PileOfMush wrote: > No, I ran the spamassassin -d -t test as root. Well, if you use spamd, that's definitely not the right user. Spamd will never scan as root.
> I'm not sure which user to > run as. I'm using qmail on plesk. I have about 6 different users with > the name "qmail" in them, plus a few "mail" related users as well as > "popuser". > Hmm, I'm unfamiliar with both qmail and plesk... As a general suggestion, as root run locate bayes_toks And see which home directories contain bayes DBs.. look for the one that's recently updated. run as that user. > Here is what's different between the two sets of headers. I threw the Bayes > part out as well because it's understandable. Does running as a different > user cause this part to be different as well? Bayes being enabled or not changes the score of *all* the rules. So that's quite normal. Generally the system puts a lot of trust bayes, since it is generally hand-trained and hand corrected. The RCVD_IN_DOB is a little odd, but that could have timed out on the first run, but been cached for the second one. Regardless the two rules that hit that did not hit in the first run total to 1.1 points, and are much less of a difference than the bayes impact. (-2.6 for BAYES_00, and URIBL_JP_SURBL is reduced by 1.4 points, so bayes is directly involved in 4 points of difference). In a well trained scenario, this should have hit BAYES_99, for +3.5 points, instead of -2.6 for BAYES_00, causing the bayes run to score much higher. That's a 6.1 point swing. Big difference. > This message was manually run > through literally 1 minute later. > > Automated: > * 1.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL > blocklist > * [URIs: opaqbay.com] > * 1.1 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread) > * [URIs: wildberyl.com] > > Manually run as root: > * 0.3 DNS_FROM_DOB RBL: Sender from new domain (Day Old Bread) > * 0.8 RCVD_IN_DOB RBL: Received via relay in new domain (Day Old > Bread) > * 0.9 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread) > * [URIs: opaqbay.com] > * 2.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL > blocklist > * [URIs: opaqbay.com] > >
