A lot of spam getting through

[Anthony Peacock]

Billy A. Pumphrey wrote:
> Hello everyone.  I am having quite a few spam get through.  I thought
> that I had quite a few things installed and configured correctly.
> Actually they used to work really well then when I had to rebuild bayes
> as there were too many FP and turn off RBL's, then a lot of spam are
> getting through.  Somewhere around 50-100 per user are seemingly getting
> through on a weekend.  I have put down as much information as I thought
> about for my configuration.  I am looking for recommendations to
> recrease my block rate.  Please let me know if I left any information
> out.  jThank you.
> 

<SNIP>

> After looking at a few emails I can see that pyzor and DCC and bayes are
> scoring:
> Score Matching Rule Description 
> cached not   
>  score=24.094   
> 6 required   
>  autolearn=spam   
> 2.17 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/) 
> 0.33 FH_DATE_ISNT_2006   
> 0.77 FH_DATE_ISNT_200X   
> 0.40 FH_LEADINGPREP   
> 0.71 FS_START_BUY   
> 3.70 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/) 
> 0.61 SARE_SXLIFE Talks about your sex life 
> 3.81 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist 
> 4.09 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist 
> 3.01 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist 
> 4.50 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist

Are these the scores that your system gives to one of the emails that 
are gettig through?  If so that scored 24 points.  So this email should 
have been filtered.  This suggests to me that the problem isn't with SA 
but with something in your MailScanner settings.

If these aren't the scores from one of the emails that are getting 
through can you save an email to a text file and send the output of the 
following command:

spamassassin --test-mode < email.txt



-- 
Anthony Peacock
CHIME, Royal Free & University College Medical School
WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
"If you have an apple and I have  an apple and we  exchange apples
then you and I will still each have  one apple. But  if you have an
idea and I have an idea and we exchange these ideas, then each of us
will have two ideas." -- George Bernard Shaw