfilter MailScanner[28181]: Disinfection completed at 5541 bytes per second    
Feb  7 17:34:42 spamfilter MailScanner[28181]: Batch completed at 277 bytes per second (5541 / 20)
Feb  7 17:34:42 spamfilter postfix/smtp[32572]: F2CDC16F6B8: to=<spam at test.com>, orig_to=<unknown>, relay=

>>> Denis.Beauchemin at USHERBROOKE.CA 2/8/2005 11:27:44 AM >>>
David Curtis wrote:

>It is being quarantined. This is the whole header from the e-mail. There are no spamassassin scores in it. It looks like MailScanner tags it as spam and does not even rely on spamassassin. 
>  
>
David,

What's in your maillog for this email?  The key lies probably there...

Denis

>  
>
>>>>Denis.Beauchemin at USHERBROOKE.CA 2/8/2005 11:08:15 AM >>>
>>>>        
>>>>
>David Curtis wrote:
>
>  
>
>>I don't fully understand how to change the way MailScanner handles spam.
>>How can I change MailScanner to not filter mail like the scoring it uses
>>for Spamassassin? Below is an example of a header from a newsletter that
>>is being filtered out but not because of Spamassassin scoring. I could
>>always add a whitelist entry but I would rather figure out how to change
>>this.
>>
>>Thanks.
>>
>>
>>Subject: [SPAM] - {Spam as detected by MailScanner} Invitation to
>>Esther Dyson's PC Forum, March 20 to 22: Hello (new) World - Found
>>word(s) to be removed register today in the HTML body
>>MIME-Version: 1.0
>>Content-Type: text/html;
>>       charset="ISO-8859-1"
>>Content-Transfer-Encoding: 7bit
>>X-Mailer-Version: 3.5.5 build 727
>>X-Mailer: Accucast
>>X-Accutrak:
>>CNET_Networks_#3.139973.3432373335333234 at newsletters.online.com 
>>X-MailScanner-From:
>>cnet_networks_#3.139973.3432373335333234.b at newsletters.online.com 
>>Return-Path:
>><cnet_networks_#3.139973.3432373335333234.b at newsletters.online.com>
>>X-OriginalArrivalTime: 07 Feb 2005 16:52:12.0103 (UTC)
>>FILETIME=[5E92BD70:01C50D35]
>>
>> 
>>
>>    
>>
>
>David,
>
>What do you mean by "filtered out"?  Do you mean it was quarantined or 
>deleted?  What is in your maillog?
>
>What are your values for:
>Spam Actions =
>High Scoring Spam Actions =
>Non Spam Actions =
>
>How about adding some verbosity to your MS setup?
>Detailed Spam Report = yes
>Include Scores In SpamAssassin Report = yes
>Always Include SpamAssassin Report = yes
>Log Spam = yes
>Log Non Spam = yes  (beware it can produce a lot a output)
>
>Denis
>
>  
>


-- 
   _
  °v°   Denis Beauchemin, analyste
/(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!








This email may contain information protected under the Family
Educational Rights and Privacy Act (FERPA) or the Health Insurance
Portability and Accountability Act (HIPAA).  If this email contains
confidential and/or privileged health or student information and you
are not entitled to access such information under FERPA or HIPAA,
federal regulations require that you destroy this email without
reviewing it and you may not forward it to anyone.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

More information about the MailScanner mailing list