On 3/8/2010 2:33 PM, Renata Dias wrote: > > Some messages receive score 0.00/0.00 and other receive the correct > score like the example below. 0/0 generally indicates the message was not scanned at all. The big giveaway is the threshold is 0, instead of 6.0.
I'm not really an expert on simscan, but if it calls spamc as an interface to spamd, by default spamc will skip scanning messages over 500kb (to avoid bogging SA down on emails that are more likely to be business emails with large attachments). Are the affected messages all over 500k? The other alternative are: -some kind of timeout - but I don't suspect this, as it looks like there's a short runtime in that log line. -simscan is internally whitelisting the message and never passing it to SA at all. I notice one of them forged the pr...@provale.com.br domain as the sender. Any chance you've done a simscan level whitelist of that address? (SA's whitelists show up as rules with large negative scores, not aborted scans). > > > 2010-03-08 16:30:42.038813500 simscan:[63157]:SPAM REJECT > (20.90/6.00):215.7090s:[SPAM] Catch the moment poltronieri! 85% Fire > Sale:84.224.133.193:poltroni...@provale.com.br:poltroni...@provale.com.br > <mailto:oltroni...@provale.com.br> > 2010-03-08 16:30:43.816889500 simscan:[63232]:CLEAN > (8.50/6.00):215.5769s:[SPAM] > =?iso-8859-1?Q?Conquistando_o_padr=E3o_de_excel=EAncia_em_tratamento?=:200.234.196.130:acquasolut...@acquasolution.com:jua...@saaeg.com.br > <mailto:ua...@saaeg.com.br> > 2010-03-08 16:30:45.851526500 simscan:[63300]:CLEAN > (2.40/6.00):215.5192s:Resposta > Automatica:200.205.19.5:gbr...@carlsonwagonlit.com.br:kafeho...@kafehotel.com.br > <mailto:afeho...@kafehotel.com.br> > 2010-03-08 16:30:47.275884500 simscan:[67507]:CLEAN > (0.00/0.00):2.9718s:Catch the moment preto! 85% Fire > Sale:77.255.23.215:pr...@provale.com.br:pr...@provale.com.br > <mailto:r...@provale.com.br> > 2010-03-08 16:30:48.497625500 simscan:[67657]:CLEAN > (0.00/0.00):0.1194s:Comprovante da > TED:200.234.214.155:netexpre...@hm2655.locaweb.com.br:f...@provale.com.br > <mailto:f...@provale.com.br> > > I'm updated SpamAssassin to p5-Mail-SpamAssassin-3.3.0_3 and rules are > /var/db/spamassassin/3.003000/ . > > Can someone help me? > > > -- > Renata Dias >
