two different spamassassin outputs

2009-08-09 Thread David Banning 
With every email for some reason I get two reports from spamassassin.
I the headers I get this line;

-
X-Spam-Status: No, score=2.5 required=5.0 tests=BAYES_00,DEAR_SOMETHING,
HTML_MESSAGE,SPF_PASS,URIBL_BLACK,URIBL_OB_SURBL autolearn=no version=3.
2.5
-


Then in the actual message content area, I get this message - (notice the 
difference in the score)



-
Content analysis details:   (6.3 points, 5.0 required)

 pts rule name  description
 -- --
-0.0 SPF_PASS   SPF: sender matches SPF record
 2.2 DEAR_SOMETHING BODY: Contains 'Dear (something)'
 0.0 HTML_MESSAGE   BODY: HTML included in message
 2.1 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
[URIs: verery.net]
 2.0 URIBL_BLACKContains an URL listed in the URIBL blacklist
[URIs: verery.net]
-

I would like it to toss the email away based on the second score (6.3)
but I would also like to know why it is scoring twice, each with a different
score.

Any comments or suggestions would be helpful. Thanks -

Re: two different spamassassin outputs

2009-08-09 Thread Jari Fredriksson 
 With every email for some reason I get two reports from
 spamassassin. 
 I the headers I get this line;
 
 -
 X-Spam-Status: No, score=2.5 required=5.0
 tests=BAYES_00,DEAR_SOMETHING,
 HTML_MESSAGE,SPF_PASS,URIBL_BLACK,URIBL_OB_SURBL
 autolearn=no version=3.  
 2.5
 -
 
 
 Then in the actual message content area, I get this
 message - (notice the difference in the score)
 
 
 
 -
 Content analysis details:   (6.3 points, 5.0 required)
 
 pts rule name  description
  --
 -- 
 -0.0 SPF_PASS   SPF: sender matches SPF record
 2.2 DEAR_SOMETHING BODY: Contains 'Dear
 (something)' 
 0.0 HTML_MESSAGE   BODY: HTML included in message
 2.1 URIBL_OB_SURBL Contains an URL listed in the
OB SURBL blocklist [URIs:
 verery.net] 
 2.0 URIBL_BLACKContains an URL listed in the
URIBL blacklist [URIs:
 verery.net] -
 
 I would like it to toss the email away based on the
 second score (6.3) 
 but I would also like to know why it is scoring twice,
 each with a different score.
 
 Any comments or suggestions would be helpful. Thanks -

Somehow your installation passes the email to SpamAssassin twice: first the 
spam, and THEN the SpamAssassin message with the spam as an attachment in it.

This is only a wild guess, can't say as I do not see the headers.

Re: two different spamassassin outputs

2009-08-09 Thread Matt Kettler 
David Banning wrote:
 With every email for some reason I get two reports from spamassassin.
 I the headers I get this line;

 -
 X-Spam-Status: No, score=2.5 required=5.0 tests=BAYES_00,DEAR_SOMETHING,
 HTML_MESSAGE,SPF_PASS,URIBL_BLACK,URIBL_OB_SURBL autolearn=no version=3.
 2.5
 -


 Then in the actual message content area, I get this message - (notice the 
 difference in the score)



 -
 Content analysis details:   (6.3 points, 5.0 required)

  pts rule name  description
  -- --
 -0.0 SPF_PASS   SPF: sender matches SPF record
  2.2 DEAR_SOMETHING BODY: Contains 'Dear (something)'
  0.0 HTML_MESSAGE   BODY: HTML included in message
  2.1 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
 [URIs: verery.net]
  2.0 URIBL_BLACKContains an URL listed in the URIBL blacklist
 [URIs: verery.net]
 -

 I would like it to toss the email away based on the second score (6.3)
 but I would also like to know why it is scoring twice, each with a different
 score.
   
It looks like you're scanning twice. One copy of SA has a bayes database
(that thinks the message is nonspam, so it's probably badly trained),
and the other doesn't seem to have bayes enabled.

That alone accounts for -2.6 points.

The other side of it, the second copy, because bayes isn't active, the
second one is using scoreset 1, instead of scoreset 3, which raises the
scores of other tests (the points that bayes would otherwise hog gets
sprinkled around across other rules).

ie: in set 1, URIBL_OB_SURBL is 2.132 points, in set 3 it is 1.50.. etc.

 Any comments or suggestions would be helpful. Thanks -