Mailscanner not catching SPAM but manual run via SA catches it

[Glenn Steen]

On 14/11/06, Dan Carl <danc at bluestarshows.com> wrote:
>  [snip]
> >
> > That's an option on MS, look for "Always Include SpamAssassin Report".
> >
> Thanks, missed it in the conf.
> Now I can do some testing
>  [snip]
>
> I've been analyzing messages all morning.
> It seems that spamassassin runs through all of the rules all the time but
> mailscanner rules erratically.(example below)
>
> FROM SPAMASSASSIN
> Content analysis details:   (13.8 points, 5.0 required)
>
>  pts rule name              description
> ---- ---------------------- ------------------------------------------------
> --
>  1.4 SPF_SOFTFAIL           SPF: sender does not match SPF record (softfail)
> [SPF failed: Please see
> http://www.openspf.org/why.html?sender=sondraiszmcgrathly%40charter.net&ip=85.69.182.160&receiver=mail.bluestarshows.com]
>  0.0 UNPARSEABLE_RELAY      Informational: message has unparseable relay
> lines
>  3.0 BAYES_95               BODY: Bayesian spam probability is 95 to 99%
>                             [score: 0.9598]
>  2.0 RCVD_IN_SORBS_DUL      RBL: SORBS: sent directly from dynamic IP
> address
>                             [85.69.182.160 listed in dnsbl.sorbs.net]
>  1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
>                [Blocked - see
> <http://www.spamcop.net/bl.shtml?85.69.182.160>]
>  3.9 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
>                             [85.69.182.160 listed in sbl-xbl.spamhaus.org]
>  1.9 RCVD_IN_NJABL_DUL      RBL: NJABL: dialup sender did non-local SMTP
>                             [85.69.182.160 listed in combined.njabl.org]
>
> FROM MAILSCANNER
> X-Bluestar-MScan-SpamCheck: not spam, SpamAssassin (not cached, score=5.844,
>  required 6, RCVD_IN_NJABL_DUL 1.95, RCVD_IN_XBL 3.90,
>  UNPARSEABLE_RELAY 0.00)
> X-Bluestar-SpamScore: sssss
>
> This is the exact same message.
> Why didn't Mailscanner use Bayes, SORBS or SPAMCOP?
>
> It's not like there not working here's proof of one caught a few minutes
> ago.
> spamcop is not here but bayes and sorbs are.

Sorry if you posted this already, but how do you do your Bayes expiry?
How big is your Bayes db?
I'm thinking expiry problems here... Do you get bayes_toks.expire*
files (where you have your bayes DB files)?
SpamCop and Sorbs could be slow responses...

> X-Bluestar-MScan-SpamCheck: spam, SpamAssassin (not cached, score=9.284,
>  required 6, BAYES_60 1.00, DCC_CHECK 2.17, DIGEST_MULTIPLE 0.77,
>  MSGID_FROM_MTA_ID 1.39, RAZOR2_CF_RANGE_51_100 0.50,
>  RAZOR2_CF_RANGE_E4_51_100 1.50, RAZOR2_CHECK 0.50,
>  RCVD_IN_SORBS_WEB 1.46)
>
> Rene hope you or someone else can help.
We'll do our best:-).

-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se