On Tue, 16 Aug 2011 00:48:13 Bowie Bailey wrote:
> On 8/15/2011 10:57 AM, Rodney Baker wrote:
> > Hi all. I'm running spamassassin 3.3.1 on my openSuse 11.2 box at home.
> > Mail is collected from multiple ISP mail accounts via fetchmail and
> > delivered to local IMAP mail folders via procmail. My user account
> > .procmailrc file begins
> >
> > thus:
> > LOGFILE=$HOME/pm.log
> >
> > :0fw: spamassassin.lock
> > :
> > | spamc
> > :
> > :0
> >
> > * ^Subject.*SPAM\([0-9]{1,3}\.[0-9]\).*
> > $HOME/Maildir/.Spam//
> >
> > I'm attempting to filter on the modified subject line (which for some
> > reason isn't working - that rule never seems to match and spam never
> > gets moved into the Spam folder, even though I've tested the regex
> > manually). I thought of filtering on the X-Spam-Status header instead,
> > but when I had a look at a message that was marked as Spam (according to
> > the subject line) I found something rather strange...
> >
> > X-Virus-Flag: no
> > X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
> >
> > <my.local.mailhost.name.removed>
> >
> > X-Spam-Level: *
> > X-Spam-Status: No, score=1.5 required=6.5
> >
> > tests=BAYES_00,IMPOTENCE,NO_RELAYS
> >
> > autolearn=no version=3.3.1
> >
> > X-Spam-Virus: No
> > Received: from localhost by <my.local.mailhost.name.removed>
> >
> > with SpamAssassin (version 3.3.1);
> > Mon, 15 Aug 2011 18:58:01 +0930
> >
> > From: "Adele Key" <spam.address.removed>
> > To: another.u...@iinet.net.au
> > Subject: ****SPAM(10.1)**** <spam-subject-removed>
> > Date: Mon, 15 Aug 2011 18:12:48 +0900
> > Message-Id: <165971112.54106003786840@spamdomain.removed>
> > MIME-Version: 1.0
> > Content-Type: multipart/mixed;
> > boundary="----------=_4E48E6A1.127A41A2"
> > X-Length: 7330
> > X-UID: 83487
> > X-KMail-Filtered: 61220
> > Status: R
> > X-Status: N
> > X-KMail-EncryptionState:
> > X-KMail-SignatureState:
> >
> > X-KMail-MDN-Sent:
> > Spam detection software, running on the system
> > <my.local.mailhost.name.removed>, has
> > identified this incoming email as possible spam. The original message
> > has been attached to this so you can view it (if it isn't spam) or
> > label similar future email. If you have any questions, see
> > postmaster for details.
> >
> >
> > Content preview: [...]
> >
> >
> > Content analysis details: (10.1 points, 6.5 required)
> >
> > pts rule name description
> > ---- ----------------------
> > ---------------------------------------------- 3.8
> > KB_DATE_CONTAINS_TAB KB_DATE_CONTAINS_TAB
> > 3.0 IMPOTENCE BODY: Impotence cure
> > -0.0 BAYES_20 BODY: Bayes spam probability is 5 to 20%
> >
> > [score: 0.1050]
> >
> > 2.0 KB_FAKED_THE_BAT KB_FAKED_THE_BAT
> > 1.2 RDNS_NONE Delivered to internal network by a host
> > with no
> >
> > rDNS
> >
> >
> > I don't get it - the content analysis shows a score of 10.1, the modified
> > subject line shows 10.1, but the X-Spam-Status header shows 1.5! What
> > have I messed up in my configuration?
>
> This message is going through SA twice.
>
> The first time, it is marked as spam and the message is re-written per
> your "report_safe" setting. This generates the analysis shown in the
> body itself.
>
> The second time, the re-written message is scanned by SA. This time,
> all of the incriminating stuff has been hidden by the rewrite, so it is
> not marked as spam. This is the analysis shown in the header.
>
> You need to fix whatever is causing the message to be scanned twice.
OK - that makes sense. Now I'm wondering if there is a global mail config
somewhere that is routing the message through SA, and then my local
.procmailrc is doing it again. Time to go digging...
That then leaves the question as to why my procmail recipe isn't triggering on
the rewritten subject, but that is probably not for this list.
Thanks for the pointer.
Rodney.
--
======================================================
Rodney Baker
rod...@jeremiah31-10.net
web: www.jeremiah31-10.net
======================================================
