No, I ran the spamassassin -d -t test as root. I'm not sure which user to
run as. I'm using qmail on plesk. I have about 6 different users with
the name "qmail" in them, plus a few "mail" related users as well as
"popuser".
Here is what's different between the two sets of headers. I threw the Bayes
part out as well because it's understandable. Does running as a different
user cause this part to be different as well? This message was manually run
through literally 1 minute later.
Automated:
* 1.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL
blocklist
* [URIs: opaqbay.com]
* 1.1 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread)
* [URIs: wildberyl.com]
Manually run as root:
* 0.3 DNS_FROM_DOB RBL: Sender from new domain (Day Old Bread)
* 0.8 RCVD_IN_DOB RBL: Received via relay in new domain (Day Old
Bread)
* 0.9 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread)
* [URIs: opaqbay.com]
* 2.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL
blocklist
* [URIs: opaqbay.com]
Matt Kettler-3 wrote:
>
> PileOfMush wrote:
>> Can someone help me understand why a message can come through and get
>> one score, then I can scan it again 1 minute later and get a much
>> higher score? Here's the message. http://slexy.org/raw/s2JoVC8OlP The
>> top copy of the message was how it was scanned coming in. Immediately,
>> I rescanned the message with spamassassin -d -t (scroll down to see
>> it). I snipped off the bottom of the long boring stuff. I'm just
>> trying to understand what's going on here so I can maintain my sanity.
>> TIA
>
> I see two big differences that jump out at me. As Duane suggested, were
> these run as the same user?
>
> The first thing that jumps out is that in the first run, URIBL_JP_SURBL
> scores 1.5 (default when bayes is enabled), but the second run it scores
> 2.9 (default when bayes is disabled).
>
> Also, the first run hit BAYES_00 for -2.6 points, but the second run did
> not hit bayes at all.
>
> It looks like your second run is as a user that doesn't have a bayes DB,
> but your first run does have one, and that bayes DB strongly thinks the
> message is not spam (less than 1% probability it is spam..).
>
> You might want to review your bayes training.
>
> See also: man sa-learn
>
>
>
>
>
>
>
>
--
View this message in context:
http://www.nabble.com/Different-Scores-tp19403311p19416161.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
