Do others see this effect in their maillogs?

[Scott Silva]

Duncan, Brian M. spake the following on 2/12/2007 8:51 AM:
> I sent this out back in December of 06 without any replies.  Figured I
> would try again now. People were probably out on vacation..
> 
> 
> I am seeing in the logs that when a message is determined to be Spam
> because of RBL checks it does NOT output the right info
> on the log but when it fails because of Spam Assassin analysis of the
> message it does print the right info in the logs.
> 
> 
> I see this on all 3 of my Mailscanner servers in my logs. (I recently
> updated to current MailScanner version with same results)
> 
> 
> Correct log notation: (ONLY occurs when SpamAssassin is involved)
> 
> MailScanner[29410]: Message kBJ96Lbp009914 from 195.22.235.12
> (ikfrjqvpvd at mdl.net <mailto:ikfrjqvpvd at mdl.net> ) to kattenlaw.com is
> spam, SpamAssassin (not cached, score=19.049, required 6.5, BAYES_99
> 6.00, HTML_40_
> 50 0.50, HTML_MESSAGE 0.00, MIME_HTML_MOSTLY 1.10, NO_RDNS2 0.01,
> SARE_CSBIG 1.66, SARE_MLB_Stock1 2.
> 00, SARE_MLH_Stock1 1.66, SARE_RMML_Stock26 1.12, STCK_SPAM_BODY17 2.00,
> STCK_SPAM_BODY21 1.50, STCK_
> SPAM_BODY28 1.50)
> 
> 
> Incorrect log notation: (message failed RBL)
> MailScanner[29447]: Message kBJ97QAb009965 from 61.116.74.25
> (econnors at afr.com.au <mailto:econnors at afr.com.au> ) to kattenlaw.com is
> dnsbl
> 
> 
> it should actually read:
> MailScanner[29447]: Message kBJ97QAb009965 from 61.116.74.25
> (econnors at afr.com.au <mailto:econnors at afr.com.au> ) to kattenlaw.com is
> spam, dnsbl
> 
> 
> Another incorrect log notation:
> MailScanner[31970]: Message kBJHT94h004055 from 221.200.186.157
> (cwkomvq at broward.org) to kattenlaw.com is cbl, MAPS-ALL,
> zen.spamhaus.org
> 
> 
> I see this behavior on ALL of my mail servers.
> 
> 
> Is this only me?
> 
> 
> All my RBL checks work fine, it is just the notation in the log that is
> messed up.
> 
> 
> Thanks for any info
It looks as if it is telling you which list it hit.
Do you have anything set in the following?
# If a message appears in at least this number of "Spam Lists" (as defined
# above), then the message will be treated as spam and so the "Spam
# Actions" will happen, unless the message reaches the levels for "High
# Scoring Spam". By default this is set to 1 to mimic the previous
# behaviour, which means that appearing in any "Spam Lists" will cause
# the message to be treated as spam.
# This can also be the filename of a ruleset.
Spam Lists To Be Spam = 0


Also look here;

# If a message appears in at least this number of "Spam Lists" (as defined
# above), then the message will be treated as "High Scoring Spam" and so
# the "High Scoring Spam Actions" will happen. You probably want to set
# this to 2 if you are actually using this feature. 5 is high enough that
# it will never happen unless you use lots of "Spam Lists".
# This can also be the filename of a ruleset.
Spam Lists To Reach High Score = 0


-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!