lots of spam getting through with zero score since saturday

[Harondel J. Sibble]

On 12 Mar 2012 at 18:44, Alex Broens wrote:

> On 03/12/2012 06:25 PM, Harondel J. Sibble wrote:
> > Kinda scratching my head here
> >
> > Client emailed to say that this weekend lots of spam started coming through.
> > Other than moving the box from physical to virtual about a month ago, there
> > haven't been any changes or updates.
> >
> > All the spam that's getting through has a listing of 0.00 Clean in
> > Mailwatch, this is what I see in Mailwatch when I pull up the detailed
> > info..
> >
> > SpamAssassin
> > Spam:  N   Action(s): store, deliver
> > High Scoring Spam:  N
> > SpamAssassin Spam:  N
> > Listed in RBL:  N
> > Spam Whitelisted:  N
> > Spam Blacklisted:  N
> > SpamAssassin Autolearn:  N
> > SpamAssassin Score: 0.00
> >
> > Spam Report: Score Matching Rule Description
> > cached not
> > out timed
> >
> > Some messages are being appropriately tagged as spam, even highscoring spam,
> > but that's maybe 1 out of a hundred, the other 99 are just flowing through.
> >
> > I'm reviewing the configuration, but so far nothing seems out of the
> > ordinary,
> >
> > Suggestions for next steps?
> 
> I'd start with getting hold of missed messages, analyze, write SA rules, feed
> bayes....


Ugh all of a sudden, same thing happening again, stuff that's clearly spam is 
getting marked with a 0.00 score and is not getting ANY spamassassin rule 
hits.

> > Spam Report: Score Matching Rule Description
> > cached not
> > out timed

Last time, after reclassifying  say 10 pages of messages in mailwatch, 
everything was fine again until yesterday.  It's not as bad as last time, but 
still happening....

once again scratching my head.
-- 
Harondel J. Sibble 
Sibble Computer Consulting
Creating Solutions for the small and medium business computer user.
help at pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com
Blog: http://www.pdscc.com/blog
(604) 739-3709 (voice)