Hello Matías, Friday, February 11, 2005, 8:48:18 AM, you wrote:
MLB> I just got a spam message in my inbox without being flagged by SA, and I MLB> find it very curios because it was a clear spam message. Wen I examine MLB> the headers to see the score assigned by SA I get more surprised MLB> Content analysis details: (0.4 points, 5.0 required) MLB> 0.2 HTML_MESSAGE BODY: HTML included in message MLB> 0.2 HTML_FONT_BIG BODY: HTML tag for a big font size MLB> I copy the message a feed SA with it MLB> X-Spam-Status: No, score=2.4 required=5.0 tests=BAYES_99,HTML_80_90, MLB> HTML_FONT_BIG,HTML_IMAGE_RATIO_08,HTML_MESSAGE,MIME_QP_LONG_LINE MLB> autolearn=no version=3.0.2 MLB> OK, here it hit the rules that it was supposed to hit. But is still MLB> getting a low score. It's also hitting BAYES_99, which means your global Bayes database (since you're running as root) thinks for sure this is NOT spam. You've got a problem with the emails you've been learning in the past. MLB> What can be causing this different scores?? MLB> I thought that maybe the running user name was the problem... MLB> So I run SA before as root, now I su to the user name which receive the MLB> mail the first time and guess what... MLB> X-Spam-Status: No, score=0.4 required=5.0 MLB> tests=HTML_FONT_BIG,HTML_MESSAGE MLB> autolearn=no version=3.0.2 This suggests that maybe the user's user_prefs file is turning off some rules, or maybe you've got a configuration problem such that the user's emails aren't going against the same rules files. If you run spamassassin -D on this email from root, and from your two users, are the lists of *.cf rules files used the same? Bob Menschel
