Erwin Zavala wrote: > see the log below. Why is that the same host is seen as trusted > (which I want) and a few minutes later it is not. Why is it that > for the same host autolearn is bothunavailable and not. It seems > that when ALL_TRUSTED is invoke, autolearn=unavailable; when it is > not invoked, autolearn=no > > May 2 10:17:03 isis spamd[23310]: result: . -2 - > ALL_TRUSTED,FROM_ENDS_IN_NUMS,HTML_40_50,HTML_MESSAGE > scantime=1.3,size=8347,mid=<[EMAIL PROTECTED]>,autolearn=u navailable > > May 2 10:22:20 isis spamd[22294]: result: . 3 - > FROM_ENDS_IN_NUMS,HELO_DYNAMIC_IPADDR,NO_REAL_NAME > scantime=0.2,size=2828,mid=<[EMAIL PROTECTED]>,autolearn=n o
I don't think the autolearn has anything to do with the trust path. "Unavailable" simply means that SA is unable to do autolearning. This is usually due to two processes trying to learn to the same database. One will succeed, the other will show "unavailable". "autolearn=no" means that the message score does not warrant autolearning. As for the trust path, we would need to see the full headers on the two messages to diagnose it. It is quite possible for the same ip address to be trusted in one message and not trusted in another one depending on the context of the other received headers. When SA parses the headers, it follows the path from the receiving server back to the sending server. As soon as it finds an untrusted ip, everything else past that point is automatically untrusted. -- Bowie
