SA ignoring a ruleset?

[Daniel Maher]

Hello all,

 

I have three incoming mail servers, each identical hardware and software configurations, running MailScanner 4.51.6 and SpamAssassin 3.1.1.  There is a custom ruleset, "99_petrosun.cf", located in /etc/mail/spamassassin/ on all three servers.  The ruleset is very simple, and is designed to identify a specific type of spam that we've been getting tonnes of lately.

 

Unfortunately, one of my three servers appears to be ignoring it.  I'm really not sure why.  Two of my servers produce logs such as this:

 

Jul 31 10:26:53 elmer MailScanner[6645]: Message 41DA34BB78.01E46 from 65.54.246.204 (ubitest2006 at hotmail.com) to ubisoft.com is spam, SpamAssassin (score=34.986, required 6, autolearn=disabled, MSGID_FROM_MTA_HEADER 0.00, PETROSUN01 10.00, PETROSUN02 10.00, PETROSUN03 10.00, SARE_FWDLOOK 1.67, SARE_MLB_Stock1 1.66, SARE_MLB_Stock6 1.66)

 

The server that isn't identifying properly produces this:

 

Jul 31 10:32:07 marvin MailScanner[14159]: Message BB3334BB48.736B5 from 65.54.246.105 (ubitest2006 at hotmail.com) to ubisoft.com is not spam, SpamAssassin (score=4.986, required 6, MSGID_FROM_MTA_HEADER 0.00, SARE_FWDLOOK 1.67, SARE_MLB_Stock1 1.66, SARE_MLB_Stock6 1.66)

 

Now, clearly, rules form /etc/mail/spamassassin/*.cf are being read, since the SARE rulesets are triggering on both - only the one custom rule appears to be ignored.  Oddly, running a lint check shows no problems; quite the opposite, in fact, as the file is read, and no errors are produced:

 

[14995] dbg: config: read file /etc/mail/spamassassin/99_petrosun.cf

 

The file itself, as well as the permissions and ownership are the same on all three servers. I've tried issuing both "MailScanner reload" and "MailScanner restart" to no avail.  Any ideas as to what's going on here are welcome.

 

Thanks!

 

 

--

  _
 °v°  Daniel Maher
/(_)\ Administrateur Système Unix

 ^ ^  Unix System Administrator

 

Sentio aliquos togatos contra me conspirare.

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20060731/4150a9d1/attachment.html