{Spam?} Re: Spam but no randomly no Spam Report

Tue Jul 7 07:11:30 IST 2009

Gary

the "Spam Report:    spam, SORBS-RECENT" gives the clue here. You're doing
RBL scanning in MailScanner ("Spam List" settings in MailScanner.conf), and
saying that if you single any single RBL this way then it's definitely spam.
Most folks either use RBL's in  the MTA or Spamassassin (where it will add
to the score).  In this case Spamassassin doesn't think it's spam.

Make sure the following are set in MailScanner.conf and you'll always get a
sensible spam report...

*Always Include SpamAssassin Report = yes

****SpamScore Number Instead Of Stars = yes

****Spam Score Number Format = ***%5.2f

*Include Scores In SpamAssassin Report = yes

*These settings make sure you always include a full spamassassin report in
all emails, even ones that spamasassin doesn't think are spam.
**
-- 
Martin Hepworth
Oxford, UK
********

2009/7/7 Gary Faith <gafaith at asdm.net>

> Jules,
>
> Sorry to be a broken record.  I am trying to document as much as possible
> so that you can get an accurate picture of what I am talking about.  Back a
> message or two, I gave the difference between what I see in the spamreport
> field on a clean message vs one that has the specific flags.  Here is the
> spamreport of a recent message (Received on: 07/06/09 20:22:02) with the
> specific flags.  In mailwatch, I ran a report with the flags set as below:
>
> is Spam (>0 = TRUE) is equal to '1'     Remove
> is High Scoring Span (>0 = TRUE) is equal to '0'        Remove
> is Spam according to SpamAssassin (>0 = TRUE) is equal to '0'   Remove
> is Listed in one or more RBL's (>0 = TRUE) is equal to '1'      Remove
>
> I chose this message and this is the pertinent part of the details page:
>
> ID:     n670LtUA030706
> SpamAssassin Score:     1.05
> Spam Report:    spam, SORBS-RECENT
>
> When I look at the mysql database, I see a sascore of 1.05 and spamreport
> show: spam, SORBS-RECENT.  (Just confirming what mailwatch shows.)  What I
> think is missing in the spamreport field is the reason(s) for the sascore of
> 1.05!
>
> When I run spamassassin on the message manually.
>
> mscan:/var/spool/MailScanner/quarantine # spamassassin <
>  20090706/spam/n670LtUA030706 | less
>
> I get:
>
> X-Spam-DCC: sonic.net: mscan 1117; Body=2 Fuz1=2 Fuz2=2
> X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
> mscan.domain.com
> X-Spam-Level: *
> X-Spam-Status: No, score=1.1 required=5.0 tests=BAYES_00,HTML_MESSAGE,
>        HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY shortcircuit=no autolearn=no
>        version=3.2.5
>
> At minimum, what seems to be missing in the spamreport field is what is
> contained in the X-Spam-Status header:  BAYES_00,HTML_MESSAGE,
> HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY and possibly other thing like
> autolearn, etc.
>
> As I stated before this only seems to happen when the flags are exactly
> like above.  The spamreport field is correct for any other condition
> including clean, high scoring, spamassassin spam, etc.   If you want, you
> can contact me off list to produce any more information because people are
> probably getting tired of me and/or this thread.  ;-)
>
> Gary
>
>
> >>> Julian Field <MailScanner at ecs.soton.ac.uk> 7/6/2009 4:05 AM >>>
>
>
> On 05/07/2009 13:16, Gary Faith wrote:
> > The whole reason for this thread was that there wasn't any information in
> the spamreport field under specific circumstances.  Jules patched the code
> and now some of the spamreport data is now showing up but I don't believe
> all of it is.  I am attempting to prove that there should be more data in
> the report when these messages are scanned and I think I have proved it but
> I really don't have the knowledge in Perl to follow the code and see what is
> happening.  I can attempt to solve some things by gathering data but reading
> Perl is definitely not my strong suit.
> >
> What do you think is still missing?
>
> Jules
>
> --
> Julian Field MEng CITP CEng
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> Need help customising MailScanner?
> Contact me!
> Need help fixing or optimising your systems?
> Contact me!
> Need help getting you started solving new requirements from your boss?
> Contact me!
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> Follow me at twitter.com/JulesFM and twitter.com/MailScanner
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090707/a5b58954/attachment-0001.html