Thanks Matt for clarification, I understand Matus complete wrong...and now I'm
completely confused.
I would understand the following:
- I check this mail first time and get eg. 3 points.
- After a while I check this mail again (the hashes and blacklist are updated)
and get now eg. 6 points.
- That make sense, you are right.
But why the hell I've got two different scores during one test? As you can see
on my first post.
Matt Kettler wrote:
age85 wrote:
Thanks for the very quick response. But how to I do that?
Do I need another script? Or is it a setting somewhere (eg in local.cf)?
How do you do what? Matus explained the results, but there's nothing to
be changed, unless you want to invent time travel.
URIBL and IXHASH are fundamentally based on reports of real-world spam.
That means they don't actually start listing a spam attribute until that
attribute appears in the wild, someone reports it, and it gets processed
into the system. That all happens pretty fast, but it still takes time,
and this really makes their results very dependent upon when you test.
If your test is really close to the start of a new spam run, these tests
will likely miss, if it's close to the middle or end, it will likely
hit. If it's a repeat run, it will also likely hit.
That's a fundamental limitation of report based systems. They're very
accurate, but the do miss a little bit at the leading edge of the storm.
On 09.04.08 05:47, age85 wrote:
we have a default slox 9 installation, please have a look at the
attached
output. We can see two different spam scores in one message. We receive
the
message with the lower spam value in the header. What's the reason for
this?
What happens with the higher value?
Received: from localhost by mail.DOMAIN.de
with SpamAssassin (version 3.1.9);
Wed, 09 Apr 2008 14:19:13 +0200 X-Spam-Checker-Version:
SpamAssassin 3.1.9 (2007-02-13) on
mail.DOMAIN.de
X-Spam-Status: Yes, score=14.5 required=5.0
tests=AWL,BAYES_99,HTML_40_50,
HTML_MESSAGE,HTML_TITLE_EMPTY,IXHASH,UNPARSEABLE_RELAY,URIBL_JP_SURBL,
URIBL_SBL,URIBL_SC_SURBL autolearn=no version=3.1.9
Received: from mail.DOMAIN.de ([unix socket])
by mail (Cyrus v2.2.3) with LMTP; Wed, 09 Apr 2008 13:22:45
+0200
X-Spam-Checker-Version: SpamAssassin 3.1.9 (2007-02-13) on
mail.DOMAIN.de
X-Spam-Level: ***
X-Spam-Status: No, score=3.5 required=5.0 tests=BAYES_95,HTML_40_50,
HTML_MESSAGE autolearn=no version=3.1.9
most of differences come from URIBL_* and IXHASH, both of those are
network
checks which usually start hitting some time after spam starts spreading
(is must be reported to get to blacklist and hash databases).
