Thanks for the suggestion, Sanford. OK, I removed the -y for all the POSTIVE SA tests (SA1-SA10) and then created the following rule in local.cf:
body MY_SPAMASSASSIN_RULE /this is a test of spamassassin/ describe MY_SPAMASSASSIN_RULE Test of my spamassassin rule score MY_SPAMASSASSIN_RULE 11 Sending a message with " this is a test of spamassassin" in the body ends up with this in maillog: spamd: clean message (4.6/5.0) and spamd: result: . 4 - AWL,BAYES_00,HTML_90_100,HTML_MESSAGE,MY_SPAMASSASSIN_RULE scantime=6.3 I wrote the rule differently, adding is to the end, and a score of 11, I'm getting a failure on SA5 now. This is weird. The maillog for that one shows: spamd: clean message (4.9/5.0) for spamd:101 in 7.2 seconds, 2872 bytes. And spamd: result: . 4 - AWL,BAYES_00,HTML_90_100,HTML_MESSAGE,MY_SPAMASSASSIN_RULE scantime=7.2,size=2872 Is my custom rule being overridden somehow?? It shows up in the spamd logging, but doesn't apply the score?? I'm using SA 3.1.0. Next I turned of Bayes and Pyzor. Maillog: spamd: identified spam (6.2/5.0) for spamd:101 in 1.8 seconds, 2872 bytes and spamd: result: Y 6 - AWL,HTML_MESSAGE,MY_SPAMASSASSIN_RULE scantime=1.8,size=2872 Now it scores higher?? Tested from command line on SPAM that was not held: SPAMC32: Loading C:\imail\Declude\filters\SPAMC32\Enjoy.eml 9.4/5.0 AWL,DCC_CHECK,HTML_FONT_BIG,HTML_IMAGE_RATIO_02,HTML_MESSAGE,INVALID_DATE,J_ CHICKENPOX_93,RCVD_IN_BL_SPAMCOP_NET,SUBJ_YOUR_DEBT,URIBL_OB_SURBL (bayes, etc. still OFF) Test on high scorer that didn't fail SA before: SPAMC32: Loading C:\imail\Declude\filters\SPAMC32\cbn.eml 28.0/5.0 ADDR_NUMS_AT_BIGSITE,ADVANCE_FEE_1,ADVANCE_FEE_2,ADVANCE_FEE_3,ADVANCE_FEE_4 ,AWL,FAKE_HELO_MAIL_COM,FORGED_MUA_OUTLOOK,FORGED_YAHOO_RCVD,FROM_HAS_ULINE_ NUMS,INVALID_DATE,J_CHICKENPOX_48,J_CHICKENPOX_74,MILLION_USD,MISSING_HEADER S,MSGID_FROM_MTA_HEADER,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL,RCVD_IN_SORBS_WEB ,RCVD_NUMERIC_HELO,TO_CC_NONE Tested my rule test mail from command line: 6.3/5.0 AWL,HTML_MESSAGE,MY_SPAMASSASSIN_RULE Hmm... It appears this is at least partially on the SA side. Any ideas?? Thanks, Geoff -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Thursday, April 27, 2006 10:31 AM To: Geoff Varney Subject: Re: [Declude.JunkMail] Problems with SPAMC32 scoring?? > While I can't *guarantee* that it was working right with higher than > 10 returns from spamd, here is what I see now. '-et 10' means 'return an exit code of 10 if the SPAMD total weight was greater than 10.' I like to look at it in terms of what SPAMC32 returns, not anything it can't control, so I won't refer to the weight you assigned to the test in the Declude test definition. What happens if you run SPAMC32 from the command line against a message known to get a SPAMD weight > 10 and check the exit code with 'echo %ERRORLEVEL%'? Can you add a regression test in SPAMD that specifically adds a weight of 11 and post the results? And I would eliminate the '-y' from the test def, or at least for this round of testing, because this is in there for backward compatibility with the *nix SpamC and, I would say, is not guaranteed to work in expected ways when paired with the newer-fangled '-e' switch. The '-y' is good switch to use for interactive debugging, but it will only create more overhead (more data sent back across the wire) when used under Declude, AFAICS. --Sandy ------------------------------------ Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa d/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re lease/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
