MCP not working

Thu Aug 9 12:58:22 IST 2007

You are redefining your rule each time. try :-

header   __MCP_W32_ZHELATIN_GEN1    Subject =~ /received a greeting (card|ecard|postcard) from a/i
header   __MCP_W32_ZHELATIN_GEN2    Subject =~ /received a postcard from a/i
header   __MCP_W32_ZHELATIN_GEN3    Subject =~ /received an ecard from a/i
meta     MCP_W32_ZHELATIN_GEN       __MCP_W32_ZHELATIN_GEN1 || __MCP_W32_ZHELATIN_GEN2 || __MCP_W32_ZHELATIN_GEN3
describe MCP_W32_ZHELATIN_GEN       Banned Subject
score    MCP_W32_ZHELATIN_GEN       10

Regards,

--[ UxBoD ]--
// PGP Key: "curl -s https://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: C759 8F52 1D17 B3C5 5854  36BD 1FB1 B02F 5DB5 687B
// Keyserver: www.keyserver.net Key-ID: 0x5DB5687B
// Phone: +44 845 869 2749 SIP Phone: uxbod at sip.splatnix.net

----- Original Message -----
From: "Daniel Eiland" <daniel at bokko.nl>
To: mailscanner at lists.mailscanner.info
Sent: Thursday, August 9, 2007 11:30:02 AM (GMT) Europe/London
Subject: MCP not working

Hello,

I hope someone can help me out.

I have a question regarding MCP. It works, but rules never match.
I am running MailScanner 4.61.7 on FreeBSD. Everything works fine except for MCP.
In my maillog i can see MCP is enabled and is scanning:

Aug  9 12:10:55 panther MailScanner[44602]: New Batch: Found 3 messages waiting
Aug  9 12:10:55 panther MailScanner[44602]: New Batch: Scanning 1 messages, 9602 bytes
Aug  9 12:10:55 panther MailScanner[44602]: MCP Checks: Starting
Aug  9 12:10:57 panther MailScanner[44602]: MCP Checks completed at 8542 bytes per second
Aug  9 12:10:57 panther MailScanner[44602]: Spam Checks: Starting
Aug  9 12:10:57 panther MailScanner[44620]: Virus Scanning completed at 2586 bytes per second
Aug  9 12:10:57 panther MailScanner[44620]: Requeue: F134C11713.526DA to D4F5A119A2
Aug  9 12:10:57 panther MailScanner[44620]: Uninfected: Delivered 1 messages
Aug  9 12:10:57 panther MailScanner[44620]: Virus Processing completed at 319425 bytes per second
Aug  9 12:10:57 panther MailScanner[44620]: Batch completed at 630 bytes per second (6453 / 10)
Aug  9 12:10:57 panther MailScanner[44620]: Batch (1 message) processed in 10.24 seconds

I defined af cf file named 10_w32_zhelatin_gen.cf that is located in %mcp-dir% for catching email with specific subjects.
The subjects i want to catch are in the form of: You've received a greeting card from a friend!

header   MCP_W32_ZHELATIN_GEN    Subject =~ /received a greeting card from a/i
describe MCP_W32_ZHELATIN_GEN    Banned Subject
score    MCP_W32_ZHELATIN_GEN    10
header   MCP_W32_ZHELATIN_GEN    Subject =~ /received a greeting ecard from a/i
describe MCP_W32_ZHELATIN_GEN    Banned Subject
score    MCP_W32_ZHELATIN_GEN    10
header   MCP_W32_ZHELATIN_GEN    Subject =~ /received a greeting postcard from a/i
describe MCP_W32_ZHELATIN_GEN    Banned Subject
score    MCP_W32_ZHELATIN_GEN    10
header   MCP_W32_ZHELATIN_GEN    Subject =~ /received a postcard from a/i
describe MCP_W32_ZHELATIN_GEN    Banned Subject
score    MCP_W32_ZHELATIN_GEN    10
header   MCP_W32_ZHELATIN_GEN    Subject =~ /received an ecard from a/i
describe MCP_W32_ZHELATIN_GEN    Banned Subject
score    MCP_W32_ZHELATIN_GEN    10

My MCP config in MailScanner.conf is:

%mcp-dir% = /usr/local/etc/MailScanner/mcp

MCP Checks = yes
First Check = mcp

MCP Required SpamAssassin Score = 1
MCP High SpamAssassin Score = 10   
MCP Error Score = 1

MCP Header = X-%org-name%-MailScanner-MCPCheck:
Non MCP Actions = deliver
MCP Actions = %rules-dir%/spam.actions.rules
High Scoring MCP Actions = %rules-dir%/spam.actions.rules
Bounce MCP As Attachment = no

MCP Modify Subject = yes
MCP Subject Text = {Evil?}
High Scoring MCP Modify Subject = yes
High Scoring MCP Subject Text = {Evil?}

Is Definitely MCP = %rules-dir%/spam.blacklist.rules
Is Definitely Not MCP = %rules-dir%/spam.whitelist.rules
Definite MCP Is High Scoring = no
Always Include MCP Report = yes  
Detailed MCP Report = yes
Include Scores In MCP Report = yes
Log MCP = yes

MCP SpamAssassin Prefs File = %mcp-dir%/mcp.spam.assassin.prefs.conf
MCP SpamAssassin User State Dir = 
MCP SpamAssassin Local Rules Dir = %mcp-dir%
MCP SpamAssassin Default Rules Dir = %mcp-dir%
MCP SpamAssassin Install Prefix = %mcp-dir%   
Recipient MCP Report = %report-dir%/recipient.mcp.report.txt
Sender MCP Report = %report-dir%/sender.mcp.report.txt

In my email these are the headers:

Subject: You've received an ecard from a Class-mate!
Message-Id: <20070809093143.DFAD711920 at panther>
Date: Thu,  9 Aug 2007 11:31:39 +0200 (CEST)
From: bla at bla.com
To: undisclosed-recipients:;

X-Panther-MailScanner-Information: Please contact ISP for more information
X-Panther-MailScanner: Found to be clean
X-Panther-MailScanner-MCPCheck: MCP-Clean, MCP-Checker (score=0,
	required 1)
X-Panther-MailScanner-SpamCheck: not spam, SpamAssassin (score=0,
	required 5)
X-Panther-MailScanner-From: bla at bla.com
X-Spam-Status: No, No
X-MailScanner: Found to be clean
X-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
	score=1.618, required 5, BAYES_40 -0.18, DK_POLICY_SIGNSOME 0.00,
	NO_REAL_NAME 0.96, UNDISC_RECIPS 0.84)
X-MailScanner-SpamScore: 1

--
:wq!

-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.