{Spam?} Re: Spam but no randomly no Spam Report

[Gary Faith]

Jules,

Sorry to be a broken record.  I am trying to document as much as possible so that you can get an accurate picture of what I am talking about.  Back a message or two, I gave the difference between what I see in the spamreport field on a clean message vs one that has the specific flags.  Here is the spamreport of a recent message (Received on: 07/06/09 20:22:02) with the specific flags.  In mailwatch, I ran a report with the flags set as below:
 
is Spam (>0 = TRUE) is equal to '1'	Remove
is High Scoring Span (>0 = TRUE) is equal to '0'	Remove
is Spam according to SpamAssassin (>0 = TRUE) is equal to '0'	Remove
is Listed in one or more RBL's (>0 = TRUE) is equal to '1'	Remove

I chose this message and this is the pertinent part of the details page:

ID:	n670LtUA030706 
SpamAssassin Score:	1.05
Spam Report:	spam, SORBS-RECENT

When I look at the mysql database, I see a sascore of 1.05 and spamreport show: spam, SORBS-RECENT.  (Just confirming what mailwatch shows.)  What I think is missing in the spamreport field is the reason(s) for the sascore of 1.05!

When I run spamassassin on the message manually.  

mscan:/var/spool/MailScanner/quarantine # spamassassin <  20090706/spam/n670LtUA030706 | less

I get:

X-Spam-DCC: sonic.net: mscan 1117; Body=2 Fuz1=2 Fuz2=2
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on mscan.domain.com
X-Spam-Level: *
X-Spam-Status: No, score=1.1 required=5.0 tests=BAYES_00,HTML_MESSAGE,
        HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY shortcircuit=no autolearn=no
        version=3.2.5
 
At minimum, what seems to be missing in the spamreport field is what is contained in the X-Spam-Status header:  BAYES_00,HTML_MESSAGE, HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY and possibly other thing like autolearn, etc.

As I stated before this only seems to happen when the flags are exactly like above.  The spamreport field is correct for any other condition including clean, high scoring, spamassassin spam, etc.   If you want, you can contact me off list to produce any more information because people are probably getting tired of me and/or this thread.  ;-)

Gary


>>> Julian Field <MailScanner at ecs.soton.ac.uk> 7/6/2009 4:05 AM >>>


On 05/07/2009 13:16, Gary Faith wrote:
> The whole reason for this thread was that there wasn't any information in the spamreport field under specific circumstances.  Jules patched the code and now some of the spamreport data is now showing up but I don't believe all of it is.  I am attempting to prove that there should be more data in the report when these messages are scanned and I think I have proved it but I really don't have the knowledge in Perl to follow the code and see what is happening.  I can attempt to solve some things by gathering data but reading Perl is definitely not my strong suit.
>    
What do you think is still missing?

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info 
Buy the MailScanner book at www.MailScanner.info/store 

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info 
http://lists.mailscanner.info/mailman/listinfo/mailscanner 

Before posting, read http://wiki.mailscanner.info/posting 

Support MailScanner development - buy the book off the website!