MS and SA diuffer

[Anthony Peacock]

Hi Alex,

Alex Broens wrote:
> On 10/6/2006 6:53 AM, Garry Glendown wrote:
>> Hi,
>>
>> I've just set up FuzzyOCR to take care of the Image spam that has
>> increased recently ... after still receiving untagged stock spam, I've
>> checked into the scores and stuff and noticed on a test message, that MS
>> has a lot less rule hits (and therefore less score points) than when
>> calling spamassassin directly ...
>>
>> Here's what I got originally from MS:
>>
>> X-nethinks-MailScanner-SpamCheck: not spam, SpamAssassin (Wertung=3.905,
>>     benoetigt 5, HTML_10_20 1.35, HTML_IMAGE_ONLY_32 1.05,
>>     HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.00, RCVD_NUMERIC_HELO 1.50)
>>
>> whereas the -t run from SA resulted in:
>>
>> X-Spam-Status: Yes, score=25.2 required=5.0 tests=AWL,BAYES_99,
>>  FORGED_RCVD_HELO,FUZZY_OCR,HTML_10_20,HTML_IMAGE_ONLY_32,HTML_MESSAGE,
>>         MIME_HTML_ONLY,RCVD_NUMERIC_HELO,SARE_GIF_ATTACH autolearn=no
>>
>> MailScanner.conf points to the right SA directory
>> (/etc/mail/spamassassin), there ARE image spams that get tagged with the
>> OCR-tags, so I don't really get it why the scoring differs this much ...
>> also with the Bayes score ... none on MS, 99 on SA ... !?
>>
>> I'm still running MS 4.50, SA is 3.1.5 ...
>>
>> Any idea where I could look for the cause of this?
> 
> I know I'l be tarred & feathered by this comment (once again):
> 
> I'd bet its because MS only sent part of the whole msg thru SA and 
> cutoff too early & missed the attached images.
> 
> You may have to increase the value in "Max SpamAssassin Size" to catch 
> them.
> 
> Alex

No tar and feathers, but I do think that you are wrong in your 
assumption in this case. :-)


There are lots of rules different between the two tests that can't be 
explained by a truncated message being passed to SA.

AWL, BAYES, RCVD_ tests for instance.

To me this suggests that the SpamAssassin tests were run as a different 
user than the user that MailScanner runs as.  So it picks up the BAYES 
databases and the AWL databases.  It might also be that some tests are 
being disabled in the MS setup.


-- 
Anthony Peacock
CHIME, Royal Free & University College Medical School
WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
"If you have an apple and I have  an apple and we  exchange apples
then you and I will still each have  one apple. But  if you have an
idea and I have an idea and we exchange these ideas, then each of us
will have two ideas." -- George Bernard Shaw