Thanks for the help. The output of the following two commands is matching up.
Spamassassin -p /etc/mail/sa-mimedefang.cf < ENTIRE_MESSAGE Spamassassin -p /etc/mail/spamassassin/sa-mimedefang.cf < ENTIRE_MESSAGE. The 2 files are linked, also local.cf is linked to /etc/mail/spamassassin/sa-mimedefang.cf The bayes is the same. I fed it through bayes before I sent the second output, sorry about that. It seems that the SARE rules I have are not being picked up. These are in /var/lib/spamassassin/3.001007. None of the messages that are running through Mimedefang are hitting any of these rules. Should I put all those files as includes in the /etc/mail/spamassassin/sa-mimedefang.cf? Something like include /var/lib/spamassassin/3.001007/99_sare_adult_cf_sare_sa-update_dostech_n et.cf Content preview: Genuie and from the Original manufacturer are selling by Trusted vendor. Don't miss this chance to buy Hight-Quality production! Our online shop: http://golfmaywood.info [...] Content analysis details: (12.9 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.1 EXTRA_MPART_TYPE Header has extraneous Content-type:...type= entry 1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) [SPF failed: Please see http://spf.pobox.com/why.html?sender=berry%40artstheatreschool.com&ip=89 .35.3 9.20&receiver=mx1] 1.3 INFO_TLD URI: Contains an URL in the INFO top-level domain 0.0 HTML_MESSAGE BODY: HTML included in message 4.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100% [score: 1.0000] 0.5 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level above 50% [cf: 100] 2.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) 1.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% [cf: 100] Content preview: Genuie and from the Original manufacturer are selling by Trusted vendor. Don't miss this chance to buy Hight-Quality production! Our online shop: http://golfmaywood.info [...] Content analysis details: (34.9 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 10 FH_MSGID_XXX Message-Id = @xxx 1.1 EXTRA_MPART_TYPE Header has extraneous Content-type:...type= entry -0.0 NO_RELAYS Informational: message was not relayed via SMTP 1.3 INFO_TLD URI: Contains an URL in the INFO top-level domain 0.0 HTML_MESSAGE BODY: HTML included in message 4.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100% [score: 1.0000] 0.5 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.8 SARE_GIF_ATTACH FULL: Email has a inline gif 1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level above 50% [cf: 100] 2.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) 1.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% [cf: 100] 3.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist [URIs: golfmaywood.info] 0.9 MY_CID_AND_CLOSING SARE cid and closing 0.7 MY_CID_AND_STYLE SARE cid and style 1.2 MY_CID_ARIAL2_CLOSING SARE cid arial2 closing 1.1 MY_CID_ARIAL_STYLE SARE cid arial2 style 0.7 MY_CID_AND_ARIAL2 SARE CID and Arial2 0.9 FM_NO_STYLE FM_NO_STYLE -0.0 NO_RECEIVED Informational: message has no Received headers 1.7 SARE_GIF_STOX Inline Gif with little HTML 1.1 FM_MULTI_ODD2 FM_MULTI_ODD2 0.7 FM_MULTI_ODD3 FM_MULTI_ODD3 [EMAIL PROTECTED] MD-Quarantine]# more /etc/mail/spamassassin/sa-mimedefang.cf rewrite_header Subject *****SPAM***** ok_locales all lock_method nfssafe required_score 5.0 dns_available yes uridnsbl_timeout 30 use_razor2 1 use_auto_whitelist 0 use_bayes 1 bayes_auto_learn 1 rbl_timeout 20 bayes_store_module Mail::SpamAssassin::BayesStore::SQL bayes_sql_dsn DBI:mysql:Spam:mx1:3306 bayes_sql_username defang bayes_sql_password defang bayes_auto_learn_threshold_spam 10.0 bayes_auto_learn_threshold_nonspam -2.0 score SARE_DIPLOMA2 10.0 score RCVD_IN_BL_SPAMCOP_NET 10.0 score RAZOR2_CHECK 2.0 score RAZOR2_CF_RANGE_51_100 1.5 score RAZOR2_CF_RANGE_E4_51_100 2.0 score FUZZY_SOFTWARE 10.0 score ALL_TRUSTED 0 score SPF_PASS -1.0 score SPF_HELO_PASS -1.0 score BAYES_99 4.0 Thanks, David -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jan-Pieter Cornet Sent: Wednesday, January 24, 2007 3:34 AM To: [email protected] Subject: Re: [Mimedefang] Some spam tests not running Timeout maybe On Tue, Jan 23, 2007 at 06:24:53PM -0800, David Reta wrote: > I am having an issue with some spam slipping through. When I check the > MSG.0 file from the quarantine against a manual run of the > ENTIRE_MESSAGE file from the quarantine there are rules that are not > hit. I am running them manually as the same user as mimedefang so I > don't think it could be a permission issue. Is there a timeout setting > or something else I could be missing that could be causing this? > > Any help is appreciated. "spamassassin" as a standalone binary uses another configuration file as the spamassassin integrated into mimedefang does. That is likely your problem... try to compare with: spamassassin -p /etc/mail/sa-mimedefang.cf < ENTIRE_MESSAGE Then possibly tweak your sa-mimedefang.cf > Here is an example from the quarantine > > [EMAIL PROTECTED] qdir-2007-01-23-16.27.29-001]$ more MSG.0 [...] > Content analysis details: (0.6 points, 5.0 required) > > 0.603 5 BAYES_00,HTML_MESSAGE,MIME_HTML_ONLY,NO_DNS_FOR_FROM > > Here is the output from when it manually > > [EMAIL PROTECTED] qdir-2007-01-23-16.27.29-001]$ spamassassin < > ENTIRE_MESSAGE [...] > X-Spam-Status: Yes, score=5.8 required=5.0 tests=BAYES_50,DBL_12_LETTER_FLDR, > DBL_12_LETTER_PGIMG,HTML_MESSAGE,MIME_HTML_ONLY,SARE_FORGED_PAYPAL, > SARE_FORGED_PAYPAL_C,SARE_SPOOF_BADURL,SPF_HELO_PASS autolearn=no > version=3.1.7 Note that you also use a different bayes database, apparently. Compare the configs of sa-mimedefang.cf and all *.cf files under /etc/mail/spamassassin. You could if you like put something like "include /etc/mail/spamassassin/local.cf" in your sa-mimedefang.cf, along with any other *.cf files you want to use. (This assumes spamassassin actually uses /etc/mail/spamassassin, and mimedefang uses /etc/mail. Substitute the appropriate paths for your setup, if necessary) -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. Please !! !! archive this message indefinitely to allow verification of the logs. !! _______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list [email protected] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang This email and attachments may contain Narus, Inc. confidential material. If you are not the intended recipient, contact the sender immediately and delete all instances of this email and attachments. _______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list [email protected] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
