Gary<br><br>the "Spam Report: spam, SORBS-RECENT" gives the clue here. You're doing RBL scanning in MailScanner ("Spam List" settings in MailScanner.conf), and saying that if you single any single RBL this way then it's definitely spam. Most folks either use RBL's in the MTA or Spamassassin (where it will add to the score). In this case Spamassassin doesn't think it's spam.<br>
<br>Make sure the following are set in MailScanner.conf and you'll always get a sensible spam report...<br><br><b><a name="Always Include SpamAssassin Report">Always Include SpamAssassin Report = yes<br><br></a></b><a name="Always Include SpamAssassin Report"><b></b></a><b><a name="SpamScore Number Instead Of Stars">SpamScore Number Instead Of Stars = yes<br>
<br></a></b><a name="SpamScore Number Instead Of Stars"><b></b></a><b><a name="Spam Score Number Format">Spam Score Number Format = </a></b><a name="Always Include SpamAssassin Report"></a><a name="SpamScore Number Instead Of Stars"></a><a name="Spam Score Number Format"></a><b><a name="Spam Score Number Format"></a></b>%5.2f<br>
<br><b><a name="Include Scores In SpamAssassin Report">Include Scores In SpamAssassin Report = yes<br><br></a></b><a name="Include Scores In SpamAssassin Report">These settings make sure you always include a full spamassassin report in all emails, even ones that spamasassin doesn't think are spam.<br>
</a><b><a name="Include Scores In SpamAssassin Report"></a></b><a name="Include Scores In SpamAssassin Report"><br>-- <br>Martin Hepworth<br>Oxford, UK<br></a><b><a name="Include Scores In SpamAssassin Report"></a></b><a name="Always Include SpamAssassin Report"><b></b></a><b><a name="SpamScore Number Instead Of Stars"></a></b><b><a name="Always Include SpamAssassin Report"></a></b>
<br><br><div class="gmail_quote">2009/7/7 Gary Faith <span dir="ltr"><<a href="mailto:gafaith@asdm.net">gafaith@asdm.net</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Jules,<br>
<br>
Sorry to be a broken record. I am trying to document as much as possible so that you can get an accurate picture of what I am talking about. Back a message or two, I gave the difference between what I see in the spamreport field on a clean message vs one that has the specific flags. Here is the spamreport of a recent message (Received on: 07/06/09 20:22:02) with the specific flags. In mailwatch, I ran a report with the flags set as below:<br>
<br>
is Spam (>0 = TRUE) is equal to '1' Remove<br>
is High Scoring Span (>0 = TRUE) is equal to '0' Remove<br>
is Spam according to SpamAssassin (>0 = TRUE) is equal to '0' Remove<br>
is Listed in one or more RBL's (>0 = TRUE) is equal to '1' Remove<br>
<br>
I chose this message and this is the pertinent part of the details page:<br>
<br>
ID: n670LtUA030706<br>
SpamAssassin Score: 1.05<br>
<div class="im">Spam Report: spam, SORBS-RECENT<br>
<br>
</div>When I look at the mysql database, I see a sascore of 1.05 and spamreport show: spam, SORBS-RECENT. (Just confirming what mailwatch shows.) What I think is missing in the spamreport field is the reason(s) for the sascore of 1.05!<br>
<br>
When I run spamassassin on the message manually.<br>
<br>
mscan:/var/spool/MailScanner/quarantine # spamassassin < 20090706/spam/n670LtUA030706 | less<br>
<br>
I get:<br>
<br>
X-Spam-DCC: <a href="http://sonic.net" target="_blank">sonic.net</a>: mscan 1117; Body=2 Fuz1=2 Fuz2=2<br>
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on <a href="http://mscan.domain.com" target="_blank">mscan.domain.com</a><br>
X-Spam-Level: *<br>
X-Spam-Status: No, score=1.1 required=5.0 tests=BAYES_00,HTML_MESSAGE,<br>
HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY shortcircuit=no autolearn=no<br>
version=3.2.5<br>
<br>
At minimum, what seems to be missing in the spamreport field is what is contained in the X-Spam-Status header: BAYES_00,HTML_MESSAGE, HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY and possibly other thing like autolearn, etc.<br>
<br>
As I stated before this only seems to happen when the flags are exactly like above. The spamreport field is correct for any other condition including clean, high scoring, spamassassin spam, etc. If you want, you can contact me off list to produce any more information because people are probably getting tired of me and/or this thread. ;-)<br>
<br>
Gary<br>
<br>
<br>
>>> Julian Field <<a href="mailto:MailScanner@ecs.soton.ac.uk">MailScanner@ecs.soton.ac.uk</a>> 7/6/2009 4:05 AM >>><br>
<div><div></div><div class="h5"><br>
<br>
On 05/07/2009 13:16, Gary Faith wrote:<br>
> The whole reason for this thread was that there wasn't any information in the spamreport field under specific circumstances. Jules patched the code and now some of the spamreport data is now showing up but I don't believe all of it is. I am attempting to prove that there should be more data in the report when these messages are scanned and I think I have proved it but I really don't have the knowledge in Perl to follow the code and see what is happening. I can attempt to solve some things by gathering data but reading Perl is definitely not my strong suit.<br>
><br>
What do you think is still missing?<br>
<br>
Jules<br>
<br>
--<br>
Julian Field MEng CITP CEng<br>
<a href="http://www.MailScanner.info" target="_blank">www.MailScanner.info</a><br>
Buy the MailScanner book at <a href="http://www.MailScanner.info/store" target="_blank">www.MailScanner.info/store</a><br>
<br>
Need help customising MailScanner?<br>
Contact me!<br>
Need help fixing or optimising your systems?<br>
Contact me!<br>
Need help getting you started solving new requirements from your boss?<br>
Contact me!<br>
<br>
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654<br>
Follow me at <a href="http://twitter.com/JulesFM" target="_blank">twitter.com/JulesFM</a> and <a href="http://twitter.com/MailScanner" target="_blank">twitter.com/MailScanner</a><br>
<br>
<br>
--<br>
This message has been scanned for viruses and<br>
dangerous content by MailScanner, and is<br>
believed to be clean.<br>
<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
</div></div></blockquote></div><br><br>