Hi, We're using qmail-scanner for a couple of years now, with no real problems. But last night something strange happened. A user complains that he has received some spam. The subject of these mails is tagged with what we have configured in local.cf, in this case: "**** SPAM? (20.3) ****". We have configured qmail-scanner with the --sa-quarantine option so that mails with a score >= 7 will be quarantined. This is weird, the mail should have gone to quarantine. I'm sure that this subject was added by our server, as the qmail-queue.log file shows the original subject without that score. The rest of the qmail-queue.log shows the following:
<---------------[snip]-----------------> Tue, 01 Apr 2008 22:02:30 CEST:19637: SA: run /usr/bin/spamc -t 30 -f < /var/spool/qscan/working/new/vmvmai120708015054019637 Tue, 01 Apr 2008 22:02:39 CEST:19637: SA: overwriting /var/spool/qscan/working/new/vmvmai120708015054019637 with /var/spool/qscan/working/new/vmvmai120708015054019637.spamc Tue, 01 Apr 2008 22:02:39 CEST:19637: spamassassin: finished scan of dir "/var/spool/qscan/tmp/vmvmai120708015054019637" in 9.317778 secs Tue, 01 Apr 2008 22:02:39 CEST:19637: scanloop: finished scan of "/var/spool/qscan/tmp/vmvmai120708015054019637"... Tue, 01 Apr 2008 22:02:39 CEST:19637: ini_sc: scanning message took 9.352407 seconds Tue, 01 Apr 2008 22:02:39 CEST:19637: q_r: fork off child into /var/qmail/bin/qmail-queue... Tue, 01 Apr 2008 22:02:39 CEST:19637: qmail-scanner[19637]: Clear:RC:0(85.214.85.80):SA:0(0.6/5.0): 9.358264 3991 <> [EMAIL PROTECTED] failure_notice <[EMAIL PROTECTED]> 1207080150.19639-0.vmvmai:3612 orig-vmvmai120708015054019637:3991 Tue, 01 Apr 2008 22:02:39 CEST:19637: cleanup: archiving into /var/spool/qscan/archives/new/ <---------------[snip]-----------------> So it does not detect it as spam, but it does alter the subject with a score of 20.3? One reason I could imagine, is that the message is a bounce, and that the bounce contains a copy of the original message, which in turn contains a line: "X-Spam-Status: No, hits=0.6 required=5.0". Maybe somehow qmail-scanner is confused and takes the 0.6 score instead of the 20.3 ? Any help is appreciated! Greetings, Tom ------------------------------------------------------------------------- Check out the new SourceForge.net Marketplace. It's the best place to buy or sell services for just about anything Open Source. http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace _______________________________________________ Qmail-scanner-general mailing list Qmail-scanner-general@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
