A lot of spam getting through

Alex Neuman van der Hans alex at nkpanama.com
Mon Apr 30 19:21:51 IST 2007


Billy A. Pumphrey wrote:
> Hello everyone.  I am having quite a few spam get through.  I thought
> that I had quite a few things installed and configured correctly.
> Actually they used to work really well then when I had to rebuild bayes
> as there were too many FP and turn off RBL's, then a lot of spam are
> getting through.  Somewhere around 50-100 per user are seemingly getting
> through on a weekend.  I have put down as much information as I thought
> about for my configuration.  I am looking for recommendations to
> recrease my block rate.  Please let me know if I left any information
> out.  jThank you.
>
>   
You should use RBL's within spamassassin (as you have it set now) since 
RBL's within spamassassin count towards the score and aren't a pass-fail 
situation that can lead to FP's in your particular case. I, for one, use 
RBL's at the MTA with few (if any) FPs, but rbl's are one of those 
things where your mileage *will* vary, and a lot.

You don't seem to mention running a local caching DNS server. SA could 
be failing to find stuff on RBL's, for example.

You can try using Rules_du_Jour as well, that should kick your scores up 
a few notches.
> Spamassassin:	3.1.8
> MailScanner:	4.58.9
> Perl:			5.8.5
> DCC:			1.3.30
> Razor:		2.80
> Pyzor:		???
> 	Disabled?
> 	[29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::Pyzor
> from @INC
> 	[29269] dbg: pyzor: local tests only, disabling Pyzor
>
>
> I have attached my lint test.
>
> RBL Checks are off because of FP's.  I could not find a good RBL.  I did
> try using the ones that were suggested on the board, but hotmail and
> yahoo email kept getting tagged as spam.
>
> Settings from MailScanner.conf:
> 	Require SpamAssassin Score = 6
> 	
> Sa-learn --dump magic:
> 0.000          0          3          0  non-token data: bayes db version
> 0.000          0      93282          0  non-token data: nspam
> 0.000          0        329          0  non-token data: nham
> 0.000          0     250559          0  non-token data: ntokens
> 0.000          0 1177529793          0  non-token data: oldest atime
> 0.000          0 1177953747          0  non-token data: newest atime
> 0.000          0          0          0  non-token data: last journal
> sync atime
> 0.000          0 1177702647          0  non-token data: last expiry
> atime
> 0.000          0     172800          0  non-token data: last expire
> atime delta
> 0.000          0     338424          0  non-token data: last expire
> reduction count
>
>
>
> /etc/mail/spamassassin directory:
>
> 70_sare_adult.cf
> 70_sare_bayes_poison_nxm.cf
> 70_sare_evilnum0.cf
> 70_sare_evilnum1.cf
> 70_sare_evilnum2.cf
> 70_sare_genlsubj0.cf
> 70_sare_genlsubj1.cf
> 70_sare_genlsubj2.cf
> 70_sare_genlsubj3.cf
> 70_sare_header0.cf
> 70_sare_header1.cf
> 70_sare_header.cf
> 70_sare_html0.cf
> 70_sare_html1.cf
> 70_sare_html2.cf
> 70_sare_html3.cf
> 70_sare_html.cf
> 70_sare_obfu.cf
> 70_sare_oem.cf
> 70_sare_random.cf
> 70_sare_specific.cf
> 70_sare_spoof.cf
> 70_sare_stocks.cf
> 70_sare_unsub.cf
> 70_sare_uri0.cf
> 70_sare_uri1.cf
> 70_sare_uri3.cf
> 70_sare_uri_eng.cf
> 70_sare_whitelist_rcvd.cf
> 70_sare_whitelist_spf.cf
> 70_sc_top200.cf
> 72_sare_bml_post25x.cf
> 72_sare_redirect_post3.0.0.cf
> 88_FVGT_body.cf
> 88_FVGT_headers.cf
> 88_FVGT_rawbody.cf
> 88_FVGT_subject.cf
> 88_FVGT_uri.cf
> 88_FVGT_uri.cf.1
> 99_sare_fraud_post25x.cf
> backhair.cf
> bogus-virus-warnings.cf
> chickenpox.cf
> imageinfo.cf
> init.pre
> local.cf
> mailscanner.cf
> mangled.cf
> old
> random.cf
> RulesDuJour
> sa-update-keys
> spamassassin-default.rc
> spamassassin-helper.sh
> spamassassin-spamc.rc
> tripwire.cf
> v310.pre
> v310.pre.rpmnew
> v312.pre
> v312.pre.rpmnew
> weeds.cf
>
> After looking at a few emails I can see that pyzor and DCC and bayes are
> scoring:
> Score Matching Rule Description 
> cached not   
>  score=24.094   
> 6 required   
>  autolearn=spam   
> 2.17 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/) 
> 0.33 FH_DATE_ISNT_2006   
> 0.77 FH_DATE_ISNT_200X   
> 0.40 FH_LEADINGPREP   
> 0.71 FS_START_BUY   
> 3.70 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/) 
> 0.61 SARE_SXLIFE Talks about your sex life 
> 3.81 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist 
> 4.09 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist 
> 3.01 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist 
> 4.50 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
>
>
> Billy Pumphrey
> IT Manager
> Wooden & McLaughlin
>
>   
> ------------------------------------------------------------------------
>
> [29269] dbg: logger: adding facilities: all 0 
> [29269] dbg: logger: logging level is DBG 0.0001 
> [29269] dbg: generic: SpamAssassin version 3.1.8 6E-05 
> [29269] dbg: config: score set 0 chosen. 0.00099 
> [29269] dbg: util: running in taint mode? yes 0.00032 
> [29269] dbg: util: taint mode: deleting unsafe environment variables, resetting PATH 7E-05 
> [29269] dbg: util: PATH included '/sbin', keeping 0.00018 
> [29269] dbg: util: PATH included '/usr/sbin', keeping 0.0001 
> [29269] dbg: util: PATH included '/bin', keeping 9E-05 
> [29269] dbg: util: PATH included '/usr/bin', keeping 0.0001 
> [29269] dbg: util: PATH included '/usr/X11R6/bin', keeping 0.0001 
> [29269] dbg: util: final PATH set to: /sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin 0.0001 
> [29269] dbg: message: ---- MIME PARSER START ---- 0.00628 
> [29269] dbg: message: main message type: text/plain 0.00015 
> [29269] dbg: message: parsing normal part 7E-05 
> [29269] dbg: message: added part, type: text/plain 0.00013 
> [29269] dbg: message: ---- MIME PARSER END ---- 7E-05 
> [29269] dbg: dns: is Net::DNS::Resolver available? yes 0.00055 
> [29269] dbg: dns: Net::DNS version: 0.48 7E-05 
> [29269] dbg: diag: perl platform: 5.008005 linux 0.25394 
> [29269] dbg: diag: module installed: Digest::SHA1, version 2.07 0.00016 
> [29269] dbg: diag: module installed: LWP::UserAgent, version 2.031 0.0001 
> [29269] dbg: diag: module installed: HTTP::Date, version 1.46 0.00029 
> [29269] dbg: diag: module installed: Archive::Tar, version 1.29 9E-05 
> [29269] dbg: diag: module installed: IO::Zlib, version 1.04 9E-05 
> [29269] dbg: diag: module installed: DB_File, version 1.809 9E-05 
> [29269] dbg: diag: module installed: HTML::Parser, version 3.54 9E-05 
> [29269] dbg: diag: module installed: MIME::Base64, version 3.01 8E-05 
> [29269] dbg: diag: module installed: Net::DNS, version 0.48 8E-05 
> [29269] dbg: diag: module installed: Net::SMTP, version 2.29 9E-05 
> [29269] dbg: diag: module not installed: Mail::SPF::Query ('require' failed) 0.0001 
> [29269] dbg: diag: module not installed: IP::Country::Fast ('require' failed) 9E-05 
> [29269] dbg: diag: module installed: Razor2::Client::Agent, version 2.80 9E-05 
> [29269] dbg: diag: module not installed: Net::Ident ('require' failed) 9E-05 
> [29269] dbg: diag: module not installed: IO::Socket::INET6 ('require' failed) 9E-05 
> [29269] dbg: diag: module not installed: IO::Socket::SSL ('require' failed) 9E-05 
> [29269] dbg: diag: module installed: Time::HiRes, version 1.86 9E-05 
> [29269] dbg: diag: module installed: DBI, version 1.50 8E-05 
> [29269] dbg: diag: module installed: Getopt::Long, version 2.34 8E-05 
> [29269] dbg: ignore: using a test message to lint rules 8E-05 
> [29269] dbg: config: using "/etc/mail/spamassassin" for site rules pre files 0.0001 
> [29269] dbg: config: read file /etc/mail/spamassassin/init.pre 0.0001 
> [29269] dbg: config: read file /etc/mail/spamassassin/v310.pre 9E-05 
> [29269] dbg: config: read file /etc/mail/spamassassin/v312.pre 0.00013 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008" for sys rules pre files 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org.pre 0.00025 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008" for default rules dir 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org.cf 0.00032 
> [29269] dbg: config: using "/etc/mail/spamassassin" for site rules dir 0.00029 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_adult.cf 0.00365 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_bayes_poison_nxm.cf 0.00057 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_evilnum0.cf 0.00081 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_evilnum1.cf 0.00034 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_evilnum2.cf 0.00045 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_genlsubj0.cf 0.00178 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_genlsubj1.cf 0.00322 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_genlsubj2.cf 0.0013 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_genlsubj3.cf 0.00211 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_header.cf 0.01877 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_header0.cf 0.00657 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_header1.cf 0.00614 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_html.cf 0.00469 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_html0.cf 0.00164 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_html1.cf 0.00185 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_html2.cf 0.00116 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_html3.cf 0.00094 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_obfu.cf 0.00527 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_oem.cf 0.00153 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_random.cf 0.00132 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_specific.cf 0.00354 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_spoof.cf 0.00147 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_stocks.cf 0.00267 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_unsub.cf 0.00153 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_uri0.cf 0.00094 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_uri1.cf 0.00115 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_uri3.cf 0.00061 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_uri_eng.cf 0.00041 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_whitelist_rcvd.cf 0.00152 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sare_whitelist_spf.cf 0.00149 
> [29269] dbg: config: read file /etc/mail/spamassassin/70_sc_top200.cf 0.00058 
> [29269] dbg: config: read file /etc/mail/spamassassin/72_sare_bml_post25x.cf 0.00077 
> [29269] dbg: config: read file /etc/mail/spamassassin/72_sare_redirect_post3.0.0.cf 0.00077 
> [29269] dbg: config: read file /etc/mail/spamassassin/88_FVGT_body.cf 0.00405 
> [29269] dbg: config: read file /etc/mail/spamassassin/88_FVGT_headers.cf 0.00291 
> [29269] dbg: config: read file /etc/mail/spamassassin/88_FVGT_rawbody.cf 0.00189 
> [29269] dbg: config: read file /etc/mail/spamassassin/88_FVGT_subject.cf 0.00282 
> [29269] dbg: config: read file /etc/mail/spamassassin/88_FVGT_uri.cf 0.00126 
> [29269] dbg: config: read file /etc/mail/spamassassin/99_sare_fraud_post25x.cf 0.00046 
> [29269] dbg: config: read file /etc/mail/spamassassin/backhair.cf 0.00065 
> [29269] dbg: config: read file /etc/mail/spamassassin/bogus-virus-warnings.cf 0.00619 
> [29269] dbg: config: read file /etc/mail/spamassassin/chickenpox.cf 0.00144 
> [29269] dbg: config: read file /etc/mail/spamassassin/imageinfo.cf 0.00049 
> [29269] dbg: config: read file /etc/mail/spamassassin/local.cf 0.0002 
> [29269] dbg: config: read file /etc/mail/spamassassin/mailscanner.cf 0.00071 
> [29269] dbg: config: read file /etc/mail/spamassassin/mangled.cf 0.00249 
> [29269] dbg: config: read file /etc/mail/spamassassin/random.cf 0.00108 
> [29269] dbg: config: read file /etc/mail/spamassassin/tripwire.cf 0.00272 
> [29269] dbg: config: read file /etc/mail/spamassassin/weeds.cf 0.00066 
> [29269] dbg: config: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file 0.00816 
> [29269] dbg: config: read file /etc/MailScanner/spam.assassin.prefs.conf 0.00077 
> [29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC 0.08558 
> [29269] dbg: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xa35674c) 0.0161 
> [29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC 0.00027 
> [29269] dbg: plugin: registered Mail::SpamAssassin::Plugin::Hashcash=HASH(0xa375c5c) 0.00421 
> [29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC 0.0002 
> [29269] dbg: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0xa3c4af0) 0.00621 
> [29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::DCC from @INC 0.00039 
> [29269] dbg: dcc: local tests only, disabling DCC 0.01016 
> [29269] dbg: plugin: registered Mail::SpamAssassin::Plugin::DCC=HASH(0xa3792d4) 0.0003 
> [29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::Pyzor from @INC 0.00021 
> [29269] dbg: pyzor: local tests only, disabling Pyzor 0.00426 
> [29269] dbg: plugin: registered Mail::SpamAssassin::Plugin::Pyzor=HASH(0xa42932c) 0.00025 
> [29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::SpamCop from @INC 0.00027 
> [29269] dbg: reporter: local tests only, disabling SpamCop 0.00505 
> [29269] dbg: plugin: registered Mail::SpamAssassin::Plugin::SpamCop=HASH(0xa39b118) 0.00021 
> [29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::AWL from @INC 0.00024 
> [29269] dbg: plugin: registered Mail::SpamAssassin::Plugin::AWL=HASH(0xa4359f4) 0.00594 
> [29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::AutoLearnThreshold from @INC 0.00021 
> [29269] dbg: plugin: registered Mail::SpamAssassin::Plugin::AutoLearnThreshold=HASH(0xa44ea74) 0.00191 
> [29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::WhiteListSubject from @INC 0.00026 
> [29269] dbg: plugin: registered Mail::SpamAssassin::Plugin::WhiteListSubject=HASH(0xa443d80) 0.00189 
> [29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::MIMEHeader from @INC 0.00027 
> [29269] dbg: plugin: registered Mail::SpamAssassin::Plugin::MIMEHeader=HASH(0xa461690) 0.00225 
> [29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::ReplaceTags from @INC 0.0002 
> [29269] dbg: plugin: registered Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0xa3ef9a8) 0.0027 
> [29269] dbg: plugin: loading Mail::SpamAssassin::Plugin::ImageInfo from @INC 0.00018 
> [29269] dbg: plugin: registered Mail::SpamAssassin::Plugin::ImageInfo=HASH(0xa3efdec) 0.00464 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/empty.pre 0.00051 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/empty.pre" for included file 0.00012 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_html_tests.cf 0.00026 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_html_tests.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_html_tests.cf 0.00086 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/80_additional.cf 0.01655 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/80_additional.cf" for included file 0.00014 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/80_additional.cf 0.00117 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_pl.cf 0.02436 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_pl.cf" for included file 0.00014 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_pl.cf 0.00144 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_razor2.cf 0.00829 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_razor2.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_razor2.cf 0.00026 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_spf.cf 0.00115 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_spf.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_spf.cf 0.00032 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist_dk.cf 0.00217 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist_dk.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist_dk.cf 0.00028 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/10_misc.cf 0.00125 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/10_misc.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/10_misc.cf 0.00044 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_body_tests_es.cf 0.00314 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_body_tests_es.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_body_tests_es.cf 0.00059 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_nl.cf 0.00231 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_nl.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_nl.cf 0.00197 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_drugs.cf 0.00892 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_drugs.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_drugs.cf 0.00087 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/50_scores.cf 0.01719 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/50_scores.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/50_scores.cf 0.00181 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_accessdb.cf 0.05813 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_accessdb.cf" for included file 0.00014 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_accessdb.cf 0.00017 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_body_tests.cf 0.00058 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_body_tests.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_body_tests.cf 0.00045 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_pt_br.cf 0.00555 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_pt_br.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_pt_br.cf 0.00028 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist_subject.cf 0.00102 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist_subject.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist_subject.cf 0.00026 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_pyzor.cf 0.00107 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_pyzor.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_pyzor.cf 0.00016 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_antivirus.cf 0.00062 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_antivirus.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_antivirus.cf 0.00023 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_anti_ratware.cf 0.0008 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_anti_ratware.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_anti_ratware.cf 0.00023 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_phrases.cf 0.00056 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_phrases.cf" for included file 0.00011 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_phrases.cf 0.00103 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_dcc.cf 0.01859 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_dcc.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_dcc.cf 0.00017 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_uri_tests.cf 0.00062 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_uri_tests.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_uri_tests.cf 0.00061 
> [29269] dbg: config: adding redirector regex: /^http:\/\/chkpt\.zdnet\.com\/chkpt\/\w+\/(.*)$/i 0.00083 
> [29269] dbg: config: adding redirector regex: /^http:\/\/www(?:\d+)?\.nate\.com\/r\/\w+\/(.*)$/i 0.00023 
> [29269] dbg: config: adding redirector regex: /^http:\/\/.+\.gov\/(?:.*\/)?externalLink\.jhtml\?.*url=(.*?)(?:&.*)?$/i 0.00024 
> [29269] dbg: config: adding redirector regex: /^http:\/\/redir\.internet\.com\/.+?\/.+?\/(.*)$/i 0.00022 
> [29269] dbg: config: adding redirector regex: /^http:\/\/(?:.*?\.)?adtech\.de\/.*(?:;|\|)link=(.*?)(?:;|$)/i 0.00025 
> [29269] dbg: config: adding redirector regex: m'^http.*?/redirect\.php\?.*(?<=[?&])goto=(.*?)(?:$|[&#])'i 0.00027 
> [29269] dbg: config: adding redirector regex: m'^https?:/*(?:[^/]+\.)?emf\d\.com/r\.cfm.*?&r=(.*)'i 0.00024 
> [29269] dbg: config: adding redirector regex: m'/(?:index.php)?\?.*(?<=[?&])URL=(.*?)(?:$|[&#])'i 0.0003 
> [29269] dbg: config: adding redirector regex: m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/url\?.*?(?<=[?&])q=(.*?)(?:$|[&#])'i 0.00039 
> [29269] dbg: config: adding redirector regex: m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])site:(.*?)(?:$|%20|[\s+&#])'i 0.00037 
> [29269] dbg: config: adding redirector regex: m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:"|%22)(.*?)(?:$|%22|["\s+&#])'i 0.00039 
> [29269] dbg: config: adding redirector regex: m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/translate\?.*?(?<=[?&])u=(.*?)(?:$|[&#])'i 0.00031 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_advance_fee.cf 0.00659 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_advance_fee.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_advance_fee.cf 0.00043 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_fr.cf 0.00987 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_fr.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_fr.cf 0.00179 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_hashcash.cf 0.00881 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_hashcash.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_hashcash.cf 0.00027 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_fake_helo_tests.cf 0.00202 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_fake_helo_tests.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_fake_helo_tests.cf 0.00067 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_meta_tests.cf 0.00705 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_meta_tests.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_meta_tests.cf 0.00031 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_dkim.cf 0.00536 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_dkim.cf" for included file 0.00015 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_dkim.cf 0.00026 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/70_iadb.cf 0.00115 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/70_iadb.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/70_iadb.cf 0.00075 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/23_bayes.cf 0.00748 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/23_bayes.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/23_bayes.cf 0.00027 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/60_awl.cf 0.00191 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/60_awl.cf" for included file 0.00011 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/60_awl.cf 0.00022 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_head_tests.cf 0.0009 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_head_tests.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_head_tests.cf 0.00166 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_ratware.cf 0.03575 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_ratware.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_ratware.cf 0.00089 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_replace.cf 0.01752 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_replace.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_replace.cf 0.00067 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_textcat.cf 0.01034 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_textcat.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_textcat.cf 0.00018 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist_spf.cf 0.00061 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist_spf.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist_spf.cf 0.00033 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist.cf 0.00325 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist.cf 0.00038 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_porn.cf 0.00374 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_porn.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_porn.cf 0.00035 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_dnsbl_tests.cf 0.00444 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_dnsbl_tests.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_dnsbl_tests.cf 0.00093 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist_dkim.cf 0.00893 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist_dkim.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/60_whitelist_dkim.cf 0.00028 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_net_tests.cf 0.00109 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_net_tests.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_net_tests.cf 0.00026 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_body_tests_pl.cf 0.00127 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_body_tests_pl.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_body_tests_pl.cf 0.00106 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_de.cf 0.00563 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_de.cf" for included file 0.00011 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/30_text_de.cf 0.0021 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_compensate.cf 0.01253 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/20_compensate.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/20_compensate.cf 0.00024 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_domainkeys.cf 0.00128 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_domainkeys.cf" for included file 0.00013 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_domainkeys.cf 0.00026 
> [29269] dbg: plugin: fixed relative path: /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_uribl.cf 0.0011 
> [29269] dbg: config: using "/var/lib/spamassassin/3.001008/updates_spamassassin_org/25_uribl.cf" for included file 0.00012 
> [29269] dbg: config: read file /var/lib/spamassassin/3.001008/updates_spamassassin_org/25_uribl.cf 0.0005 
> [29269] dbg: plugin: Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0xa3ef9a8) implements 'finish_parsing_end' 1.48345 
> [29269] dbg: replacetags: replacing tags 0.00016 
> [29269] dbg: replacetags: done replacing tags 0.03226 
> [29269] dbg: bayes: tie-ing to DB file R/O /etc/MailScanner/bayes/bayes_toks 0.03705 
> [29269] warn: bayes: cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/O: tie failed: Permission denied 0.00081 
> [29269] dbg: bayes: untie-ing DB file toks 0.00012 
> [29269] dbg: config: score set 0 chosen. 0.0001 
> [29269] dbg: message: ---- MIME PARSER START ---- 0.00045 
> [29269] dbg: message: main message type: text/plain 0.00017 
> [29269] dbg: message: parsing normal part 0.0001 
> [29269] dbg: message: added part, type: text/plain 0.00017 
> [29269] dbg: message: ---- MIME PARSER END ---- 0.0001 
> [29269] dbg: bayes: tie-ing to DB file R/O /etc/MailScanner/bayes/bayes_toks 0.00063 
> [29269] warn: bayes: cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/O: tie failed: Permission denied 0.00038 
> [29269] dbg: bayes: untie-ing DB file toks 0.00011 
> [29269] dbg: dns: is DNS available? 0 0.0001 
> [29269] dbg: metadata: X-Spam-Relays-Trusted:  0.00046 
> [29269] dbg: metadata: X-Spam-Relays-Untrusted:  0.00011 
> [29269] dbg: metadata: X-Spam-Relays-Internal:  0.0001 
> [29269] dbg: metadata: X-Spam-Relays-External:  8E-05 
> [29269] dbg: message: no encoding detected 0.00039 
> [29269] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xa35674c) implements 'parsed_metadata' 0.00026 
> [29269] dbg: rules: local tests only, ignoring RBL eval 0.00022 
> [29269] dbg: check: running tests for priority: 0 0.00126 
> [29269] dbg: rules: running header regexp tests; score so far=0 0.00012 
> [29269] dbg: rules: ran header rule __HAS_MSGID ======> got hit: "<" 0.64813 
> [29269] dbg: rules: ran header rule __SANE_MSGID ======> got hit: "<1177953262 at lint_rules> 0.00084 
> [29269] dbg: rules: " 7E-05 
> [29269] dbg: rules: ran header rule __MSGID_OK_HOST ======> got hit: "@lint_rules>" 0.00083 
> [29269] dbg: rules: ran header rule __SARE_WHITELIST_FLAG ======> got hit: "i" 0.01107 
> [29269] dbg: rules: ran header rule __MSGID_OK_DIGITS ======> got hit: "1177953262" 0.00799 
> [29269] dbg: eval: all '*From' addrs: ignore at compiling.spamassassin.taint.org 0.00311 
> [29269] dbg: eval: all '*To' addrs:  0.00156 
> [29269] dbg: rules: ran eval rule NO_RELAYS ======> got hit 0.00081 
> [29269] dbg: rules: ran eval rule __UNUSABLE_MSGID ======> got hit 0.00186 
> [29269] dbg: rules: running body-text per-line regexp tests; score so far=-0.001 0.00043 
> [29269] dbg: rules: ran body rule __NONEMPTY_BODY ======> got hit: "I" 0.77554 
> [29269] dbg: uri: running uri tests; score so far=-0.001 0.05781 
> [29269] dbg: bayes: tie-ing to DB file R/O /etc/MailScanner/bayes/bayes_toks 0.07064 
> [29269] warn: bayes: cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/O: tie failed: Permission denied 0.00078 
> [29269] dbg: bayes: untie-ing DB file toks 0.00021 
> [29269] dbg: bayes: not scoring message, returning undef 0.00024 
> [29269] dbg: bayes: opportunistic call attempt failed, DB not readable 0.00024 
> [29269] dbg: rules: running raw-body-text per-line regexp tests; score so far=-0.001 0.00911 
> [29269] dbg: rules: running full-text regexp tests; score so far=-0.001 0.17779 
> [29269] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xa35674c) implements 'check_tick' 0.01835 
> [29269] dbg: check: running tests for priority: 500 0.00022 
> [29269] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xa35674c) implements 'check_post_dnsbl' 0.0001 
> [29269] dbg: rules: running meta tests; score so far=-0.001 0.00017 
> [29269] info: rules: meta test DIGEST_MULTIPLE has undefined dependency 'RAZOR2_CHECK' 0.0015 
> [29269] info: rules: meta test SARE_HEAD_SUBJ_RAND has undefined dependency 'SARE_XMAIL_SUSP2' 0.02145 
> [29269] info: rules: meta test SARE_HEAD_SUBJ_RAND has undefined dependency 'SARE_HEAD_XAUTH_WARN' 8E-05 
> [29269] info: rules: meta test SARE_HEAD_SUBJ_RAND has dependency 'X_AUTH_WARN_FAKED' with a zero score 7E-05 
> [29269] info: rules: meta test SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_MKSHRT' 0.00969 
> [29269] info: rules: meta test SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_GT' 7E-05 
> [29269] info: rules: meta test SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_TINY' 7E-05 
> [29269] info: rules: meta test SARE_MSGID_LONG45 has undefined dependency '__SARE_MSGID_LONG50' 0.01129 
> [29269] info: rules: meta test SARE_MSGID_LONG45 has undefined dependency '__SARE_MSGID_LONG55' 7E-05 
> [29269] info: rules: meta test SARE_MSGID_LONG45 has undefined dependency '__SARE_MSGID_LONG65' 7E-05 
> [29269] info: rules: meta test SARE_MSGID_LONG45 has undefined dependency '__SARE_MSGID_LONG75' 7E-05 
> [29269] info: rules: meta test VIRUS_WARNING_DOOM_BNC has undefined dependency 'VIRUS_WARNING_MYDOOM4' 0.00031 
> [29269] info: rules: meta test SARE_OBFU_CIALIS has undefined dependency 'SARE_OBFU_CIALIS2' 0.0022 
> [29269] dbg: rules: running header regexp tests; score so far=1.866 0.14259 
> [29269] dbg: rules: running body-text per-line regexp tests; score so far=1.866 0.00011 
> [29269] dbg: uri: running uri tests; score so far=1.866 0.0001 
> [29269] dbg: rules: running raw-body-text per-line regexp tests; score so far=1.866 9E-05 
> [29269] dbg: rules: running full-text regexp tests; score so far=1.866 9E-05 
> [29269] dbg: check: running tests for priority: 1000 0.00013 
> [29269] dbg: rules: running meta tests; score so far=1.866 7E-05 
> [29269] dbg: rules: running header regexp tests; score so far=1.866 0.00012 
> [29269] dbg: rules: running body-text per-line regexp tests; score so far=1.866 0.00044 
> [29269] dbg: uri: running uri tests; score so far=1.866 7E-05 
> [29269] dbg: rules: running raw-body-text per-line regexp tests; score so far=1.866 8E-05 
> [29269] dbg: rules: running full-text regexp tests; score so far=1.866 0.00012 
> [29269] dbg: check: is spam? score=1.866 required=5 0.00027 
> [29269] dbg: check: tests=MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS,TO_CC_NONE 8E-05 
> [29269] dbg: check: subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__NONEMPTY_BODY,__SANE_MSGID,__SARE_WHITELIST_FLAG,__UNUSABLE_MSGID 8E-05 
>   



More information about the MailScanner mailing list