Mailscanner not catching SPAM but manual run via SA catches it

[Dan Carl]

----- Original Message ----- 
From: "Glenn Steen" <glenn.steen at gmail.com>
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Sent: Wednesday, November 15, 2006 3:20 AM
Subject: Re: Mailscanner not catching SPAM but manual run via SA catches it


> On 14/11/06, Dan Carl <danc at bluestarshows.com> wrote:
> >  [snip]
> > >
> > > That's an option on MS, look for "Always Include SpamAssassin Report".
> > >
> > Thanks, missed it in the conf.
> > Now I can do some testing
> >  [snip]
> >
> > I've been analyzing messages all morning.
> > It seems that spamassassin runs through all of the rules all the time
but
> > mailscanner rules erratically.(example below)
> >
> > FROM SPAMASSASSIN
> > Content analysis details:   (13.8 points, 5.0 required)
> >
> >  pts rule name              description
>
> ---- ---------------------- ----------------------------------------------
--
> > --
> >  1.4 SPF_SOFTFAIL           SPF: sender does not match SPF record
(softfail)
> > [SPF failed: Please see
> >
http://www.openspf.org/why.html?sender=sondraiszmcgrathly%40charter.net&ip=85.69.182.160&receiver=mail.bluestarshows.com]
> >  0.0 UNPARSEABLE_RELAY      Informational: message has unparseable relay
> > lines
> >  3.0 BAYES_95               BODY: Bayesian spam probability is 95 to 99%
> >                             [score: 0.9598]
> >  2.0 RCVD_IN_SORBS_DUL      RBL: SORBS: sent directly from dynamic IP
> > address
> >                             [85.69.182.160 listed in dnsbl.sorbs.net]
> >  1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
> >                [Blocked - see
> > <http://www.spamcop.net/bl.shtml?85.69.182.160>]
> >  3.9 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
> >                             [85.69.182.160 listed in
sbl-xbl.spamhaus.org]
> >  1.9 RCVD_IN_NJABL_DUL      RBL: NJABL: dialup sender did non-local SMTP
> >                             [85.69.182.160 listed in combined.njabl.org]
> >
> > FROM MAILSCANNER
> > X-Bluestar-MScan-SpamCheck: not spam, SpamAssassin (not cached,
score=5.844,
> >  required 6, RCVD_IN_NJABL_DUL 1.95, RCVD_IN_XBL 3.90,
> >  UNPARSEABLE_RELAY 0.00)
> > X-Bluestar-SpamScore: sssss
> >
> > This is the exact same message.
> > Why didn't Mailscanner use Bayes, SORBS or SPAMCOP?
> >
> > It's not like there not working here's proof of one caught a few minutes
> > ago.
> > spamcop is not here but bayes and sorbs are.
>
> Sorry if you posted this already, but how do you do your Bayes expiry?
I used to have it as a cronjob, but just used the line in Mailscanner.conf
> How big is your Bayes db?
5.2M bayes_seen
2.9M bayes_toks

> I'm thinking expiry problems here... Do you get bayes_toks.expire*
no
> files (where you have your bayes DB files)?
/root/.spamassassin
Question?
My auto-whitelist is 82M is this normal?
If it is and I have Always Include SpamAssassin Report = yes
will it show up in the header as being whitelist?
I know my spam.whitelist.rules are displayed in the header.
> SpamCop and Sorbs could be slow responses...
I've been logging speed today and most batches take less than 10seconds
I set my Spam List Timeout = 60
Is there anything else I can try?
Not as concerned about how long it takes to deliver a message as I am about
reducing spam.
>
> > X-Bluestar-MScan-SpamCheck: spam, SpamAssassin (not cached, score=9.284,
> >  required 6, BAYES_60 1.00, DCC_CHECK 2.17, DIGEST_MULTIPLE 0.77,
> >  MSGID_FROM_MTA_ID 1.39, RAZOR2_CF_RANGE_51_100 0.50,
> >  RAZOR2_CF_RANGE_E4_51_100 1.50, RAZOR2_CHECK 0.50,
> >  RCVD_IN_SORBS_WEB 1.46)
> >
> > Rene hope you or someone else can help.
> We'll do our best:-).
Thanks
>
> -- 
> -- Glenn
> email: glenn < dot > steen < at > gmail < dot > com
> work: glenn < dot > steen < at > ap1 < dot > se
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!