Mailscanner not catching SPAM but manual run via SA catches it

[Dan Carl]

----- Original Message ----- 
From: "René Berber" <r.berber at computer.org>
To: <mailscanner at lists.mailscanner.info>
Sent: Monday, November 13, 2006 2:46 PM
Subject: Re: Mailscanner not catching SPAM but manual run via SA catches it


>
> > If it is, why when I manually run spam that doesn't get marked through
> > spamassassin I get an output like this?
> >
> > Content analysis details:   (9.0 points, 5.0 required)
> >
> >  pts rule name              description
>
> ---- ---------------------- ----------------------------------------------
--
> > --
> >  0.1 FORGED_RCVD_HELO       Received: contains a forged HELO
> >  1.0 BAYES_60               BODY: Bayesian spam probability is 60 to 80%
> >                             [score: 0.7092]
> >  2.0 RCVD_IN_SORBS_DUL      RBL: SORBS: sent directly from dynamic IP
> > address
> >                             [151.41.202.96 listed in dnsbl.sorbs.net]
> >  3.9 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
> >                             [151.41.202.96 listed in
sbl-xbl.spamhaus.org]
> >  1.9 RCVD_IN_NJABL_DUL      RBL: NJABL: dialup sender did non-local SMTP
> >                             [151.41.202.96 listed in combined.njabl.org]
>
> 7.9 / 9.0 is from RBLs, perhaps you have configured MS to use its own RBL
checks
> (or none at all) and they are different from what SA uses by default.
That
I have no RBL listed in my MS conf. because I thought if it was set to use
SA
it would use SA's RBL.

> would mean that you didn't configure SA as recommended (link MS's
> etc/spam.assassin.prefs.conf to /etc/mail/spamassassin/mailscanner.cf or
to
> local.cf, so they use the same configuration).
Have the link set.
/etc/mail/spamassassin/mailscanner.cf ->
/etc/MailScanner/spam.assassin.prefs.conf

> > The header shows:
> > X-Bluestar-SpamScore: sssss
> > X-Spam-Status: No
> [snip]
>
> About 5 (for the same message?),
YES
> this could also be caused by AWL.  If you are
> running SA as a different user, this happens all the time, I prefer to run
I have spamassassin and mailscanner running as the same user.

> `spamassassin -x ...` to avoid this (but not cache hits or image hits,
which are
> more difficult to avoid) and erase the email address from the whitelist
(i.e.
> `spamassassin --remove-addr-from-whitelist=...`)
> You need to analyze just one message in detail, what scores differ, what
rules
> match or don't match.  Then look at what is causing the differences.
OK I know how run a test email through SA:
spamassassin -tx < test.eml
How do I do it with Mailscanner?
> -- 
> René Berber
>
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!