strange: logwatch mail on mailserver is marked as spam

[Martin Hepworth]

Chris Green wrote:
> The SA score is high because it's tripping over on the RBL scores. This 
> means that the IP address from which the mail came from is blacklisted - 
> which is odd if it's from the same machine (it would normally appear to 
> come from 127.0.0.1). Check to see if your machine is listening on this 
> IP. Perhaps you have restricted incoming mail to use IP addresses other 
> than 127.0.0.1?
> 
> Another option would be to whitelist the sender, but that spoils the 
> troubleshooting fun really!
> 
> 
> Götz Reinicke wrote:
>>
>> Hi,
>>
>> I have no idea what's going wrong:
>>
>> I do get the logwatch report generated on my mailserver detected as 
>> spam by the mailservers mailscanner/SA installation :-)
>>
>> The server is RHEL 4 (2.6.9-kernel), MS 4.54.6, SA 3.1.3.
>>
>> The score for the report is e.g.
>>
>> spam,    SpamAssassin (nicht zwischen gespeichert, Wertung=17.019, 
>> benoetigt 3.6, ALL_TRUSTED -1.80, BAYES_00 -2.60, INFO_TLD 1.27, 
>> NO_REAL_NAME 0.96, URIBL_AB_SURBL 3.81, URIBL_JP_SURBL 4.09, 
>> URIBL_OB_SURBL 3.01, URIBL_SBL 1.64, URIBL_SC_SURBL 4.50,    
>> URIBL_WS_SURBL 2.14)
>>
>> Any ideas or what information may I provide?
>>
>> Thanks for any hint!!
> 
> 

The URIRBL scores here are looking at the message body, not the headers..

personally I remove all the emails 127.0.0.1 from any checks but 
anti-virus...

-- 
Martin Hepworth
Senior Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.	

**********************************************************************