<div dir="ltr">Just to provide feedback on this, it seems I'm mistaken and the headers just aren't showing in MailWatch, because if I look at a message that passed through the server to myself, the headers do show..<div><br><div><div>*SNIP*</div><div>Received: by <a href="http://spam.mycompany.co.za">spam.mycompany.co.za</a> (Postfix, from userid 0)</div><div><span style="white-space:pre"> </span>id A4D012C0070; Tue, 17 Jul 2018 13:00:42 +0200 (SAST)</div><div>Date: Tue, 17 Jul 2018 13:00:42 +0200</div><div>To: <a href="mailto:neilw@mycompany.co.za">neilw@mycompany.co.za</a></div><div>User-Agent: Heirloom mailx 12.5 7/5/10</div><div>MIME-Version: 1.0</div><div>Content-Type: text/plain; charset=us-ascii</div><div>Content-Transfer-Encoding: 7bit</div><div>Message-Id: <<a href="mailto:20180717110042.A4D012C0070@spam.mycompany.co.za">20180717110042.A4D012C0070@spam.mycompany.co.za</a>></div><div>From: <a href="mailto:root@mycompany.co.za">root@mycompany.co.za</a> (root)</div><div>X-mycompany-MailScanner-Information: Please contact mycompany for more info</div><div>X-mycompany-MailScanner-ID: A4D012C0070.A293B</div><div>X-mycompany-MailScanner: Found to be clean</div><div>X-mycompany-MailScanner-IP-Protocol: IPv4</div><div>X-mycompany-MailScanner-SpamScore: s</div><div>X-mycompany-MailScanner-From: <a href="mailto:root@mycompany.co.za">root@mycompany.co.za</a></div></div><div><br></div><div>My question is though, How then can I get emails marked as Junk by Sanesecurity blocked by spamassassin?</div><div><br></div><div>I have configured....</div><div>Spam-Virus Header = X-mycompany-MailScanner-SpamVirus-Report:<br></div><div><br></div><div>and...</div><div><br></div><div><div>Virus Names Which Are Spam = Sane*UNOFFICIAL HTML/* *Phish* Sanesecurity.Junk.*.UNOFFICIAL</div><div><br></div><div>...then I've configured the following in /etc/MailScanner/spamassassin.conf...</div><div><br></div><div>header MS_FOUND_SPAMVIRUS exists:X-mycompany-MailScanner-SpamVirus-Report</div><div>score MS_FOUND_SPAMVIRUS 3.0</div></div><div><br></div><div>...but I never see the above header in MailWatch when looking at emails that were flagged by Sanesecurity, eg:...</div><div><br></div><div><div>Jul 17 11:38:10 MailScanner[28945]: Clamd::INFECTED::Sanesecurity.Junk.47380.UNOFFICIAL :: ./B41AF2C0079.AFBE0/</div><div>Jul 17 11:38:10 MailScanner[28945]: Found spam based virus Sanesecurity.Junk.47380.UNOFFICIAL in B41AF2C0079.AFBE0</div><div>Jul 17 11:38:22 MailScanner[28945]: MailWatch: Logging message B41AF2C0079.AFBE0 to SQL</div><div>Jul 17 11:38:22 MailScanner[29735]: MailWatch: B41AF2C0079.AFBE0: Logged to MailWatch SQL</div></div><div><br></div><div>Any ideas or suggestions please?</div><div><br></div><div>Thanks!</div></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Tue, Jul 17, 2018 at 10:24 AM Neil <<a href="mailto:nwilson123@gmail.com">nwilson123@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi guys,<div><br></div><div>Please could someone assist me, I can't seem to get MailScanner to add the usual message headers.</div><div><br></div><div>I'm using MailScanner-5.0.7-2 with MailWatch 1.2.8</div><div><br></div><div>I've tried moving my org-name variable from MailScanner.conf to my_settings and putting the options in one file, and commenting it out in the other, but nothing seems to work, when I look in MailWatch I just don't see any headers with my company name showing.</div><div><br></div><div>The reason I'm doing this is because I'm wanting Sanesecurity viruses to be recognised by spamassassin but I can't seem to get the Spam-Virus-Header showing, let alone the other headers.</div><div><br></div><div>My --lint test doesn't show any issues either...</div><div><br></div><div><div>[root@freshmail conf.d]# MailScanner --lint</div><div>Trying to setlogsock(unix)</div><div><br></div><div>Reading configuration file /etc/MailScanner/MailScanner.conf</div><div>Reading configuration file /etc/MailScanner/conf.d/README</div><div>Reading configuration file /etc/MailScanner/conf.d/my_settings.conf</div><div>Read 1500 hostnames from the phishing whitelist</div><div>Read 15766 hostnames from the phishing blacklists</div><div>Config: calling custom init function SQLBlacklist</div><div>MailWatch: Starting up MailWatch SQL Blacklist</div><div>MailWatch: Read 1544 blacklist entries</div><div>Config: calling custom init function MailWatchLogging</div><div>MailWatch: Started MailWatch SQL Logging child</div><div>Config: calling custom init function SQLWhitelist</div><div>MailWatch: Starting up MailWatch SQL Whitelist</div><div>MailWatch: Read 102 whitelist entries</div><div><br></div><div>Checking version numbers...</div><div>Version number in MailScanner.conf (5.0.7) is correct.</div><div><br></div><div>Your envelope_sender_header in spamassassin.conf is correct.</div><div>MailScanner setting GID to (89)</div><div>MailScanner setting UID to (89)</div></div><div><br></div><div>Any help is appreciated.</div><div><br></div><div>Thank you!</div><div><br></div><div>Regards.</div><div><br></div><div>Neil Wilson.</div><div><br></div><div><br></div></div>
</blockquote></div>