Mailscanner not catching SPAM but manual run via SA catches it

[René Berber]

Dan Carl wrote:
[snip]
> I've been analyzing messages all morning.
> It seems that spamassassin runs through all of the rules all the time but
> mailscanner rules erratically.(example below)
> 
> FROM SPAMASSASSIN
> Content analysis details:   (13.8 points, 5.0 required)
...
>  3.0 BAYES_95               BODY: Bayesian spam probability is 95 to 99%
>                             [score: 0.9598]
>  2.0 RCVD_IN_SORBS_DUL      RBL: SORBS: sent directly from dynamic IP
> address
...
> FROM MAILSCANNER
> X-Bluestar-MScan-SpamCheck: not spam, SpamAssassin (not cached, score=5.844,
>  required 6, RCVD_IN_NJABL_DUL 1.95, RCVD_IN_XBL 3.90,
>  UNPARSEABLE_RELAY 0.00)
> 
> This is the exact same message.
> Why didn't Mailscanner use Bayes, SORBS or SPAMCOP?

That's a tough one... timeouts perhaps?

Slow DNS response would explain an occasional RBL test timeout, but Bayes will
only timeout if the computer has a high load.  Anyway, it's only a theory, I
haven't seen this problem before.

> It's not like there not working here's proof of one caught a few minutes
> ago.
> spamcop is not here but bayes and sorbs are.
> 
> X-Bluestar-MScan-SpamCheck: spam, SpamAssassin (not cached, score=9.284,
>  required 6, BAYES_60 1.00, DCC_CHECK 2.17, DIGEST_MULTIPLE 0.77,
>  MSGID_FROM_MTA_ID 1.39, RAZOR2_CF_RANGE_51_100 0.50,
>  RAZOR2_CF_RANGE_E4_51_100 1.50, RAZOR2_CHECK 0.50,
>  RCVD_IN_SORBS_WEB 1.46)

Perhaps a real expert could show us how to debug this.  From the SA.pm code I
see there is a debug setting, but I don't know how to turn it on; it may be
enough to see the parameters to SA (SA.pm uses fork-and-run).
-- 
René Berber