MCP logging action question

[Quentin Campbell]

Am using MCP facility for first time to deal with "German" spam from
Sober.Q worm. 

In MailScanner.conf have:

MCP Checks = yes

# Do the spam checks first, or the MCP checks first?
# This cannot be the filename of a ruleset, only a fixed value.
First Check = mcp

# The rest of these options are clones of the equivalent spam options
MCP Required SpamAssassin Score = 1
MCP High SpamAssassin Score = 10
MCP Error Score = 1

MCP Header = X-%org-name%-MailScanner-MCPCheck:
Non MCP Actions = deliver
MCP Actions = deliver
High Scoring MCP Actions = delete
Bounce MCP As Attachment = no

MCP Modify Subject = yes
MCP Subject Text = {MCP?}
High Scoring MCP Modify Subject = yes
High Scoring MCP Subject Text = {MCP?!}

Is Definitely MCP = no
Is Definitely Not MCP = no
Definite MCP Is High Scoring = no
Always Include MCP Report = yes
Detailed MCP Report = yes
Include Scores In MCP Report = yes
Log MCP = yes

I am seeing as expected in the logs:

May 18 10:43:24 cheviot8 MailScanner[1518]: Message j4I9gwgT004139 from
128.240.233.53 (xxx at hotmail.com) to maildb.ncl.ac.uk is MCP, MCP-Checker
(score=10, required 1, PROLO_GMCP24 10.00)

BUT I am not seeing in the logs the expected

...MCP Actions: message j4I9gwgT004139 actions are delete

although the message does not appear to be delivered according to the
logs. 

I am running MS 4.41.3-1. 

NOTE: I am doing the Sober.Q filtering with MCP rather than normal spam
filtering because we whitelist from spam tagging some domains from which
the Sober.Q messages apparently originate.

 

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!