It is not all that unusual to see differences in SA when run from the
command line. Have you looked at what scores are being hit on the
actual incoming message (amavisd-new log level to 2)?
Robert Fitzpatrick wrote:
On Wed, 2007-07-18 at 10:12 -0500, Craig Carriere wrote:
I use 256K, but I have a small volume (about a thousand emails a day)
server load. We are also experimenting with the SaneSecurity
definitions for clam which catch a lot of this rodent mail as well and
should lower the SA load.
Glad it helped.
I'm sure it did tremendously, thanks again. But WOW! Look at this one
where the logs indicate it was scored at 4.441 as I received the
message, but if I login as the vscan user, I get a score of 5.8...
Content analysis details: (5.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.6 GMD_PDF_ENCRYPTED BODY: Attached PDF is encrypted
1.4 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
1.3 MISSING_SUBJECT Missing Subject: header
1.5 EMPTY_MESSAGE Message appears to have no textual parts and no
Subject: text
1.0 TVD_PDF_FINGER01 Mail matches standard pdf spam fingerprint
$ exit
esmtp# grep Hpqf4RZBgPd0 /var/log/maillog
Jul 18 14:12:54 esmtp amavis[26504]: (26504-09) Passed CLEAN, [63.139.123.10] [166.149.97.103] <[EMAIL PROTECTED]> -> <[EMAIL PROTECTED]>, quarantine: clean-Hpqf4RZBgPd0.gz, Message-ID: <[EMAIL PROTECTED]>, mail_id: Hpqf4RZBgPd0, Hits: 4.441, queued_as: 9663137B50F, 2405 ms
What other things can contribute to this type of scenario?
|
- Re: not scoring correctly Administrator
-
