<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-15">
<META content="MSHTML 6.00.2900.3562" name=GENERATOR></HEAD>
<BODY style="MARGIN: 4px 4px 1px; FONT: 10pt Segoe UI">
<DIV>It that is true, then why aren't the SA scores a constant value? </DIV>
<DIV> </DIV>
<DIV>Here are the reports from 3 recently received messages:</DIV>
<DIV> </DIV>
<DIV><TR><TD class=heading align="right" width="175" valign="top">Spam:</TD><TD class=detail><SPAN class=YES> Y </SPAN> Action(s): store, deliver, header, "X-Spam-Status:, Yes"</TD></TR> <TR><TD class=heading align="right" width="175" valign="top">High Scoring Spam:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">SpamAssassin Spam:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">Listed in RBL:</TD><TD class=detail><SPAN class=NO> Y </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">Spam Whitelisted:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">Spam Blacklisted:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">SpamAssassin Autolearn:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">SpamAssassin Score:</TD><TD class=detail>1.77</TD></TR> <TR><TD class=heading align="right" width="175" valign="top">Spam Report:</TD><TD class=detail>spam, SBL+XBL</DIV>
<DIV> </DIV>
<DIV><TR><TD class=heading align="right" width="175" valign="top">Spam:</TD><TD class=detail><SPAN class=YES> Y </SPAN> Action(s): store, deliver, header, "X-Spam-Status:, Yes"</TD></TR> <TR><TD class=heading align="right" width="175" valign="top">High Scoring Spam:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">SpamAssassin Spam:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">Listed in RBL:</TD><TD class=detail><SPAN class=NO> Y </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">Spam Whitelisted:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">Spam Blacklisted:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">SpamAssassin Autolearn:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">SpamAssassin Score:</TD><TD class=detail>0.92</TD></TR> <TR><TD class=heading align="right" width="175" valign="top">Spam Report:</TD><TD class=detail>spam, SBL+XBL</DIV>
<DIV> </DIV>
<DIV></TD></TR></TD></TR><TR><TD class=heading align="right" width="175" valign="top">Spam:</TD><TD class=detail><SPAN class=YES> Y </SPAN> Action(s): store, deliver, header, "X-Spam-Status:, Yes"</TD></TR> <TR><TD class=heading align="right" width="175" valign="top">High Scoring Spam:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">SpamAssassin Spam:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">Listed in RBL:</TD><TD class=detail><SPAN class=NO> Y </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">Spam Whitelisted:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">Spam Blacklisted:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">SpamAssassin Autolearn:</TD><TD class=detail><SPAN class=NO> N </SPAN></TD></TR> <TR><TD class=heading align="right" width="175" valign="top">SpamAssassin Score:</TD><TD class=detail>3.09</TD></TR> <TR><TD class=heading align="right" width="175" valign="top">Spam Report:</TD><TD class=detail>spam, SBL+XBL</DIV>
<DIV> </DIV>
<DIV></TD></TR>Notice that each of these messages have isspam = 1 and isrblspam = 1, ishighspam = 0 & issaspam = 0 but each have a different SA score. My point is something is assigning a value to the SA score but nothing besides "spam, {RBL Listed} is being reported.</DIV>
<DIV><BR>Gary<BR><BR>>>> Martin Hepworth <maxsec@gmail.com> 6/26/2009 12:38 PM >>><BR>2009/6/26 Gary Faith <gafaith@asdm.net>:<BR>> Julian,<BR>><BR>> Better. The spam report field is populated now but I don't think it is<BR>> completely fixed. See below:<BR>><BR>> Spam: Y Action(s): store, deliver, header, "X-Spam-Status:, Yes"<BR>> High Scoring Spam: N<BR>> SpamAssassin Spam: N<BR>> Listed in RBL: Y<BR>> Spam Whitelisted: N<BR>> Spam Blacklisted: N<BR>> SpamAssassin Autolearn: N<BR>> SpamAssassin Score: 3.09<BR>> Spam Report: spam, SBL+XBL<BR>><BR>> I confirmed that the database shows spam, SBL+XBL only. Problem that I see<BR>> is that there is nothing in the spamreport field to explain the 3.09<BR>> SpamAssassin score.<BR>><BR>> Gary<BR>><BR>>>>> Julian Field <MailScanner@ecs.soton.ac.uk> 6/26/2009 4:41 AM >>><BR>> Aha, well done for tracking down that case, I've been looking for that<BR>> bug for ages.<BR>> Due to your diagnostics I now have what should fix it.<BR>><BR>> Please try the attached patch to<BR>> /usr/lib/MailScanner/MailScanner/Message.pm and then restart MailScanner.<BR>><BR>> Thanks for helping!<BR>> Jules.<BR>><BR>> On 26/06/2009 05:08, Gary Faith wrote:<BR>>> Follow Up! After doing more digging, I believe that I have found the<BR>>> common thread when the problem occurs. The spamreport field only<BR>>> seems to be blank when isspam & isrblspam flags are set. If issaspam<BR>>> and/or ishighspam are set then spamreport has data.<BR>>> isspam tinyint(1) =1<BR>>> ishighspam tinyint(1) =0<BR>>> issaspam tinyint(1) =0<BR>>> isrblspam tinyint(1) =1<BR>>> spamwhitelisted tinyint(1) =0<BR>>> spamblacklisted tinyint(1) =0<BR>>> sascore decimal(7,2) some value<BR>>> spamreport text {Empty}<BR>>> I hope this helps shine light on my problem. Any ideas why this is<BR>>> happening?<BR>>> Thanks,<BR>>><BR>>> Gary<BR>>><BR>>> >>> "Gary Faith" <gafaith@asdm.net> 6/25/2009 11:14 PM >>><BR>>> Running MailScanner 4.75.11 on SLES 10 SP2 X86_64. When viewing the<BR>>> information via MailWatch, I see the following on the details page:<BR>>> SpamAssassin Spam: Y Action(s): store, deliver, header,<BR>>> "X-Spam-Status:, Yes"<BR>>> High Scoring Spam: N<BR>>> SpamAssassin Spam: N<BR>>> Listed in RBL: N<BR>>> Spam Whitelisted: N<BR>>> Spam Blacklisted: N<BR>>> SpamAssassin Autolearn: N<BR>>> SpamAssassin Score:1.66<BR>>> The problem is Spam Report is blank. This happens on a few seemingly<BR>>> random messages while most have something in the spamreport field. I<BR>>> have verified this in the database that it definitely null. Any<BR>>> reason why all the data except the spam report would be logged to<BR>>> mysql? Could this be a spamassassin timeout problem?<BR>>> Thanks,<BR>>><BR>>> Gary Faith<BR>><BR>> Jules<BR>><BR>> --<BR>> Julian Field MEng CITP CEng<BR>> www.MailScanner.info<BR>> Buy the MailScanner book at www.MailScanner.info/store<BR>><BR>> Need help customising MailScanner?<BR>> Contact me!<BR>> Need help fixing or optimising your systems?<BR>> Contact me!<BR>> Need help getting you started solving new requirements from your boss?<BR>> Contact me!<BR>><BR>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654<BR>> Follow me at twitter.com/JulesFM and twitter.com/MailScanner<BR>><BR>><BR>> --<BR>> This message has been scanned for viruses and<BR>> dangerous content by MailScanner, and is<BR>> believed to be clean.<BR>><BR>><BR>> --<BR>> MailScanner mailing list<BR>> mailscanner@lists.mailscanner.info<BR>> <A href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</A><BR>><BR>> Before posting, read <A href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</A><BR>><BR>> Support MailScanner development - buy the book off the website!<BR>><BR>><BR><BR><BR>It's listing this as spam as mailScanner is using the SBL+XBL RBL as a<BR>definite source of spam. ie MailScanner is calling the RBL (not<BR>spamassassin) and is it therefor saying it's spam.<BR><BR>Spamassassin is saying it's only scoring 3.09 which isn;t enough for<BR>SA to classify this as spam as far as SA is concerned.<BR><BR>-- <BR>Martin Hepworth<BR>Oxford, UK<BR>--<BR>MailScanner mailing list<BR>mailscanner@lists.mailscanner.info<BR><A href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</A><BR><BR>Before posting, read <A href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</A><BR><BR>Support MailScanner development - buy the book off the website!<BR></DIV></BODY></HTML>