On 11/9/2012 7:45 AM, Rejaine Monteiro wrote:
I have a strange problem in Spamassassin - I have received spam which
normally should have been blocked, but were not.
I have received messages with a low score or even negative score, but
when I save the e-mail to a file and run the spamc in the same
message (using the same spamassassin server) the score is completely
different
Today for example, I received a message with a negative score (message
header say: SA: 0 (-93.5/5.0)
I got this mail client (thunderbird), saved it in a file (.eml
extension) ,I copied it to the server where it runs spamassassin and
spamc ran the manually:
#spamc -R < /tmp/spam.eml
Content analysis details: (19.8 points, 5.0 required)
This is a big differece score !!
Why this happing? I'm using spamassassin in conjunction with
qmail-scanner-queue.pl :
Internet --> Spam-Filter (qmail -> qmail-filters (rblsmtp, grey-list,
etc) -> qmail-scanner-queue.pl (per-scanner+clamav+spamasssin)
Someone also uses qmail-scanner and have been through something similar?
Add this to your local.cf or user_prefs file:
add_header all Report _REPORT_
This will give you the full report in the header showing the score
breakdown for all emails, instead of just for spam. Then you can
compare the rule hits for the original run versus your manual run.
The difference of over 100 points seems to indicate that the difference
is mostly due to a whitelist rule of some sort. A score of -93 almost
guarantees that there was a whitelist hit since there are very few rules
that give negative scores and the whitelist rules score -100. That
would mean you had a spam that scored 6.5 before it hit the whitelist
rule. The header reports will let you see exactly what is happening.
--
Bowie
