Betr.: Re: lots of spam getting through with zero score since saturday

[Arjan Melein]

Is it possible that there's a 'rogue' MTA running that is just bypassing MS ?
I think your maillog would reveal the most info right now, or run MS in a non forked mode so you can see what its doing.

-
Arjan


>>> Op 11-4-2012 om 17:31 is door "Harondel J. Sibble" <mailscanner at pdscc.com>
geschreven:

> 
> On 12 Mar 2012 at 18:44, Alex Broens wrote:
> 
>> On 03/12/2012 06:25 PM, Harondel J. Sibble wrote:
>> > Kinda scratching my head here
>> >
>> > Client emailed to say that this weekend lots of spam started coming 
> through.
>> > Other than moving the box from physical to virtual about a month ago, there
>> > haven't been any changes or updates.
>> >
>> > All the spam that's getting through has a listing of 0.00 Clean in
>> > Mailwatch, this is what I see in Mailwatch when I pull up the detailed
>> > info..
>> >
>> > SpamAssassin
>> > Spam:  N   Action(s): store, deliver
>> > High Scoring Spam:  N
>> > SpamAssassin Spam:  N
>> > Listed in RBL:  N
>> > Spam Whitelisted:  N
>> > Spam Blacklisted:  N
>> > SpamAssassin Autolearn:  N
>> > SpamAssassin Score: 0.00
>> >
>> > Spam Report: Score Matching Rule Description
>> > cached not
>> > out timed
>> >
>> > Some messages are being appropriately tagged as spam, even highscoring 
> spam,
>> > but that's maybe 1 out of a hundred, the other 99 are just flowing through.
>> >
>> > I'm reviewing the configuration, but so far nothing seems out of the
>> > ordinary,
>> >
>> > Suggestions for next steps?
>> 
>> I'd start with getting hold of missed messages, analyze, write SA rules, 
> feed
>> bayes....
> 
> 
> Ugh all of a sudden, same thing happening again, stuff that's clearly spam 
> is 
> getting marked with a 0.00 score and is not getting ANY spamassassin rule 
> hits.
> 
>> > Spam Report: Score Matching Rule Description
>> > cached not
>> > out timed
> 
> Last time, after reclassifying  say 10 pages of messages in mailwatch, 
> everything was fine again until yesterday.  It's not as bad as last time, 
> but 
> still happening....
> 
> once again scratching my head.