Atul Paralikar wrote:
Here is the issue I am facing.....
Hi,
I have setup a SA (Spamassissin) server for scanning non-locally
hosted domain. The server is able to accept mails and filter them but
unable to scan them for viruses or arrest the spam. The reason why I
say is, when I check in the Qmail Stats page, SPAMD & CLAMD are
showing "ZERO" activity.
It will be great if anyone can guide me in checking how to enable
SPAMD & CLAMD checking for the emails being forwarded? Are there any
other utilities which can help check the working of SPAMD & CLAMD.
For your information, my SIMCONTROL file output is below where I see
both of them are enabled:
:clam=yes,spam=yes,spam_hits=12,attach=.mp3:.src:.bat:.pif
etisbew.com:clam=yes,spam=yes,spam_hits=12,attach=.mp3:.src:.bat:.pif
When I checked out the email header of the spam emails received by me,
they appear as below. Here *mail.providio.com* is my main server and
*mail.etisbew.com* is SA server.
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on
mail.providio.com
X-Spam-Level: **********
X-Spam-Status: Yes, score=11.0 required=4.0 tests=BAYES_50,HTML_MESSAGE,
MIME_HTML_ONLY,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_PBL,RCVD_IN_SORBS_WEB,
RCVD_IN_XBL,URIBL_JP_SURBL,URIBL_WS_SURBL autolearn=spam version=3.2.4
X-Spam-Report:
* 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
* [Blocked - see <http://www.spamcop.net/bl.shtml?189.60.108.67>]
* 0.9 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
* [189.60.108.67 listed in zen.spamhaus.org]
* 3.0 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
* 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server
* [189.60.108.67 listed in dnsbl.sorbs.net]
* 1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
* [URIs: dwusipaf.cn]
* 1.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
* [URIs: dwusipaf.cn]
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
* [score: 0.5002]
* 1.5 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
Received: (qmail 25096 invoked from network); 18 Sep 2009 08:20:43 -0500
Received: from bd3c6c43.virtua.com.br (HELO ?189.60.108.67?)
(189.60.108.67)
by mail.etisbew.com with SMTP; 18 Sep 2009 08:20:42 -0500
Received-SPF: pass (mail.etisbew.com: SPF record at etisbew.com
designates 189.60.108.67 as permitted sender)
From: "Marketta Icjifu" <[email protected]>
To: [email protected]
Mime-Version: 1.0
Date: Fri, 18 Sep 2009 10:20:49 -0300
Reply-To: "Marketta Fjga" <[email protected]>
Subject: *****SPAM***** Did you follow client?
Message-ID: <2060kq.558468e3.097679275426qdwmetjgpphjrbk...@casa>
Content-type: text/html; charset="utf-8"
Content-Transfer-Encoding: 8bit
X-Spam-Prev-Subject: Did you follow client?
I answered your message before. It is working correctly. Your isoqlogs
may not be showing anything (they may need a reset), but the underlying
system is FINE. The message was run through spamassassin and given a
score of 11.0. In this line:
etisbew.com:clam=yes,spam=yes,spam_hits=12,attach=.mp3:.src:.bat:.pif
You told it to not delete any messages unless they scored above 12.0.
Since this message has a score of 11.0, it was not deleted.
