Matt Kettler ([EMAIL PROTECTED]) had this to say on 01/13/04 at 14:22:
> At 02:12 PM 1/13/2004, Mike Leone wrote:
> >I have a spam that scored like this:
> >
> >X-Spam-Status: No, hits=2.4 tagged_above=-999.0 required=5.0
> >tests=BAYES_56,
> > FORGED_OUTLOOK_TAGS, HTML_60_70, HTML_IMAGE_ONLY_02, HTML_MESSAGE
> >
> >In my local.cf, I made the test HTML_IMAGE_ONLY_02 score 3 points. That
> >would mean that the other tests above totaled a negative value.
> >
> >I tried looking on http://www.spamassassin.org/tests.html, but I don't see
> >all the tests this email triggered (FORGED_OUTLOOK_TAGS, BAYES_56, etc).
> >So where can
> >I find the values of these tests, to manually add them up, and verify this
> >2.4 score?
>
> The local set of scores is stored 50_scores.cf, usually located in
> /usr/share/spamassassin
OK. SO
FORGED_OUTLOOK_TAGS has 4 values of 1.1 (I don't know how I can tell which
one of the 4 it's using; obviously, in this case, it doesn't matter.
HTML_60_70 is 0.359 0.100 0.516 0.113, so the total is at most 1.5.
HTML_IMAGE_ONLY_02 *should be* 3, for a total of 4.5, so far.
HTML_MESSAGE is 0.160 0.001 0.100 0.100, so at most, my overal total is 4.6.
That would mean that BAYES_56 would have to be -2.2, right? Yet this file
shows 0 0 0.001 0.001.
Even without my custom HTML_IMAGE_ONLY_02 score, that rule should be score
HTML_IMAGE_ONLY_02 2.751 2.244 1.472 1.230.
So it's not reading my custom score.
>
> also make sure to verify that SA isn't spitting out your local.cf.. run
> spamassassin --lint
I use amavisd-new to call out SA. I ran "spamassassin --lint", and it came
back clean.
Here's my local.cf:
# This is the right place to customize your installation of SpamAssassin.
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
###########################################################################
#
rewrite_subject 1
report_safe 0
always_add_report 1
subject_tag ***SPAM*** (_HITS_/_REQD_) **
# How many hits before a mail is considered spam.
required_hits 5
ok_locales en
ok_languages en
use_bayes 1
# Set this to 0 to turn off auto-learning.
auto_learn 1
auto_learn_threshold_nonspam -2
auto_learn_threshold_spam 6
bayes_path /var/lib/amavis/.spamassassin/bayes
dns_available yes
rbl_timeout 5
# We don't use DCC, Razor or Pyzor
use_dcc 0
use_pyzor 0
use_razor1 0
check_mx_attempts 2
check_mx_delay 1
# Customized scoring values.
score MSGID_GOOD_EXCHANGE 0
score PGP_SIGNATURE 0
#
# make sure theses words trigger a spamming count
#
score PENIS_ENLARGE 4
score PENIS_ENLARGE2 4
score USER_AGENT_KMAIL 0
#
# As of Jan, 2004, we've been getting much spam that is random words, and an
image.
# Additional, the words have invisible HTML comments *within* the words.
# Hopefully, some of these rules will catch that.
#
# From the SpamAssassin Mailing list:
#
score HTML_IMAGE_ONLY_02 3
body RANDOMWORD_10
/(?:\b(?!(?:from|even|more|were|with)\b)[a-z]{4,12}\s+){10}/
describe RANDOMWORD_10 string of 10+ random words
score RANDOMWORD_10 0.5
body RANDOMWORD_15
/(?:\b(?!(?:from|even|more|were|with)\b)[a-z]{4,12}\s+){15}/
describe RANDOMWORD_15 string of 15+ random words
score RANDOMWORD_15 2.5
header __MPOP_MAILER X-Mailer =~ /mPOP Web-Mail 2\.19/
header __MPOP_SUBJ1 Subject =~ /Re: [A-Z]+, \S+ \S+ \S+/
header __MPOP_SUBJ2 Subject =~ /Re: \%RND_UC_CHAR\[2-8\], \S+ \S+ \S+/
rawbody __MPOP_HTML1 /<p>\w+<\/\w+>\w+/
meta MPOP_SPAM (__MPOP_MAILER && (__MPOP_SUBJ1 || __MPOP_SUBJ2) &&
__MPOP_HTML1)
describe MPOP_SPAM Spam from mPOP Web-Mail
score MPOP_SPAM 10.0
# score HABEAS_SWE 0
# score HABEAS_HIL 0
# score HABEAS_VIOLATOR 0
# Let's get those emails from the following people NOT marked as spam, eh?
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
whitelist_from oic.wa.gov
whitelist_from butrusandwhalon.com
# whitelist_from_recvd [EMAIL PROTECTED]
Additionally, I have a copy of "backhair.cf" in my /etc/spamassassin
directory.
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Perforce Software.
> Perforce is the Fast Software Configuration Management System offering
> advanced branching capabilities and atomic changes on 50+ platforms.
> Free Eval! http://www.perforce.com/perforce/loadprog.html
> _______________________________________________
> Spamassassin-talk mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
