I personally don't notify anyone since most viruses fake the FROM address and so it can't be trusted. It only causes more confusion. But I still wanted to notify my customers that viruses were being stopped on their behalf. So I run a monthly report of the mailstats.csv file that tells them how many and what type of viruses were stopped for them. That has worked very well.
--- Ed Henderson Certainty Tech http://www.certainty.net/ > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of jherschel > Sent: Wednesday, August 20, 2003 9:27 AM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]FW: subject_tag not being rewritten > > > Hey folks - haven't received any commentary on this yet ... > is this a bad > question, or would it be better suited to another mailing list? > Qmail-scanner was compiled with "./configure --admin > postmaster --notify > "recips,admin" --install". Am I not using the right options? > > Thanks! > > James Herschel > -----Original Message----- > From: jherschel [mailto:[EMAIL PROTECTED] > Sent: Monday, August 18, 2003 2:15 PM > To: [EMAIL PROTECTED] > Subject: subject_tag not being rewritten > > Hello all, > > I'm hoping you can help me with a small but annoying problem > when using > qmail-scanner to run the spamd/spamc combo. SpamAssassin and > clamav are > definitely being run as witnessed by an attached snippet from > my maillog. > SpamAssassin is even changing the header to include the > X-Spam information, > which is great. Problem is that at first glance the email > looks normal > because it hasn't had "SPAM" prepended to the subject. > > I've tried searching the archives and done the requisite Googling, but > haven't been able to come up with anything ... > > Running the test_installation.sh -doit command gives me the > following in my > /var/log/maillog: > > Aug 18 14:07:03 ahnold spamd[1872]: logmsg: checking message > <9PS291LhupY> > for qmailq:401. > Aug 18 14:07:03 ahnold spamd[1872]: checking message <9PS291LhupY> for > qmailq:401. > Aug 18 14:07:03 ahnold spamd[1872]: debug: running header > regexp tests; > score so far=0 > Aug 18 14:07:04 ahnold spamd[1872]: debug: running body-text > per-line regexp > tests; score so far=4 > Aug 18 14:07:04 ahnold spamd[1872]: debug: running > raw-body-text per-line > regexp tests; score so far=10.7 > Aug 18 14:07:04 ahnold spamd[1872]: debug: running uri tests; score so > far=10.7 > Aug 18 14:07:04 ahnold spamd[1872]: debug: uri tests: Done uriRE > Aug 18 14:07:04 ahnold spamd[1872]: debug: running full-text > regexp tests; > score so far=11.4 > Aug 18 14:07:04 ahnold spamd[1872]: debug: Razor2 is available > Aug 18 14:07:04 ahnold spamd[1872]: debug: Razor2 is available > Aug 18 14:07:04 ahnold spamd[1872]: debug: entering > helper-app run mode > Aug 18 14:07:04 ahnold spamd[1872]: debug: Using results from > Razor v2.36 > Aug 18 14:07:04 ahnold spamd[1872]: debug: Found Razor2 part: part=0 > engine=4 ct=0 cf=100 > Aug 18 14:07:04 ahnold spamd[1872]: debug: leaving helper-app run mode > Aug 18 14:07:04 ahnold spamd[1872]: debug: Razor2 results: > spam? 1 highest > cf score: 100 > Aug 18 14:07:04 ahnold spamd[1872]: debug: all '*From' addrs: > [EMAIL PROTECTED] > Aug 18 14:07:04 ahnold spamd[1872]: debug: all '*To' addrs: > [EMAIL PROTECTED] [EMAIL PROTECTED] > Aug 18 14:07:04 ahnold spamd[1872]: debug: forged_rcvd_trail: entry 0: > by=netnoteinc.com from=webnote.net mismatches=0 > Aug 18 14:07:04 ahnold spamd[1872]: debug: forged_rcvd_trail: entry 1: > by=webnote.net from=netsvr.internet mismatches=0 > Aug 18 14:07:04 ahnold spamd[1872]: debug: running meta > tests; score so > far=16.7 > Aug 18 14:07:04 ahnold spamd[1872]: debug: lock: 1872 created > /var/qmail/.spamassassin/.spamassassin/auto-whitelist.lock.bli > sm.skism.com.1 > 872 > Aug 18 14:07:04 ahnold spamd[1872]: debug: lock: 1872 trying > to get lock on > /var/qmail/.spamassassin/.spamassassin/auto-whitelist with 0 retries > Aug 18 14:07:04 ahnold spamd[1872]: debug: lock: 1872 link to > /var/qmail/.spamassassin/.spamassassin/auto-whitelist.lock: link ok > Aug 18 14:07:05 ahnold spamd[1872]: debug: Tie-ing to DB file R/W in > /var/qmail/.spamassassin/.spamassassin/auto-whitelist > Aug 18 14:07:05 ahnold spamd[1872]: debug: auto-whitelist (db-based): > [EMAIL PROTECTED]|ip=216.214 scores 46/787.4 > Aug 18 14:07:05 ahnold spamd[1872]: debug: AWL active, > pre-score: 17.3, > mean: 17.1173913043478, originating-ip: 216.214.106.173 > Aug 18 14:07:05 ahnold spamd[1872]: debug: add_score: New > count: 47, new > totscore: 804.7 > Aug 18 14:07:05 ahnold spamd[1872]: debug: Post AWL score: 17.2 > Aug 18 14:07:05 ahnold spamd[1872]: debug: DB addr list: untie-ing and > unlocking. > Aug 18 14:07:05 ahnold spamd[1872]: debug: DB addr list: file locked, > breaking lock. > Aug 18 14:07:05 ahnold spamd[1872]: debug: unlock: 1872 unlink > /var/qmail/.spamassassin/.spamassassin/auto-whitelist.lock > Aug 18 14:07:05 ahnold spamd[1872]: debug: is spam? > score=17.2 required=5 > tests=AWL,CLICK_BELOW,DATE_IN_FUTURE_03_06,EXCUSE_12,EXCUSE_4, > FORGED_YAHOO_R > CVD,FOR_FREE,FROM_ENDS_IN_NUMS,INVALID_DATE,INVALID_MSGID,NORM > AL_HTTP_TO_IP, > NO_REAL_NAME,RAZOR2_CHECK,REMOVE_IN_QUOTES,REMOVE_SUBJ,SUBJ_FR > EE_CAP,UNDISC_ > RECIPS > Aug 18 14:07:05 ahnold spamd[1872]: logmsg: identified spam > (17.2/5.0) for > qmailq:401 in 1.6 seconds, 1552 bytes. > Aug 18 14:07:05 ahnold spamd[1872]: identified spam (17.2/5.0) for > qmailq:401 in 1.6 seconds, 1552 bytes. > > The email header info now contains: > > Received: from by blism.skism.com by uid 0 with qmail-scanner-1.16 > (spamassassin: 2.55. Clear:SA:1(17.2/5.0):. > Processed in 2.448358 secs); 18 Aug 2003 18:07:04 -0000 > X-Spam-Status: Yes, hits=17.2 required=5.0 > > Here is my user_prefs file: > > required_hits 5 > rewrite_subject 1 > subject_tag SPAM > report_header 1 > use_terse_report 1 > report_safe 0 > defang_mime 0 > use_razor2 1 > skip_rbl_checks 1 > use_bayes 0 > > Here's a quick run-down of the software - If you need more > information, > please let me know! > > RedHat 8.0 > Qmail-scanner 1.16 > SpamAssassin 2.55 > Qmail 1.03 with various patches installed from source > > James Herschel > > > > ------------------------------------------------------- > This SF.net email is sponsored by Dice.com. > Did you know that Dice has over 25,000 tech jobs available today? From > careers in IT to Engineering to Tech Sales, Dice has tech > jobs from the > best hiring companies. http://www.dice.com/index.epl?rel_code=104 > _______________________________________________ > Qmail-scanner-general mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general > ------------------------------------------------------- This SF.net email is sponsored by Dice.com. Did you know that Dice has over 25,000 tech jobs available today? From careers in IT to Engineering to Tech Sales, Dice has tech jobs from the best hiring companies. http://www.dice.com/index.epl?rel_code=104 _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
