<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PersonName"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Arial Narrow";
panose-1:2 11 5 6 2 2 2 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Hello all,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I have three incoming mail servers, each identical hardware
and software configurations, running MailScanner 4.51.6 and SpamAssassin 3.1.1.
There is a custom ruleset, “</span></font><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>99_petrosun.cf</span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>”,
located in </span></font><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>/etc/mail/spamassassin/</span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> on all
three servers. The ruleset is very simple, and is designed to identify a
specific type of spam that we’ve been getting tonnes of lately.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Unfortunately, <i><span style='font-style:italic'>one</span></i>
of my three servers appears to be ignoring it. I’m really not sure why.
Two of my servers produce logs such as this:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Jul 31 10:26:53 elmer MailScanner[6645]: Message
41DA34BB78.01E46 from 65.54.246.204 (ubitest2006@hotmail.com) to ubisoft.com is
spam, SpamAssassin (score=34.986, required 6, autolearn=disabled,
MSGID_FROM_MTA_HEADER 0.00, PETROSUN01 10.00, PETROSUN02 10.00, PETROSUN03
10.00, SARE_FWDLOOK 1.67, SARE_MLB_Stock1 1.66, SARE_MLB_Stock6 1.66)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>The server that isn’t identifying properly produces
this:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Jul 31 10:32:07 marvin MailScanner[14159]: Message
BB3334BB48.736B5 from 65.54.246.105 (ubitest2006@hotmail.com) to ubisoft.com is
not spam, SpamAssassin (score=4.986, required 6, MSGID_FROM_MTA_HEADER 0.00,
SARE_FWDLOOK 1.67, SARE_MLB_Stock1 1.66, SARE_MLB_Stock6 1.66)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Now, clearly, rules form </span></font><font size=2
face="Courier New"><span style='font-size:10.0pt;font-family:"Courier New"'>/etc/mail/spamassassin/*.cf</span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> are being
read, since the SARE rulesets are triggering on both – only the one
custom rule appears to be ignored. Oddly, running a lint check shows no
problems; quite the opposite, in fact, as the file is read, and no errors are
produced:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>[14995] dbg: config: read file
/etc/mail/spamassassin/99_petrosun.cf<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>The file itself, as well as the permissions and ownership
are the same on all three servers. I’ve tried issuing both “MailScanner
reload” and “MailScanner restart” to no avail. Any ideas as
to what’s going on here are welcome.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Thanks!<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 color=navy face="Courier New"><span lang=FR-CA
style='font-size:8.0pt;font-family:"Courier New";color:navy'>--<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face="Courier New"><span lang=FR-CA
style='font-size:10.0pt;font-family:"Courier New";color:navy'> _<br>
°v° </span></font><st1:PersonName w:st="on"><font size=2
color=navy face="Arial Narrow"><span lang=FR-CA style='font-size:10.0pt;
font-family:"Arial Narrow";color:navy'>Daniel Maher</span></font></st1:PersonName><font
size=2 color=navy face="Courier New"><span lang=FR-CA style='font-size:10.0pt;
font-family:"Courier New";color:navy'><br>
/(_)\ </span></font><font size=2 color=navy face="Arial Narrow"><span
lang=FR-CA style='font-size:10.0pt;font-family:"Arial Narrow";color:navy'>Administrateur
Système Unix</span></font><font color=navy><span lang=FR-CA style='color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face="Courier New"><span lang=FR-CA
style='font-size:10.0pt;font-family:"Courier New";color:navy'> </span></font><font
size=2 color=navy face="Courier New"><span style='font-size:10.0pt;font-family:
"Courier New";color:navy'>^ ^</span></font><font size=2 color=navy
face="Courier New"><span style='font-size:10.0pt;font-family:"Courier New";
color:navy'> </span></font><font size=2 color=navy face="Arial Narrow"><span
style='font-size:10.0pt;font-family:"Arial Narrow";color:navy'>Unix System
Administrator<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><em><i><font size=1 color=navy face=Arial><span
style='font-size:7.5pt;font-family:Arial;color:navy'>Sentio aliquos togatos
contra me conspirare.</span></font></i></em><o:p></o:p></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</body>
</html>