Hi. This is the qmail-send program at mailscan2.newmedia.no. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out.
<[EMAIL PROTECTED]>: 66.35.250.206 failed after I sent the message. Remote host said: 550-This message matches a blacklisted regular expression ([Vv] *[Ii] *[Aa] 550 *[Gg] *[Rr] *[Aa])
--- Below this line is a copy of the message.
Return-Path: <[EMAIL PROTECTED]> Received: (qmail 22540 invoked by uid 105); 14 Sep 2004 11:48:13 -0000 Received: from [EMAIL PROTECTED] by mailscan2 with qmail-scanner-1.01 (iscan: v3.1/v5.420-0629/958/51192. sweep: 2.4/3.47. hbedv: 6.2.0.3. fsecure: 4.08/2030/2004-09-06/2004-09-10/2002-11-17. . Clean. Processed in 1.771504 secs); 14 Sep 2004 11:48:13 -0000 Received: from mail.newmedia.no (212.71.66.4) by mailscan2.newmedia.no with SMTP; 14 Sep 2004 11:48:11 -0000 Received: (qmail 14649 invoked from network); 14 Sep 2004 11:48:11 -0000 Received: from arvinn.formen.org (HELO ?212.71.64.140?) (212.71.64.140) by mail.newmedia.no with SMTP; 14 Sep 2004 11:48:11 -0000 Message-ID: <[EMAIL PROTECTED]> Date: Tue, 14 Sep 2004 13:48:10 +0200 From: =?ISO-8859-1?Q?Arvinn_L=F8kkebakken?= <[EMAIL PROTECTED]> User-Agent: Mozilla Thunderbird 0.7.3 (X11/20040817) X-Accept-Language: no, en-us, en MIME-Version: 1.0 To: [EMAIL PROTECTED] Subject: monitoring auto-learning with QS and fast_spamassassin Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit
I run Q-S with the st patch that use SA in fast_spamassassin more.
I turned debugging on in Q-Sst and get reports in qmail-queue.log like this:
Tue, 14 Sep 2004 11:28:57 CEST:31891: +++ starting debugging for process 31891 by uid=1002
Tue, 14 Sep 2004 11:28:57 CEST:31891: w_c: disallowed breakage found in header name ([ Priority: Normal ]
Tue, 14 Sep 2004 11:28:57 CEST:31891: w_c: elapsed time from start 0.003075 secs
Tue, 14 Sep 2004 11:28:57 CEST:31891: return-path='[EMAIL PROTECTED]', recips='[EMAIL PROTECTED]'
Tue, 14 Sep 2004 11:28:57 CEST:31891: from='"Moser adulterate" <[EMAIL PROTECTED]>', subj='xxxxxx at $1.80 per dose, XANAX!', via SMTP from 212.71.66.104
Tue, 14 Sep 2004 11:28:57 CEST:31891: clamdscan: finished scan in 0.007216 secs
Tue, 14 Sep 2004 11:28:58 CEST:31891: fprot: finished scan in 0.053026 secs
Tue, 14 Sep 2004 11:28:58 CEST:31891: fsecure: finished scan in 0.014894 secs
Tue, 14 Sep 2004 11:29:02 CEST:31891: SA: REPORT hits = 31.3/5.0
2.7 FROM_WEBMAIL_END_NUMS6 From webmail service and address ends in numbers
2.8 MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary
1.0 FROM_ENDS_IN_NUMS From: ends in numbers
0.5 SUBJECT_DRUG_GAP_X Subject contains a gappy version of 'xanax'
4.1 SUBJ_xxxxxx Subject includes "xxxxxx"
0.1 HTML_MESSAGE BODY: HTML included in message
2.0 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence between 51 and 100
[cf: 100]
5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
0.6 HTML_FONT_INVISIBLE BODY: HTML font color is same as background
0.1 BIZ_TLD URI: Contains a URL in the BIZ top-level domain
1.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.1 FORGED_JUNO_RCVD 'From' juno.com does not match 'Received' headers
4.1 FORGED_RCVD_NET_HELO Host HELO'd using the wrong IP network
0.7 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org
[<http://dsbl.org/listing?ip=210.227.143.136>]
1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?210.227.143.136>]
2.6 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
Tue, 14 Sep 2004 11:29:02 CEST:31891: SA: yup, this smells like SPAM - hits=31.3 - quarantining message...
Tue, 14 Sep 2004 11:29:02 CEST:31891: SA: required_hits 5.0 / sa_quarantine +5 / sa_delete +0
Tue, 14 Sep 2004 11:29:02 CEST:31891: SA: finished scan in 4.69408 secs - hits=31.3
Tue, 14 Sep 2004 11:29:02 CEST:31891: ini_sc: finished scan of "/var/spool/qmailscan/tmp/mailscan3109515413766031891"...
Tue, 14 Sep 2004 11:29:02 CEST:31891: ------ Process 31891 finished. Total of 4.881475 secs
There's nothing here telling me wether the the message whas auto-learned or not in bayes in SA.
I've been grepping around in SA's syslog too without ever finding anything that looks like auto-learning.
Now, where should I look to see if auto-learning works or what knobs may I have to twiddle to get this logged?
Arvinn
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Qmail-scanner-general mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
