<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Times New Roman; font-size: 12pt; color: #000000'><div>Here are the relevant parameters from my configuration:<div><br></div><div>Detailed Spam Report = yes</div><div>Include Scores In SpamAssassin Report = yes</div><div>Always Include SpamAssassin Report = yes</div><div>Spam Actions = forward spam@mlrw.com header "X-mlrw-MailScanner-Spam-Status: Yes"</div><div>High Scoring Spam Actions = forward spam@mlrw.com header "X-mlrw-MailScanner-High-Spam-Status: Yes" (This will change to drop once I feel that I get no High Score False Positives)</div><div>Non Spam Actions = deliver header "X-mlrw-MailScanner-Spam-Status: No"</div><div><div>Log Spam = yes</div><div><div>Log Non Spam = yes</div><div><br></div></div></div><div>I have a couple of ideas.</div><div><br></div><div>Could I add a custom function to "Spam Actions", "High Scoring Spam Actions" and "Non Spam Actions" to extract the spam score into a spam log file in addition to what they are doing now?</div><div>or</div><div>Could I use "SpamAssassin Rule Actions" to extract the spam score into a spam log file?</div><div>or</div><div>Since I am using postfix, could I have it extract the sa info before it delivers the message?</div><div><br></div><div>I just want to implement the easiest solution with either minimal or preferably no code development on my part. </div><div><br></div><div>Or do you know of anything like sa-stats that can use the output from MailScanner as is?</div><div><br></div><div>Mike</div><div><br>----- Original Message -----<br>From: "Jules Field" <MailScanner@ecs.soton.ac.uk><br>To: "MailScanner discussion" <mailscanner@lists.mailscanner.info><br>Sent: Monday, August 3, 2009 4:10:11 PM GMT -05:00 US/Canada Eastern<br>Subject: Re: Spamassassin Syslog Functionality<br><br>In which case try the<br>Spam Actions = attachment<br>spam action, or the settings<br>Detailed Spam Report = yes<br>Always Include SpamAssassin Report = yes<br>in MailScanner.conf. Putting in both the "Always" and "Detailed" <br>settings will result in you always getting a list of the rules <br>triggered, whether it was found to be spam or not.<br><br>On 03/08/2009 20:39, Mike Wallace wrote:<br>> Julian I am not looking at what rules are used, I am looking for what <br>> rules are triggered. The sa-stats program is found at <br>> http://www.rulesemporium.com/programs/sa-stats.txt<br>><br>> Here is the a Sample Output with the type of information I am looking <br>> to collect.<br>> ---------------------<br>><br>> Time Spent Running SA: 1.68 hours<br>> Time Spent Processing Spam: 0.29 hours<br>> Time Spent Processing Ham: 1.39 hours<br>><br>> TOP SPAM RULES FIRED<br>> ----------------------------------------------------------------------<br>> RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM<br>> ----------------------------------------------------------------------<br>> 1 HTML_MESSAGE 824 77.07 88.13 74.20<br>> 2 RAZOR2_CHECK 772 19.61 82.57 3.32<br>> 3 RAZOR2_CF_RANGE_51_100 753 18.21 80.53 2.08<br>> 4 RAZOR2_CF_RANGE_E8_51_100 713 17.19 76.26 1.91<br>> 5 URIBL_BLACK 652 16.03 69.73 2.13<br>> 6 MIME_HTML_ONLY 609 29.64 65.13 20.45<br>><br>> This type of report is helpful for tuning sa rules.<br>><br>> Thanks.<br>><br>> Mike<br>><br>> ----- Original Message -----<br>> From: "Jules Field" <MailScanner@ecs.soton.ac.uk><br>> To: "MailScanner discussion" <mailscanner@lists.mailscanner.info><br>> Sent: Monday, August 3, 2009 2:30:36 PM GMT -05:00 US/Canada Eastern<br>> Subject: Re: Spamassassin Syslog Functionality<br>><br>> You can find out what SA rules are being used by doing a "MailScanner<br>> --debug --debug-sa".<br>> That will print the list of rules files it uses. They are the same for<br>> every message.<br>><br>> On 03/08/2009 19:00, Mike Wallace wrote:<br>> > The reason I ask is that I want to run sa-stats to figure out what sa<br>> > rules are being used.<br>> ><br>> > I'm not a Perl expert so I would prefer to not have to modify it to<br>> > handle MailScanner's "Log Spam = yes" details in maillog.<br>> ><br>> > Or, is there an equivalent tool that will use the existing format?<br>> ><br>> > Thanks.<br>> ><br>> > Mike<br>> ><br>> ><br>> > On Jul 31, 2009, at 3:54 PM, Mike Wallace wrote:<br>> ><br>> >> Is there anyway to have MailScanner generate Spamassassin syslog <br>> output?<br>> >><br>> >> I tried using the "Log Spam" setting in MailScanner but it logs to<br>> >> maillog and not a separate log file that the Spamassassin log tools <br>> use.<br>> >><br>> >> Thanks.<br>> >><br>> >> --<br>> >> MailScanner mailing list<br>> >> mailscanner@lists.mailscanner.info<br>> >> http://lists.mailscanner.info/mailman/listinfo/mailscanner<br>> >><br>> >> Before posting, read http://wiki.mailscanner.info/posting<br>> >><br>> >> Support MailScanner development - buy the book off the website!<br>> >> This message has been scanned for viruses and dangerous content by<br>> >> MailScanner, and is believed to be clean.<br>> >><br>> ><br>><br>> Jules<br>><br>> -- <br>> Julian Field MEng CITP CEng<br>> www.MailScanner.info<br>> Buy the MailScanner book at www.MailScanner.info/store<br>><br>> Need help customising MailScanner?<br>> Contact me!<br>> Need help fixing or optimising your systems?<br>> Contact me!<br>> Need help getting you started solving new requirements from your boss?<br>> Contact me!<br>><br>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654<br>> Follow me at twitter.com/JulesFM and twitter.com/MailScanner<br>><br>><br>> -- <br>> This message has been scanned for viruses and<br>> dangerous content by MailScanner, and is<br>> believed to be clean.<br>><br>> -- <br>> MailScanner mailing list<br>> mailscanner@lists.mailscanner.info<br>> http://lists.mailscanner.info/mailman/listinfo/mailscanner<br>><br>> Before posting, read http://wiki.mailscanner.info/posting<br>><br>> Support MailScanner development - buy the book off the website!<br>><br>><br>> This message has been scanned for viruses and dangerous content by <br>> MailScanner, and is believed to be clean.<br>><br><br>Jules<br><br>-- <br>Julian Field MEng CITP CEng<br>www.MailScanner.info<br>Buy the MailScanner book at www.MailScanner.info/store<br><br>Need help customising MailScanner?<br>Contact me!<br>Need help fixing or optimising your systems?<br>Contact me!<br>Need help getting you started solving new requirements from your boss?<br>Contact me!<br><br>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654<br>Follow me at twitter.com/JulesFM and twitter.com/MailScanner<br><br><br>-- <br>This message has been scanned for viruses and<br>dangerous content by MailScanner, and is<br>believed to be clean.<br><br>-- <br>MailScanner mailing list<br>mailscanner@lists.mailscanner.info<br>http://lists.mailscanner.info/mailman/listinfo/mailscanner<br><br>Before posting, read http://wiki.mailscanner.info/posting<br><br>Support MailScanner development - buy the book off the website! <br><br> <br>This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.<br><br></div></div></div></body></html>