Message rules don't work, but if message forwarded, it does???

[Scott Silva]

on 11-6-2008 9:23 AM Chris Barber spake the following:
>>
>> Glenn,
>>
>> Thanks for the reply. You had me scared for a second there, but no
> there
>> was no white listing going on. I verified the envelope addresses. This
>> issue seems to happen randomly a least a couple times a day to some
>> users.
>>
>> Any other ideas?
>>
>> Thanks,
>> Chris
>>
>> Didn't mean to scare you, just point at one (semi-obvious:-)
> possibility....:-)
>> When it happens do you see anything ... curious .... in the logs?
>> Nothing about "Unscanned" messages or timeouts or suchlike?
>> Also... Tell a bit about versions etc, since this just might be a
>> known bug/issue...
>>
>> Cheers
>> -- 
>> -- Glenn
>> email: glenn < dot > steen < at > gmail < dot > com
>> work: glenn < dot > steen < at > ap1 < dot > se
> 
> 
> I don't see anything unusual in the logs. No timeouts and nothing about
> unscanned that I can see. MailScanner processes the message normally it
> seems. 
> 
> It gets an SA score, but the only rules that hit are:
> 0.10 BAYES_50 Bayesian spam probability is 40 to 60% 
> 0.00 HTML_MESSAGE HTML included in message 
> -0.00 SPF_PASS SPF: sender matches SPF record
> 
> Then when the same message is forwarded to me from the user, (Through
> the same MailScanner server) the rule hits show:
> -0.74 BAYES_20 Bayesian spam probability is 5 to 20% 
> 0.00 HTML_MESSAGE HTML included in message 
> 2.96 URIBL_BLACK Contains an URL listed in the URIBL blacklist 
> 3.50 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
> 
> Notice that now the URL is beting detected, but why not before?
> 
> Versions:
> Cent OS 5.2
> MailScanner 4.72.5
> Spamassassin 3.2.5
> Perl 5.8.8
> MIME::Tools 5.427
> HTML::Parser 3.56
> 
> Let me know if there are versions of anything else you would like to see
> 
> Thanks!
> Chris
> 
> 
Have you run the usual test tools like MailScanner --lint and spamassassin -D
--lint? They will show things like mis detected trusted networks in spamassassin.


-- 
MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 250 bytes
Desc: OpenPGP digital signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20081106/06153854/signature-0001.bin