Ronald I. Nutter wrote: > I am trying to figure out what happened here. This one got through and > shouldnt have. I saved the message out of Outlook as a text > file and ran spamassassin in test mode. It scored enough to have been > blocked and wasnt. It scored a 5.0 and I am running sa 2.64 at default > scoring level so 5.0 should have gotten the message blocked. > > Suggestions ?
In general it's not valid to run the same message through SA at two different points in time and expect the same results if you use either bayes or any network tests (RBLs, razor, DCC, etc). It's VERY likely for RBL contents to change in a matter of 15 minutes, so this is the usual cause of "why did it get through the first time, when now it scores high enough". Check the list of hits it got the first time around, and if any RBLs got hit the second time that missed the first time, there's your answer. Other possible causes: Running the command-line SA as a different user than mail gets scanned as will result in a different bayes database being used. Perhaps changes introduced by outlook after it got scanned increased the score. Regardless, the message itself looks like a virus-generated message, something SA generally doesn't try to catch.
