On 10/24/2014 05:59 PM, micah anderson wrote:
Hi,
I've got some machines that are running logcheck, they periodically send
mail to us with reports. Sometimes those mails have some spammy stuff in
them, because they are mail server logs, or web logs with some spammy
stuff in them.
I don't want spamassassin to deal with these messages, I want them to
come through no matter what. I don't want them to contribute to bayes
scoring and I don't want them ever to end up as Spam.
Unfortunately, they are, it seems mostly because URIBL scores are
hitting before the SHORTCIRCUIT/ALL_TRUSTED stuff fires, so for example:
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07)
X-Spam-Flag: YES
X-Spam-Status: Yes, score=8.1 required=6.0 tests=ALL_TRUSTED,SHORTCIRCUIT,
URIBL_AB_SURBL,URIBL_BLACK,URIBL_JP_SURBL,URIBL_WS_SURBL shortcircuit=ham
autolearn=disabled version=3.4.0
I've got the IP in trusted_networks, and internal_networks and I've got
a couple shortcircuit rules like as follows:
# simple, non-network-based whitelists, locally-generated messages,
# messages via a trusted relay chain, simple
meta SC_HAM
(USER_IN_WHITELIST||USER_IN_DEF_WHITELIST||USER_IN_ALL_SPAM_TO||NO_RELAYS||ALL_TRUSTED)
priority SC_HAM -1000
shortcircuit SC_HAM ham
score SC_HAM -20
I'd lower the SC_HAM score to -500
that will make sure stuff that hits SC_HAM really sticks out...
