{Spam?} Re: Spam but no randomly no Spam Report

[Glenn Steen]

2009/7/3 Gary Faith <gafaith at asdm.net>:
> I think it is a perfectly legitimate question and not orthogonal.
Of course. I meant "orthogonal to the thread as such", but that is (as
always) the thread filtered through my understanding of it.... perhaps
not the ebst filter there is...:-)
> MailScanner calls SA, SA returns information and MailScanner reports it.
>
> The reason why I asked it is that the only messages without all the
> information in the spamreport are the ones with isspam=1, isrblspam=1,
> issaspam=0 & ishighspam=0.  ALL other messages including clean messages
Yes, but ... don't you have all the info you need there? A BL blocked
it in MS, and (after the fix) it correctly identifieswhich BL as well.
You also know that SA didn't find it to be spam (and the score). Do
you *need* more? Sure, one could perhaps want to try determin if there
is something one could do in SA to make SA more effective against it
but... You already had the hit from the BL.
Sorry if I seem dense, but I fail to see what you are trying to achieve.

> generate a full report.  According to Jules, last message is that you have
> to turn on
>
> Always Include SpamAssassin Report = yes
>
> to get a report.  And he wrote:
>
>>Absolutely correct. You don't want the inefficiency of always generating
>>the report, which involves always running SA, so don't be surprised when
>>you don't get the report.
>
> My problem with this is that I get a report on clean messages so the logic
> of not getting report is SA doesn't think it is spam is not correct.
>
Ah. Are we perhaps talking about discrepancies with how things get
reported in MailWatch?
> Here is the report on a clean message:
>
> SpamAssassin Score:-0.50
> Spam Report:
> Score Matching Rule Description
> -0.50 BAYES_00 Bayesian spam probability is 0 to 1%
> -0.00 SPF_PASS SPF: sender matches SPF record
> On a message that meets the criteria in the first sentence, I get this:
>
> SpamAssassin Score:-0.49
> Spam Report:spam, SORBS-RECENT
> If I go to the quarantine directory and run spamassassin:
>
> mscan:/var/spool/MailScanner/quarantine # spamassassin <
> 20090703/spam/n63D7E9n010959
>
> I get the following back:
>
> X-Spam-DCC: INFN-TO: mscan 1233; Body=2 Fuz1=3 Fuz2=3
> X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
> mscan.asdmonline.net
> X-Spam-Level:
> X-Spam-Status: No, score=-0.5 required=5.0 tests=BAYES_00,HTML_MESSAGE
>         shortcircuit=no autolearn=unavailable version=3.2.5
>
> Now for some reason, SpamAssassin is returning BAYES_00, HTML_MESSAGE when I
> run it manually but MailScanner doesn't include them in the spamreport.
>
> How can that be?
I think I see what you mean. As stated above, the relevant reason for
the quarantining is actually in the "incomplete" report. That you get
SA reports for clean messages is because they have had it run on them.
Look at a whitelisted message. Do you have a SA report there? Probably
not. Same for other things that would act on the message prior to SA
being run. Things run *after* SA that would result in it being in the
quarantine would include the SA report. There's no mystery there.
And there really is no need for the SA report. Since it wasn't the
reason for it being blocked. IMO, at least:-).
> Gary
(snip)

Cheers
-- 
-- Glenn (who is finally of on vacation! Hm, wait ... where did the
nice weather go...)
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se