SA ignoring a ruleset?

[Scott Silva]

Daniel Maher spake the following on 7/31/2006 7:59 AM:
> Hello all,
> 
>  
> 
> I have three incoming mail servers, each identical hardware and software
> configurations, running MailScanner 4.51.6 and SpamAssassin 3.1.1. 
> There is a custom ruleset, “99_petrosun.cf”, located in
> /etc/mail/spamassassin/ on all three servers.  The ruleset is very
> simple, and is designed to identify a specific type of spam that we’ve
> been getting tonnes of lately.
> 
>  
> 
> Unfortunately, /one/ of my three servers appears to be ignoring it.  I’m
> really not sure why.  Two of my servers produce logs such as this:
> 
>  
> 
> Jul 31 10:26:53 elmer MailScanner[6645]: Message 41DA34BB78.01E46 from
> 65.54.246.204 (ubitest2006 at hotmail.com) to ubisoft.com is spam,
> SpamAssassin (score=34.986, required 6, autolearn=disabled,
> MSGID_FROM_MTA_HEADER 0.00, PETROSUN01 10.00, PETROSUN02 10.00,
> PETROSUN03 10.00, SARE_FWDLOOK 1.67, SARE_MLB_Stock1 1.66,
> SARE_MLB_Stock6 1.66)
> 
>  
> 
> The server that isn’t identifying properly produces this:
> 
>  
> 
> Jul 31 10:32:07 marvin MailScanner[14159]: Message BB3334BB48.736B5 from
> 65.54.246.105 (ubitest2006 at hotmail.com) to ubisoft.com is not spam,
> SpamAssassin (score=4.986, required 6, MSGID_FROM_MTA_HEADER 0.00,
> SARE_FWDLOOK 1.67, SARE_MLB_Stock1 1.66, SARE_MLB_Stock6 1.66)
> 
>  
> 
> Now, clearly, rules form /etc/mail/spamassassin/*.cf are being read,
> since the SARE rulesets are triggering on both – only the one custom
> rule appears to be ignored.  Oddly, running a lint check shows no
> problems; quite the opposite, in fact, as the file is read, and no
> errors are produced:
> 
>  
> 
> [14995] dbg: config: read file /etc/mail/spamassassin/99_petrosun.cf
> 
>  
> 
> The file itself, as well as the permissions and ownership are the same
> on all three servers. I’ve tried issuing both “MailScanner reload” and
> “MailScanner restart” to no avail.  Any ideas as to what’s going on here
> are welcome.
Have you tried re-copying the rule? Maybe it is corrupted in some way.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!