On Tue, 2 Jun 2009, Rich Shepard wrote:
This morning not only was the mail log report and logwatch report falsely
flagged as spam, but so were several messages posted to the google group
mail list for an application I use. What is interesting to me is that every
one had a +2.5 score for EMPTY_BODY, while none of them had empty bodies.
This *really* suggests that one of two things MUST be occuring:
1) What you are seeing is NOT what spamassassin "sees".
2) A character (null/ascii-zeros?) has been injected into the e-mail
somewhere in the headers, causing Spamassassin to cease its scan at
that point...
Presuming upon the latter, try examining all the headers injected by other
processes like clamav. Particularly where *some* messages receive this
treatment, but not *all*, you should be able to find a 'header difference'
between the passed and failed messages.
Something to try:
Setup a custom rule in local.cf to match a custom header
X-Spam-Test: YES
And then , just before you scan the e-mail with spamassasin, use 'formail'
to add that header to the mail. It will get injected at the end of the
headers. If the test rule 'hits' then you have a real mystery. If the test
rule does *not* 'hit', then we have evidence that something is causing
Spamassassin to behave like an End-Of-File condition has ben reached on
the mail before it read it all..... Null/zeros or something....
- Charles
