Rich Shepard wrote:
Here are all headers from the mail log summary:
From [email protected] Mon Jun 1 11:25:44 2009
Return-Path: <[email protected]>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5-ph20040310.0 (2008-06-10) on
salmo.appl-ecosys.com
X-Spam-Level: ****
X-Spam-Status: Yes, score=4.9 required=4.0
tests=ALL_TRUSTED,AWL,BAYES_99,
EMPTY_BODY,NORMAL_HTTP_TO_IP,NUMERIC_HTTP_ADDR,URI_HEX,URI_NOVOWEL
autolearn=no version=3.2.5-ph20040310.0
X-Spam-Report:
* -1.3 ALL_TRUSTED Passed through trusted hosts only via SMTP
* 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 2.5 EMPTY_BODY BODY: Message has subject but no body
* 0.0 NORMAL_HTTP_TO_IP URI: Uses a dotted-decimal IP address in URL
* 0.4 URI_HEX URI: URI hostname has long hexadecimal sequence
* 0.0 NUMERIC_HTTP_ADDR URI: Uses a numeric IP address in URL
* 1.6 URI_NOVOWEL URI: URI hostname has long non-vowel sequence
* -1.8 AWL AWL: From: address is in the auto white-list
X-Original-To: [email protected]
Delivered-To: [email protected]
Received: from salmo.appl-ecosys.com (localhost.localdomain [127.0.0.1])
by salmo.appl-ecosys.com (Postfix) with ESMTP id 8DA0F1026
for <[email protected]>; Mon, 1 Jun 2009 11:25:44 -0700 (PDT)
Received: (from r...@localhost)
by salmo.appl-ecosys.com (8.14.3/8.14.2/Submit) id n51IPibx030133;
Mon, 1 Jun 2009 11:25:44 -0700
Date: Mon, 1 Jun 2009 11:25:44 -0700
From: [email protected]
Message-Id: <[email protected]>
To: [email protected]
Subject: *****SPAM***** salmo Daily Mail Report for Monday, 01 June 2009
X-Spam-Prev-Subject: salmo Daily Mail Report for Monday, 01 June 2009
Report based on information in /var/log/maillog
Your biggest problems here are BAYES_99 and EMPTY_BODY. To fix the
Bayes problem, sa-learn some of these messages as ham. Make sure you
are learning as the right user...
The empty body problem is a more difficult problem. Have procmail save
a copy of the raw message somewhere and take a look at it. Make sure
there is a blank line between the headers and the body. Run
'spamassassin -D' on this saved message and look for anything unusual in
the debug output.
--
Bowie
