{Spam?} Re: Spam but no randomly no Spam Report
Julian Field
MailScanner at ecs.soton.ac.uk
Tue Jul 7 08:50:41 IST 2009
But it does mean that, even though it's spam because it has hit an RBL,
you will still waste time doing a SpamAssassin run of the message, even
though that won't result in any change in action taken with the message.
So yes, you get your report, but you don't get any advantage from having
run it as it's spam anyway. So the time taken to produce the
SpamAssassin report is wasted.
But you can waste your CPU if you want to... :-)
Jules.
On 07/07/2009 07:11, Martin Hepworth wrote:
> Gary
>
> the "Spam Report: spam, SORBS-RECENT" gives the clue here. You're
> doing RBL scanning in MailScanner ("Spam List" settings in
> MailScanner.conf), and saying that if you single any single RBL this
> way then it's definitely spam. Most folks either use RBL's in the MTA
> or Spamassassin (where it will add to the score). In this case
> Spamassassin doesn't think it's spam.
>
> Make sure the following are set in MailScanner.conf and you'll always
> get a sensible spam report...
>
> *Always Include SpamAssassin Report = yes
>
> **SpamScore Number Instead Of Stars = yes
>
> **Spam Score Number Format = ***%5.2f
>
> *Include Scores In SpamAssassin Report = yes
>
> *These settings make sure you always include a full spamassassin
> report in all emails, even ones that spamasassin doesn't think are spam.
> **
> --
> Martin Hepworth
> Oxford, UK
> ******
>
> 2009/7/7 Gary Faith <gafaith at asdm.net <mailto:gafaith at asdm.net>>
>
> Jules,
>
> Sorry to be a broken record. I am trying to document as much as
> possible so that you can get an accurate picture of what I am
> talking about. Back a message or two, I gave the difference
> between what I see in the spamreport field on a clean message vs
> one that has the specific flags. Here is the spamreport of a
> recent message (Received on: 07/06/09 20:22:02) with the specific
> flags. In mailwatch, I ran a report with the flags set as below:
>
> is Spam (>0 = TRUE) is equal to '1' Remove
> is High Scoring Span (>0 = TRUE) is equal to '0' Remove
> is Spam according to SpamAssassin (>0 = TRUE) is equal to '0' Remove
> is Listed in one or more RBL's (>0 = TRUE) is equal to '1' Remove
>
> I chose this message and this is the pertinent part of the details
> page:
>
> ID: n670LtUA030706
> SpamAssassin Score: 1.05
> Spam Report: spam, SORBS-RECENT
>
> When I look at the mysql database, I see a sascore of 1.05 and
> spamreport show: spam, SORBS-RECENT. (Just confirming what
> mailwatch shows.) What I think is missing in the spamreport field
> is the reason(s) for the sascore of 1.05!
>
> When I run spamassassin on the message manually.
>
> mscan:/var/spool/MailScanner/quarantine # spamassassin <
> 20090706/spam/n670LtUA030706 | less
>
> I get:
>
> X-Spam-DCC: sonic.net <http://sonic.net>: mscan 1117; Body=2
> Fuz1=2 Fuz2=2
> X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
> mscan.domain.com <http://mscan.domain.com>
> X-Spam-Level: *
> X-Spam-Status: No, score=1.1 required=5.0 tests=BAYES_00,HTML_MESSAGE,
> HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY shortcircuit=no
> autolearn=no
> version=3.2.5
>
> At minimum, what seems to be missing in the spamreport field is
> what is contained in the X-Spam-Status header:
> BAYES_00,HTML_MESSAGE, HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY and
> possibly other thing like autolearn, etc.
>
> As I stated before this only seems to happen when the flags are
> exactly like above. The spamreport field is correct for any other
> condition including clean, high scoring, spamassassin spam, etc.
> If you want, you can contact me off list to produce any more
> information because people are probably getting tired of me and/or
> this thread. ;-)
>
> Gary
>
>
> >>> Julian Field <MailScanner at ecs.soton.ac.uk
> <mailto:MailScanner at ecs.soton.ac.uk>> 7/6/2009 4:05 AM >>>
>
>
> On 05/07/2009 13:16, Gary Faith wrote:
> > The whole reason for this thread was that there wasn't any
> information in the spamreport field under specific circumstances.
> Jules patched the code and now some of the spamreport data is now
> showing up but I don't believe all of it is. I am attempting to
> prove that there should be more data in the report when these
> messages are scanned and I think I have proved it but I really
> don't have the knowledge in Perl to follow the code and see what
> is happening. I can attempt to solve some things by gathering
> data but reading Perl is definitely not my strong suit.
> >
> What do you think is still missing?
>
> Jules
>
> --
> Julian Field MEng CITP CEng
> www.MailScanner.info <http://www.MailScanner.info>
> Buy the MailScanner book at www.MailScanner.info/store
> <http://www.MailScanner.info/store>
>
> Need help customising MailScanner?
> Contact me!
> Need help fixing or optimising your systems?
> Contact me!
> Need help getting you started solving new requirements from your boss?
> Contact me!
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> Follow me at twitter.com/JulesFM <http://twitter.com/JulesFM> and
> twitter.com/MailScanner <http://twitter.com/MailScanner>
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> <mailto:mailscanner at lists.mailscanner.info>
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> <mailto:mailscanner at lists.mailscanner.info>
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>
>
Jules
--
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
More information about the MailScanner
mailing list