<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="Section1">
<p class="MsoNormal">spamassassin-3.3.1-3.el5.rf<o:p></o:p></p>
<p class="MsoNormal">mailscanner-4.83.5-1<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Looking for some help here, it looks like sometimes Mailscanner is causing SpamAssassin to not use some rules. (Not exactly sure on this I assume it is Mailscanner based on the behavior I am seeing)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I receive the message and it is not tagged as Spam and winds up in my inbox. The headers show on this example:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">X-MailScanner-SpamCheck: not spam, SpamAssassin (cached, score=0.8,required 6.5, BAYES_50 0.80, LOTS_OF_MONEY 0.00,RP_MATCHES_RCVD -0.00)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I then take that message and drag it into a separate mailbox I had setup on our Exchange server, then pull it down to my Sendmail/Mailscanner/SpamAssassin box through imap in rfc822 format.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I then run the same message through Spamassassin with –test-mode locally from my mail server I get different scoring on, it looks like I am missing some of the checks because now it defiantly shows as Spam:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Content analysis details: (17.3 hits, 6.5 required)<o:p></o:p></p>
<p class="MsoNormal"> 5.0 URIBL_DBL_SPAM Contains an URL listed in the DBL blocklist<o:p></o:p></p>
<p class="MsoNormal"> [URIs: eelefs.net]<o:p></o:p></p>
<p class="MsoNormal">-0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain<o:p></o:p></p>
<p class="MsoNormal"> 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%<o:p></o:p></p>
<p class="MsoNormal"> [score: 0.5050]<o:p></o:p></p>
<p class="MsoNormal"> 2.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level<o:p></o:p></p>
<p class="MsoNormal"> above 50%<o:p></o:p></p>
<p class="MsoNormal"> [cf: 100]<o:p></o:p></p>
<p class="MsoNormal"> 8.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)<o:p></o:p></p>
<p class="MsoNormal"> 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%<o:p></o:p></p>
<p class="MsoNormal"> [cf: 100]<o:p></o:p></p>
<p class="MsoNormal"> 0.0 LOTS_OF_MONEY Huge... sums of money<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">------ End of SpamAssassin results, Original message follows --------<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So I was wondering if it had to with my MailScanner.conf having this line: SpamAssassin Local State Dir = # /var/lib/spamassassin<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">But based on my debug of MailScanner, it does not matter if the # is present or not, MailScanner seems to think it knows where all the rules are. The below output is with SpamAssassin Local State Dir = /var/lib/spamassassin<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In Debugging mode, not forking...<o:p></o:p></p>
<p class="MsoNormal">Trying to setlogsock(unix)<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.475 [32352] dbg: logger: adding facilities: all<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.475 [32352] dbg: logger: logging level is DBG<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.475 [32352] dbg: generic: SpamAssassin version 3.3.1<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.475 [32352] dbg: generic: Perl 5.008008, PREFIX=/usr, DEF_RULES_DIR=/usr/share/spamassassin, LOCAL_RULES_DIR=/etc/mail/spamassassin, LOCAL_STATE_DIR=/var/lib/spam<o:p></o:p></p>
<p class="MsoNormal">assassin<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.475 [32352] dbg: config: timing enabled<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.475 [32352] dbg: config: score set 0 chosen.<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.477 [32352] dbg: util: running in taint mode? no<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.480 [32352] dbg: dns: is Net::DNS::Resolver available? yes<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.480 [32352] dbg: dns: Net::DNS version: 0.65<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.481 [32352] dbg: config: using "/etc/mail/spamassassin" for site rules pre files<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.481 [32352] dbg: config: read file /etc/mail/spamassassin/init.pre<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.481 [32352] dbg: config: read file /etc/mail/spamassassin/v310.pre<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.481 [32352] dbg: config: read file /etc/mail/spamassassin/v312.pre<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.481 [32352] dbg: config: read file /etc/mail/spamassassin/v320.pre<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.481 [32352] dbg: config: read file /etc/mail/spamassassin/v330.pre<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.481 [32352] dbg: config: using "/var/lib/spamassassin/3.003001" for sys rules pre files<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.481 [32352] dbg: config: using "/var/lib/spamassassin/3.003001" for default rules dir<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.482 [32352] dbg: config: read file /var/lib/spamassassin/3.003001/updates_spamassassin_org.cf<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.482 [32352] dbg: config: using "/etc/mail/spamassassin" for site rules dir<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.482 [32352] dbg: config: read file /etc/mail/spamassassin/70_sare_evilnum1.cf<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.482 [32352] dbg: config: read file /etc/mail/spamassassin/70_sare_unsub.cf<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.482 [32352] dbg: config: read file /etc/mail/spamassassin/chickenpox.cf<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.482 [32352] dbg: config: read file /etc/mail/spamassassin/local.cf<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.482 [32352] dbg: config: read file /etc/mail/spamassassin/mailscanner.cf<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.483 [32352] dbg: config: using "/root/.spamassassin/user_prefs" for user prefs file<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.483 [32352] dbg: config: read file /root/.spamassassin/user_prefs<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.484 [32352] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.488 [32352] dbg: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.491 [32352] dbg: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.494 [32352] dbg: plugin: loading Mail::SpamAssassin::Plugin::Pyzor from @INC<o:p></o:p></p>
<p class="MsoNormal">15:54:01 Jun 12 15:54:01.496 [32352] dbg: pyzor: network tests on, attempting Pyzor<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The odd thing here to me, is if I search my maillog for some of the hits from above, Like URIBL_DBL_SPAM, I am seeing many hits on this.. It just seems to be skipping some of the rules for a certain messages. I looked through<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Anyone have any ideas where I can start to figure this one out? I checked my rules, but since some of the rules are firing I assumed it can’t have anything to do with that..<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here is the complete output from the message I give as an example from above: (minus the spammy body)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Received: from CHI-US-HT-01.us.kmz.com (10.18.17.28) by<o:p></o:p></p>
<p class="MsoNormal"> CHI-US-CAS-1B.us.kmz.com (10.125.15.2) with Microsoft SMTP Server (TLS) id<o:p></o:p></p>
<p class="MsoNormal"> 14.3.123.3; Wed, 12 Jun 2013 15:44:04 -0500<o:p></o:p></p>
<p class="MsoNormal">Received: from chi-us-vwall-01.us.kmz.com (10.18.16.181) by<o:p></o:p></p>
<p class="MsoNormal"> CHI-US-HT-01.us.kmz.com (10.18.17.28) with Microsoft SMTP Server id<o:p></o:p></p>
<p class="MsoNormal"> 14.3.123.3; Wed, 12 Jun 2013 15:44:03 -0500<o:p></o:p></p>
<p class="MsoNormal">Received: from venus.kattenlaw.com ([10.18.3.33]) by us.kmz.com<o:p></o:p></p>
<p class="MsoNormal"> ([10.18.16.181]) with ESMTP (TREND IMSS SMTP Service 7.1) id 844d8c4f001d4ac4<o:p></o:p></p>
<p class="MsoNormal"> ; Wed, 12 Jun 2013 15:44:01 -0500<o:p></o:p></p>
<p class="MsoNormal">Received: from smtp1.eelefs.net (smtp1.eelefs.net [66.197.143.105]) by<o:p></o:p></p>
<p class="MsoNormal"> venus.kattenlaw.com (8.13.8/8.13.4) with ESMTP id r5CKi0H8028960 for<o:p></o:p></p>
<p class="MsoNormal"> <brian.duncan@kmzr.com>; Wed, 12 Jun 2013 15:44:03 -0500<o:p></o:p></p>
<p class="MsoNormal">From: 2013 Models <Jorge.Mendoza@eelefs.net><o:p></o:p></p>
<p class="MsoNormal">To: "Duncan, Brian M." <brian.duncan@kattenlaw.com><o:p></o:p></p>
<p class="MsoNormal">Subject: *Reduction Information* 2013's for thousands less<o:p></o:p></p>
<p class="MsoNormal">Thread-Topic: *Reduction Information* 2013's for thousands less<o:p></o:p></p>
<p class="MsoNormal">Thread-Index: AQHOZ62T+0z+e2LgwkiBidggfWeC0A==<o:p></o:p></p>
<p class="MsoNormal">Date: Wed, 12 Jun 2013 15:43:58 -0500<o:p></o:p></p>
<p class="MsoNormal">Message-ID: <29295056e3e7741908e644022e5f0220@smtp1.eelefs.net><o:p></o:p></p>
<p class="MsoNormal">Reply-To: "Jorge.Mendoza@eelefs.net" <Jorge.Mendoza@eelefs.net><o:p></o:p></p>
<p class="MsoNormal">Content-Language: en-US<o:p></o:p></p>
<p class="MsoNormal">X-MS-Exchange-Organization-AuthAs: Anonymous<o:p></o:p></p>
<p class="MsoNormal">X-MS-Exchange-Organization-AuthSource: CHI-US-HT-01.us.kmz.com<o:p></o:p></p>
<p class="MsoNormal">X-MS-Has-Attach:<o:p></o:p></p>
<p class="MsoNormal">X-MS-TNEF-Correlator:<o:p></o:p></p>
<p class="MsoNormal">x-mailscanner-from: jorgemendoza@smtp1.eelefs.net<o:p></o:p></p>
<p class="MsoNormal">x-mailscanner-spamcheck: not spam, SpamAssassin (cached, score=0.8, required<o:p></o:p></p>
<p class="MsoNormal"> 6.5, BAYES_50 0.80, LOTS_OF_MONEY 0.00, RP_MATCHES_RCVD -0.00)<o:p></o:p></p>
<p class="MsoNormal">x-kattenlaw-mailscanner-information:<o:p></o:p></p>
<p class="MsoNormal">x-mailscanner-spam: no<o:p></o:p></p>
<p class="MsoNormal">x-kattenlaw-mailscanner-id: r5CKi0H8028960<o:p></o:p></p>
<p class="MsoNormal">x-tm-imss-message-id: <844d8c4f001d4ac4@us.kmz.com><o:p></o:p></p>
<p class="MsoNormal">x-kattenlaw: NS<o:p></o:p></p>
<p class="MsoNormal">Content-Type: text/plain; charset="us-ascii"<o:p></o:p></p>
<p class="MsoNormal">Content-ID: <8737EB66163E6F4DA060748F2D862AD0@kattenlaw.com><o:p></o:p></p>
<p class="MsoNormal">MIME-Version: 1.0<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks for any help.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre>===========================================================
CIRCULAR 230 DISCLOSURE: Pursuant to Regulations Governing Practice Before the Internal Revenue
Service, any tax advice contained herein is not intended or written to be used and cannot be used
by a taxpayer for the purpose of avoiding tax penalties that may be imposed on the taxpayer.
===========================================================
CONFIDENTIALITY NOTICE:
This electronic mail message and any attached files contain information intended for the exclusive
use of the individual or entity to whom it is addressed and may contain information that is
proprietary, privileged, confidential and/or exempt from disclosure under applicable law. If you
are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or
distribution of this information may be subject to legal restriction or sanction. Please notify
the sender, by electronic mail or telephone, of any unintended recipients and delete the original
message without making any copies.
===========================================================
NOTIFICATION: Katten Muchin Rosenman LLP is an Illinois limited liability partnership that has
elected to be governed by the Illinois Uniform Partnership Act (1997).
===========================================================</pre></font></td></tr></table>