{Spam?} Re: Spam but no randomly no Spam Report

[Gary Faith]

>>> On 7/3/2009 at 11:27 AM, in message
<223f97700907030827v65ae494o23985590087ede10 at mail.gmail.com>, Glenn Steen
<glenn.steen at gmail.com> wrote:
> 2009/7/3 Gary Faith <gafaith at asdm.net>:
>> I think it is a perfectly legitimate question and not orthogonal.
> Of course. I meant "orthogonal to the thread as such", but that is (as
> always) the thread filtered through my understanding of it.... perhaps
> not the ebst filter there is...:-)
>> MailScanner calls SA, SA returns information and MailScanner reports it.
>>
>> The reason why I asked it is that the only messages without all the
>> information in the spamreport are the ones with isspam=1, isrblspam=1,
>> issaspam=0 & ishighspam=0.  ALL other messages including clean messages
> Yes, but ... don't you have all the info you need there? A BL blocked
> it in MS, and (after the fix) it correctly identifieswhich BL as well.
> You also know that SA didn't find it to be spam (and the score). Do
> you *need* more? Sure, one could perhaps want to try determin if there
> is something one could do in SA to make SA more effective against it
> but... You already had the hit from the BL.
> Sorry if I seem dense, but I fail to see what you are trying to achieve.
> 
>> generate a full report.  According to Jules, last message is that you have
>> to turn on
>>
>> Always Include SpamAssassin Report = yes
>>
>> to get a report.  And he wrote:
>>
>>>Absolutely correct. You don't want the inefficiency of always generating
>>>the report, which involves always running SA, so don't be surprised when
>>>you don't get the report.
>>
>> My problem with this is that I get a report on clean messages so the logic
>> of not getting report is SA doesn't think it is spam is not correct.
>>
> Ah. Are we perhaps talking about discrepancies with how things get
> reported in MailWatch?

No, the problem doesn't seem to be mailwatch.  The problem seems to be what is returned in the spamreport field.  Not all the data is being returned when the flags are set in this specific configuration.

>> Here is the report on a clean message:
>>
>> SpamAssassin Score:-0.50
>> Spam Report:
>> Score Matching Rule Description
>> -0.50 BAYES_00 Bayesian spam probability is 0 to 1%
>> -0.00 SPF_PASS SPF: sender matches SPF record
>> On a message that meets the criteria in the first sentence, I get this:
>>
>> SpamAssassin Score:-0.49
>> Spam Report:spam, SORBS-RECENT
>> If I go to the quarantine directory and run spamassassin:
>>
>> mscan:/var/spool/MailScanner/quarantine # spamassassin <
>> 20090703/spam/n63D7E9n010959
>>
>> I get the following back:
>>
>> X-Spam-DCC: INFN-TO: mscan 1233; Body=2 Fuz1=3 Fuz2=3
>> X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
>> mscan.asdmonline.net
>> X-Spam-Level:
>> X-Spam-Status: No, score=-0.5 required=5.0 tests=BAYES_00,HTML_MESSAGE
>>         shortcircuit=no autolearn=unavailable version=3.2.5
>>
>> Now for some reason, SpamAssassin is returning BAYES_00, HTML_MESSAGE when I
>> run it manually but MailScanner doesn't include them in the spamreport.
>>
>> How can that be?
> I think I see what you mean. As stated above, the relevant reason for
> the quarantining is actually in the "incomplete" report. That you get
> SA reports for clean messages is because they have had it run on them.
> Look at a whitelisted message. Do you have a SA report there? Probably
> not. Same for other things that would act on the message prior to SA
> being run. Things run *after* SA that would result in it being in the
> quarantine would include the SA report. There's no mystery there.
> And there really is no need for the SA report. Since it wasn't the
> reason for it being blocked. IMO, at least:-).

The whole reason for this thread was that there wasn't any information in the spamreport field under specific circumstances.  Jules patched the code and now some of the spamreport data is now showing up but I don't believe all of it is.  I am attempting to prove that there should be more data in the report when these messages are scanned and I think I have proved it but I really don't have the knowledge in Perl to follow the code and see what is happening.  I can attempt to solve some things by gathering data but reading Perl is definitely not my strong suit.

>> Gary
> (snip)
> 
> Cheers

Gary