Hi Guys, I finally figure this out. First I check if simscan reads the "hits" and "score" correctly QMAILQUEUE="/var/qmail/bin/simscan" SIMSCAN_DEBUG=2 NOP0FCHECK=1 /var/qmail/bin/qmail-inject [email protected] < test.txt simscan: cdb looking up simscan: cdb for found clam=yes,spam=yes,spam_hits=6,attach=.mp3:.src:.bat:.pif simscan: pelookup clam = yes simscan: pelookup spam = yes simscan: pelookup spam_hits = 6 simscan: Per Domain Hits set to : 6.000000 simscan: pelookup attach = .mp3:.src:.bat:.pif simscan: attachment flag attach = .mp3:.src:.bat:.pif simscan: .mp3 is attachment number 0 simscan: .src is attachment number 1 simscan: .bat is attachment number 2 simscan: .pif is attachment number 3 simscan: starting: work dir: /var/qmail/simscan/1432176943.952853.29806 simscan: pelookup: called with [email protected] simscan: pelookup: domain is mail.yyy.com simscan: cdb looking up mail.yyy.com simscan: pelookup: local part is root simscan: cdb looking up [email protected] simscan: pelookup: called with [email protected]: pelookup: domain is yyy.com simscan: cdb looking up yyy.com simscan: pelookup: local part is xxx simscan: cdb looking up [email protected]: cdb looking up version attach simscan: calling clamdscan simscan: cdb looking up version clamav simscan: normal clamdscan return code: 0 simscan: calling spamc simscan: calling /usr/bin/spamc spamc simscan: neither hits= or score= in X-Spam-Status header simscan: cdb looking up version spam simscan:[29805]:CLEAN (0.00/6.00):1.6770s::(null):[email protected]:[email protected] simscan: done, execing qmail-queue simscan: qmail-queue exited 0
we see that simscan cannot read the numbers simscan: neither hits= or score= in X-Spam-Status header so, I edit the /etc/mail/spamassassin/local.cf , remove all add_header config and add only add_header all Report _REPORT_ then restart qmail then I try again [root@mail tmp]# QMAILQUEUE="/var/qmail/bin/simscan" SIMSCAN_DEBUG=2 NOP0FCHECK=1 /var/qmail/bin/qmail-inject [email protected] < test.txt simscan: cdb looking up simscan: cdb for found clam=yes,spam=yes,spam_hits=6,attach=.mp3:.src:.bat:.pif simscan: pelookup clam = yes simscan: pelookup spam = yes simscan: pelookup spam_hits = 6 simscan: Per Domain Hits set to : 6.000000 simscan: pelookup attach = .mp3:.src:.bat:.pif simscan: attachment flag attach = .mp3:.src:.bat:.pif simscan: .mp3 is attachment number 0 simscan: .src is attachment number 1 simscan: .bat is attachment number 2 simscan: .pif is attachment number 3 simscan: starting: work dir: /var/qmail/simscan/1432177207.419532.30782 simscan: pelookup: called with [email protected] simscan: pelookup: domain is mail.yyy.com simscan: cdb looking up mail.yyy.com simscan: pelookup: local part is root simscan: cdb looking up [email protected] simscan: pelookup: called with [email protected] simscan: pelookup: domain is yyy.com simscan: cdb looking up yyy.com simscan: pelookup: local part is xxx simscan: cdb looking up [email protected] simscan: cdb looking up version attach simscan: calling clamdscan simscan: cdb looking up version clamav simscan: normal clamdscan return code: 0 simscan: calling spamc simscan: calling /usr/bin/spamc spamc simscan: cdb looking up version spam simscan:[30781]:CLEAN (3.60/6.00):1.6591s::(null):[email protected]:[email protected] simscan: done, execing qmail-queue simscan: qmail-queue exited 0 now simscan can read the numbers again ^^; It seems that I messed up with the "add_header" in /etc/mail/spamassassin/local.cf that cause this to happen. Thanks Guys. On Thursday, 16 April 2015, 20:57, Eric Broch <[email protected]> wrote: Not off the top of my head. The only thing I can come up with is that Simscan is not scoring spam, but something else entirely with that 'CLEAN' message. On 4/16/2015 7:41 AM, nelson wrote: Thanks for the info Eric, it helps me understand more about simscan. Any hints about the Spam Score and Simscan "odd" behaviour ? Regards, Nelson On Thursday, 16 April 2015, 20:15, Eric Broch <[email protected]> wrote: On 4/16/2015 6:44 AM, nelson wrote: > Eric, > CMIIW, is it not spamd check the mail, decided the spam score and then add > prefix ***SPAM*** to the subject before passing it to simscan for execution ? > What i am confused about is that spamd already flag the email as spam with > spam score 18.3, and simscan said otherwise with result CLEAN (0.00/6.00) > I am sure that simscan and spamd were checking the same email because of the > same timestamp (email header using GMT and simscan using GMT+07), same > sender, even the X-Spam-Report saying the right thing about the email content Notice in your header: Received: by simscan 1.4.0 ppid: 25086, pid: 25089, t: 2.0388s scanners: attach: 1.4.0 clamav: 0.98.4 /m:55/d:20330 spam: 3.3.2 Simscan calls clamav and spamassassin. You can control which is called. Look into 'simcontrol' here: http://qmailwiki.org/Simscan/Guide --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
